OP-ED: A Data Privacy Law for All of Us

May 17, 2024 | By Charity Clark 

Last week, the Vermont Legislature voted out one of the most impactful consumer bills seen in decades,  H.121, an act relating to enhancing consumer data privacy and the age-appropriate design code. I am proud to say that I was one of the original authors of H.121 – and humbled to say that the final bill that passed is much, much better. 

In the bill, consumer protections for our data privacy are balanced with protections for small businesses and the beneficiaries are all of us -- consumers, the marketplace,  businesses and children. 

First, let’s talk about the consumer protections of the bill. In essence, the bill creates mechanisms for data minimization and empowers consumers to be able to request that a company destroy their data. It also creates robust protections for sensitive data, like biometric data (such as your face, your fingerprint, your DNA) or your Social Security number. In an increasingly online marketplace, these protections are essential to preserving Vermont’s ethos of privacy. 

The protections for small businesses are profound and, in some cases, novel. First, small businesses are completely removed from the scope of the bill. The bill does not apply to businesses and other holders of consumer data who hold data for fewer than 25,000 consumers. Also, consumers may bring a lawsuit if their privacy rights are violated only against data holders that process the data of 100,000 consumers or more annually and only if the violation involves sensitive data. And, even then, only after a 60-day “cure period” lapses, during which time a data holder in violation of the law may correct the breach of the law.  

In addition, the bill contains groundbreaking protections for children in Vermont. If passed, Vermont will join a small group of states leading the effort to establish specific and meaningful safeguards for children on social media platforms, provisions informed by the expertise gained by my office’s investigation into  Meta. It also bans the collection and sale of children’s data without notice and consent. In Vermont, our children’s privacy should not be for sale. 

During the legislative process, I was disappointed by the dark influence of Big Tech which attempted to manipulate lawmakers and small businesses and spread misinformation, as I have written about before. But Vermonters can be proud of the process that took years of thoughtful consideration, research, testimony, and collaboration. There is a reason why the bill was voted out of the House committee where it originated and the House itself unanimously. 

A tripartisan effort, H.121 represents the best of  Vermont: sticking up for our values and standing up to big corporate interests.

Charity Clark is Vermont’s Attorney General.