Orvis and other Vermont-based online retailers have emerged as the public face of an effort to roll back key elements of a comprehensive consumer data privacy bill advancing in the state legislature.
The opposition campaign mirrors a similar effort this year in Maine — featuring companies such as L.L. Bean — that resulted in data privacy legislation being defeated.
While popular home state companies have been out front, the bills in Maine and Vermont have also drawn the attention of national business groups that say the legislative proposals will have unintended consequences for both consumers and businesses.
Rep. Monique Priestley (D), a lead sponsor of the Vermont privacy bill, told Pluribus News that she believes the fights in both states are part of a national playbook to pass weak data privacy laws, and that local companies have been activated through “fear mongering.”
“They’re fighting because they’re being told that they should be scared,” Priestley said.
L.L. Bean said in a statement that it did not coordinate with out-of-state interests “in any way” and had to oppose the bill after last-minute changes in the House made it unlike any other state law.
“We shared our individual experiences complying with laws in other states, encouraging the Maine Legislature to utilize existing models to ensure Mainers have the same protections afforded to other consumers and to provide a level of interstate continuity,” the company’s statement said.
In a hearing Friday in Montpelier, Vt., Rob Bean, Orvis’s chief financial officer, told the House Commerce and Economic Development Committee that his company supports data privacy laws but that details matter.
“I feel a lot of alignment with where we want to go,” Bean said. “We’re just very scared, frankly, because we have been punished by laws that left open the door for the wrong actors to do the wrong things.”
Like the defeated Maine proposal, the Vermont privacy bill drew business opposition because it broke from an industry-accepted national template that was passed in more than a dozen states.
Priestley, who wanted to enact something more consumer-protective, said the bill she and her colleagues introduced in January was designed as a beefed-up version of Connecticut’s data privacy law. It included a stricter standard for how much data companies can collect from individuals, as well as a private right of action, which would allow individuals to sue to enforce the law — something businesses vehemently oppose.
The bill drew comments and suggested amendments from national industry groups, including the Computer and Communications Industry Association and the State Privacy & Security Coalition, as well as from Microsoft. On the other side, privacy advocates such as the Electronic Privacy Information Center suggested ways to strengthen it.
Vermont-based companies including Orvis, the Vermont Country Store, Gardener’s Supply Company and King Arthur Baking also took notice. After the House unanimously passed the bill last month, the companies turned their attention to the Senate and intensified the drumbeat to scale back the bill.
Top leaders at the companies voiced their objections in a jointly signed email to lawmakers. They wrote that while they support consumer privacy, “we are extremely concerned about provisions in the current version of H.121 that would affect the ability of our businesses and other small to mid-size companies that also do business online.”
The Senate Committee on Economic Development, Housing and General Affairs significantly amended the bill last week by narrowing the universe of companies to which the law would apply, adopting a different data collection standard, and removing the private right of action language, among other changes.
The committee’s chair, Sen. Kesha Ram Hinsdale (D), said it was local businesses’ concerns that convinced her to make the changes.
“We’re a tourist-based economy and we’re a small state, and I’m not listening to anybody but our Vermont small businesses,” Ram Hinsdale told Pluribus News.
Ram Hinsdale said she was concerned the private right of action would lead to class-action lawsuits that could “annihilate a business.” She said several of the changes the committee adopted were aimed at bringing the bill more in line with Connecticut’s law.
“Connecticut is in our region, they have built a standard that people recognize in New England, and it made sense to start there and then build a shared understanding of what we might change,” she said.
In a statement, Orvis praised the Senate’s amendments as “striking a balance between data privacy protection for consumers, while supporting needs critical to Vermont’s business community, including Orvis.”
Consumer and privacy advocates have argued that existing state privacy laws have been overly influenced by industry and do not give consumer’s meaningful control over their data. A recent report card from EPIC and the Public Interest Research Group gave Connecticut’s law a D grade. A February report from Connecticut’s attorney general also identified weaknesses in the law and made recommendations for strengthening it.
“It’s a David vs. Goliath situation,” said Caitriona Fitzgerald, EPIC’s deputy director. “It is small, nonprofit advocacy groups vs. big tech with their unlimited funds to hire lobbyists and influence politicians.”
In a statement, Andrew Kingman, counsel to SPSC, a multi-industry group that has played a key role in data privacy laws passed across the country, said it should be “no surprise” that when state lawmakers introduce bills that significantly deviate from the laws elsewhere, it draws “concern from all corners of a state’s economy.”
“[C]onsistent regulations are critical to provide businesses with the certainty and stability they need to plan,” Kingman said.
Consumer advocates scored a recent win in Maryland when the General Assembly approved legislation that limits the information companies can collect about online users to “what is reasonably necessary and proportionate” to provide the service or product the customer is requesting. That is a stricter standard than other state privacy laws.
On Friday, Priestley invited the sponsor of that bill, Del. Sara Love (D), and a bipartisan group of four other current and former state lawmakers from Kentucky, Maine, Montana and Oklahoma to share stories with the House Commerce Committee about trying to pass data privacy laws in their states and the industry opposition they encountered.
“The more they pushed, the more we said … ‘Enough, OK we’re going to pass something that matters,’” Love said. “So it somewhat backfired [for] them.”
With the legislature’s adjournment looming next month, the Vermont bill’s fate is uncertain. Priestley, the House sponsor, called the Senate’s changes “disappointing” and said they made the bill “much weaker.” Priestley said her House colleagues are unlikely to accept the Senate’s amendments which could send the bill to a conference committee.
“I am optimistic that in conference we’ll have the opportunity to have a discussion about what the changes actually mean for Vermonters in order to negotiate the strongest bill possible,” Priestley said.
This story was updated to include a statement from Orvis about the Senate bill.