This is a #privacy #bigdeal.👇🏻Do companies start #optingout of certain states due to #PRA risk? Not a viable strategy for long term as data practices continue to become more heavily regulated x ♾️ in more and more states/national level. #privacylaws #moreprivacylaws More press from CR on this here touting the pro consumer features of the law: https://lnkd.in/euCgq_2K.
BIG BREAKING: It happened. The elusive ripple of a private right of action has now become a reality in the U.S. state privacy law patchwork courtesy of Vermont. The Vermont General Assembly went down to the wire May 10 to grant final passage to House Bill 121, a comprehensive privacy law with a targeted right of action AND data minimization standards. The PRA is limited to data brokers and “large data holders,” which are companies carrying data on more than 100k Vermonters. May create less animosity around potential frivolous lawsuits. Minimization language requires companies to limit practices to what is “reasonably necessary and proportionate.” Those standards won’t cover sensitive data, which will still require user consent for processing. The bill also contains stiff health data standards, data broker registry and “credentialing,” children’s privacy provisions and much more. This is a big deal. Blue states still left on the board (and maybe those able to amend existing law) can turn to this bill as an example of what’s possible and palatable. A shift is not assured, but the potential alone may change the patchwork outlook forever. Here’s the bill page:
Dan Frechtling
1mo
I wonder if this limited PRA will be an anomaly or a precedent. With the dearth of MHMD private lawsuits in WA, it seems Joe's right that a limited PRA will minimize frivolous lawsuits.
Practical Problem Solver + Trusted Consigliere
1moWill be interesting. Vermont has the distinction of already having one privacy law struck down by the Supreme Court. It will be interesting to see how the business community reacts. Carl Szabo ?