Minnesota And Vermont Legislatures Pass Comprehensive Privacy Laws

In the past several weeks, the Minnesota governor has signed into law the Minnesota Consumer Data Privacy Act, while the Vermont Data Privacy Act has been passed by the legislature and awaits the governor's signature. Both of these laws include provisions that depart from the general model set by state comprehensive privacy laws enacted to date.

Vermont's bill is particularly notable because it is the first state comprehensive privacy law to include a private right of action for privacy-related violations. (The California Consumer Privacy Act, the only other comprehensive privacy law with a private right of action, limits the applicability of its cause of action to certain security incidents.) The bill has received strong opposition from certain business groups that are urging Vermont's governor to veto the law. Assuming it is eventually signed into law, "large data holders" and data brokers registered under Vermont's data broker law (the types of entities that are