The Democrat-controlled Vermont legislature has passed one of the strongest data privacy measures in the country aimed at cracking down on companies’ use of online personal data, which would let consumers file civil lawsuits against companies that break certain privacy rules.

However, Republican Gov. Phil Scott has concerns about how part of the legislation could affect small businesses. He hasn’t seen the final bill that passed early Saturday before the Legislature adjourned. He will make a decision once he’s had a chance to review it, his spokesperson Jason Maulucci said Tuesday.

The bill prohibits the sale of sensitive data, such as social security and drivers’ license numbers, financial or health information. It also sets meaningful limits on the amount of personal data that companies can collect and use, according to the nonprofit Electronic Privacy Information Center based in Washington, D.C.