Vermont Passes Data Broker Law – First in US!

Vermont became the first state in the nation to pass data broker legislation last week, regulating the commercial businesses that buy and sell personal information of consumers. The new law passed on last Tuesday and requires data brokers to register with the state and pay a $100 annual fee, among other important things.

The world has been focused on the collection and sharing of data for the past few months as businesses were focused on preparing for the EU General Data Protection Regulation (GDPR) and the Facebook – Cambridge Analytica scandal gained widespread attention in the media and among consumers. This is the first law aimed at the practices of data brokers, who are at the heart of these issues since they often don’t have any direct relationship with consumers, yet possess a great deal of their sensitive information.

Data brokers operating in Vermont will now face new security standards requiring the protection of the data of consumers (encryption for all sensitive data), as well as transparency requirements to inform consumers about the data they collect and clear instructions for opting out (if the option is available).

The legislation also contains a notification requirement for wrongdoing. Data brokers that suffer a data breach or violate the law will be required to inform authorities of the incident.

The bill also makes the fraudulent acquisition of data illegal. This includes the acquisition of data for purposes of ID theft, discrimination, harassment or stalking.

It also eliminates the fees required to freeze credit reports and lift the credit report freeze. The credit reporting bureaus have to allow Vermont residents to control their accounts and they will not be allowed to charge the $10 and $5 fees.

The law defines a “data broker” as a business that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.

The Vermont Attorney General applauded the new law in a statement released last Thursdy. The Vermont Governor objected to the law earlier in the spring because of the annual fee imposed on these businesses but decided to allow the bill to become law without his signature.

Discover the Benefits of Privacy Management Software with Clarip

The Clarip data privacy software and team are available to help improve privacy and trust at your organization. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.

If you are working towards GDPR compliance, try our modular GDPR software. Start with our automated GDPR data mapping software, enhance your privacy program with DPIA software, and meet ePrivacy requirements with the cookie consent manager.

If CCPA compliance in 2020 is on your radar, ask us about our California Consumer Privacy Act software. Improve efficiency of responses to data subject access requests with our DSAR Portal, or provide the right to opt out of the sale of personal information with our consent software.

Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.

Other Blog Posts on Privacy Laws:

Chicago Considering Personal Data Collection and Protection Ordinance
New Mexico Privacy Bill Copies CCPA
New York Considering Privacy Law – Right to Know Act
New PIPEDA Rules for Data Breach Reporting in Canada