With little national fanfare, Vermont’s new data brokering law – requiring businesses which buy and sell your personal data to register and disclose to the state of Vermont that they are a data broker – went into effect a few weeks ago.
The law, Vermont House Bill 764 (Full Text of Vermont Data Broker Law H.764 here), and titled “An act relating to data brokers and consumer protection”, requires that any company that “knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship” be classified as a data broker, and must register with the state of Vermont, pay an annual $100 registration fee, and disclose certain information about their practices.
Some news outlets are touting the Vermont law as the country’s first of its kind. However, as we first reported here, the California Consumer Privacy Act was also passed in 2018. It is true, however, that Vermont’s law is the first one to go into effect, as it became effective in January of this year; California’s law goes into effect on 1/1/20.
Vermont’s law defines any business that “knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship” as a data broker.
And the law defines “brokered personal information” as “one or more of the following computerized data elements about a consumer, if categorized or organized for dissemination to third parties: (i) name; (ii) address; (iii) date of birth; (iv) place of birth; (v) mother’s maiden name; (vi) unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data; (vii) name or address of a member of the consumer’s immediate family or household; (viii) Social Security number or other government-issued identification number; or (ix) other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.”
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Any business meeting the above criteria (and a few others which you can read in the full text of the law if you like) must register with the Vermont Secretary of state, pay the annual registration fee of $100, and also disclose their name, address, email address, and their Internet address.
The data broker must also disclose whether or not they permit the consumer to opt out of the broker having their personal data, how the consumer can opt-out, and, if they have data from which the consumer may not opt-out, then “a statement specifying the data collection, databases, or sales activities from which a consumer may not opt out.”
They must also disclose:
- a statement whether the data broker implements a purchaser credentialing process;
- the number of data broker security breaches that the data broker has experienced during the prior year, and if known, the total number of consumers affected by the breaches;
- where the data broker has actual knowledge that it possesses the brokered personal information of minors, a separate statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the brokered personal information of minors; and
- any additional information or explanation the data broker chooses to provide concerning its data collection practices.
The law also, in a separate section, provides new rules for credit reporting agencies.
Said Vermont Attorney General TJ Donovan, “This new law slashes fees, helps stop fraudsters, and promotes transparency. Vermonters care about their privacy. This bill not only saves them money, but it gives them information and tools to help them keep their personal information secure.”
The portal for completing and submitting the annual filing is here.
You can read Vermont’s guidance on the new law here.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
I am attempting to manifest that Annie, might share with us (in the “Explaining the Law” area) her concept of “privacy” in the USA, and what if any support she sees for it in the US Constitution (Griswald?) and how it variously would apply to different parts of modern US life — AND since there’s now a non-US GDPR and Vermont and CA — does Annie feel that any deficiencies in constitutional privacy protection can be addressed adequately through statute and / or by the states — or if a constitutional amendment would be necessary to do it right?