New law, first of its kind, sets up broker registry, penalties

Pedigree

The state of Vermont – home to notable residents Bernie Sanders and Ben & Jerry’s – has been ahead of the curve on important legal issues for quite some time. Vermont abolished slavery before any other state, was the first state to allow same-sex marriage without a battle in the courts and adopted women’s suffrage before the country officially did. In May 2018, the Green Mountain State made history again with another first – a state bill that takes aim at the power of data brokers.

Getting to Know ALL About You

People are well-acquainted with the idea of certain services (Facebook, Google, Amazon, iTunes) gathering our data for the purpose of creating better service offerings for us. We’re also well-aware that these companies (and others) have been accused of surreptitiously gathering our data and even swapping it among competitors and partners. Data brokers, on the other hand, are slightly harder to define and are certainly less visible to the average consumer. Data brokers do not seek to provide useful services to consumers; rather, they mainly collect, purchase and share data on individuals with other companies and services. Data brokers also gather inferred data that approximates information that is normally protected by law. For example, your medical records cannot be shared without your permission. However, your credit card purchases at a local pharmacy might be added to your profile with a data broker, who can then infer from the purchase what your medical issues are. The

Takeaway

ermont’s new law is succinct: “‘Data broker’ means a business … that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” Companies that fit the definition will be governed by the law’s four basic provisions, according to the Vermont attorney general:

• Brokers must meet certain minimum security standards for consumer data.

• They must cease charging fees for initiating and lifting credit report freezes.

• The law mandates a state-run registry that provides consumers with information about brokers, opt-out instructions and alerts when data breaches occur.

• The law creates legal penalties for fraudulent acquisition or improper use of brokered data.

In and of themselves, these rules seem unlikely to immediately impact advertisers and marketers, but along with recent industry efforts to codify data privacy and transparency, a seismic shift may be pending beneath big data’s feet. The use of data brokers is an important practice, typically unknown to consumers, and one that many companies and advertisers use to market relevant products to individuals. Data brokers are also valuable assets for companies seeking to broaden their reach to new consumers and tap into previously untouched communities. This Vermont law may begin a wave of state-specific legislation across the country regulating the type of practices data brokers can engage in and will undoubtedly have legal implications for data brokers engaging with Vermont’s residents in the near future.