Vermont Business Magazine Attorney General TJ Donovan, in partnership with the Department of Financial Regulation, issued a report to the Vermont General Assembly that recommends regulation of the Data Broker Industry, otherwise known as “Big Data.” If the Assembly adopts the recommendations, Vermont would become the first state to implement Data Broker regulation.
“I have traveled all over the state and heard from many Vermonters who are frustrated and concerned that businesses are collecting their personal information, and people have no say in the matter,” said Attorney General Donovan. “Privacy is a fundamental value here in Vermont, and I look forward to work with the Assembly to draft a bill that will restore some balance in this area.”
Data Brokers are businesses that collect personal data in order to resell it to third-parties. Recent incidents involving Data Brokers have raised concerns that businesses collecting information about Vermonters are not taking sufficient steps to protect that information. Additional concerns have been raised that Data Brokers are not providing citizens with enough control over their own personal information, and that Vermonters’ personal information is at risk of being captured by criminal elements. The most recent example of a Data Broker failing to properly protect consumer information is the recent Equifax breach.
The Assembly directed the Attorney General and DFR to study the data broker industry and issue a report in the last legislative session. For the past six months, the two agencies have been diligently researching the industry, reviewing reports of other investigations, and debating possible recommendations. In July, the Working Group held two days of hearings in Burlington. At the hearings members of industry, consumer advocacy groups, and human rights groups weighed in on the question of Data Broker regulation. In November, the Working Group attended the legislature’s listening tour and heard concerns from Vermonters who gathered in Brattleboro, Manchester, Barton and Burlington.
The report has been posted to a dedicated website which also collects all submitted comments, video of the hearings, and an archive all documents relied in on the report. The website address is: http://ago.vermont.gov/focus/consumer-info/privacy-and-data-security1/data-broker-working-group.php.
S.72 it required the Attorney General and DFR to provide a recommendation or draft legislation regarding Data Brokers. The full text of S.72 can be found here.
The report makes six recommendations for potential legislation:
- Amend Vermont’s credit-freeze law (9 V.S.A. § 2480h) to prohibit credit reporting agencies from charging a fee to freeze or unfreeze consumers’ credit reports;
- Provide consumers with more information about opt-out rights and how to exercise them, by requiring Data Brokers to provide the State of Vermont with certain information;
- Create new causes of action, enforceable by a consumer or the Attorney General, against those who acquire data with the intent of committing certain wrongful acts;
- Require data brokers to employ reasonable security methods to protect data;
- Require data brokers that suffer certain data breaches to quickly provide notice of the breach; and
- Protect children by prohibiting the sale of data about certain minors without parental consent.
The Attorney General thanked Vermonters, industry professionals and partner agencies for their participation which resulted in a balanced report and recommendations.
Source: Vermont AG. 12.18.2017