Office of the Vermont Attorney General

A.G.: New Data Broker Law Is Good for Vermonters

May 24, 2018

Contact: Chris Curtis, Chief of Public Protection, (802) 828-5586

Attorney General TJ Donovan applauded lawmakers for passage of a new law that protects consumers from credit freeze fees, fraudulent acquisition of Vermonters’ data, and establishes a registry and security standards for the “data broker” industry. Vermont is the first state in the nation to successfully pass data broker legislation.

“This new law slashes fees, helps stop fraudsters, and promotes transparency,” said Attorney General TJ Donovan. “Vermonters care about their privacy,” said Donovan. “This bill not only saves them money, but it gives them information and tools to help them keep their personal information secure,” he said.

Data brokers are commercial entities that buy and sell personal information of millions of consumers annually. Many data brokers are unknown to consumers because they have no direct relationship with them. Increasingly the public is concerned about the use – and misuse – of sensitive information that directly affects them. These are transactions over which consumers have very little control.

The new law contains four essential elements:

  • Eliminates fees. Currently Vermonters are compelled by statute to pay $10 to initiate a freeze of their credit reports should they choose to do so following a data breach; another $5 is levied to lift the credit freeze. If every Vermonter affected by one of the most recent breaches took advantage of a credit freeze and lifted a freeze at each of the major credit reporting agencies it would represent more than $10 million of savings to Vermonters. Eliminating fees is good for consumers affected by data breaches;
  • Protects consumers from fraud. Makes it illegal under the Consumer Protection Act for fraudulent acquisition of data, or acquisition of data for purposes of stalking, harassment, ID theft, or discrimination – an important deterrent;
  • Clarifies minimum data security requirements. Data security for commercial actors – especially in a business model that trades in brokered personal information of consumers – is both important and already enshrined in law by at least one neighboring state (Massachusetts). The new law is consistent with our sister state of Massachusetts and helps provide clarity in this area for businesses; and
  • Sunlight and Transparency. Providing consumers with information about commercial entities with whom they have no direct relationship and what options they may have to opt out of certain lists or offerings provides transparency, provides them real options when or if a data breach occurs that may affect them, and provides consumers and regulators with important information about a growing industry.

New revelations about data breaches and exposure of consumer information from major companies has become almost routine. Donovan convened a working group in partnership with the Department of Financial Regulation that issued a report and recommendations in 2017 with a menu of options for the legislature to consider, including elements contained in the new law. “I’m proud of the work my office has done to convene stakeholders, hear from Vermonters, and balance commerce and common sense,” Donovan said.

The Attorney General said the state has a strong public safety interest in transparency, data security, and consumer protection generally with respect to commercial interests that elect to engage in the business of buying and selling consumer data without the consumer’s knowledge.

The Attorney General stressed the new law and registration requirement is a “light touch” that imposes no burdensome regulation and requires no major changes to procedure. It is simply a registry where businesses can describe current practices and procedures for consumers to access.

The Vermont Secretary of State’s Office will host the registry. Secretary of State Jim Condos said, “Transparency of information is great when it comes to government, but not for individuals and their personal information. Vermonters expect and deserve privacy. I’m pleased that my office can assist in this first step toward the regulation of data mining companies.”

The Attorney General thanked Vermonters, the General Assembly, industry professionals and partner agencies for their participation which resulted in the new law.

Last modified: May 30, 2018