Vermont Becomes First U.S. State to Pass Law Regulating Data Brokers

The state of Vermont becomes the first in the U.S. to pass a law that imposes regulations on data brokers.

Data brokers are companies that collect information on organizations and individuals sourced from various channels and subsequently analyze them for various purposes. Examples of data brokers are credit score rating companies, like Equifax.

Reports note that Vermont’s newly enacted law (H.764) is the first to seek oversight on how data brokers operate. One of the requirements imposed by the law is an annual $100 registration fee paid to the state, which Gov. Phil Scott has reportedly objected to.

However, the law was passed on May 22 even without Gov. Scott’s signature.

Meanwhile, in H.764’s draft bill, it was apparent that one of the striking motivations for passing the law was the possibility of a cyber breach that puts people’s sensitive information at huge risk.

“While neither government nor industry can prevent every security breach, the State of Vermont has the authority and the duty to enact legislation to protect its consumers where possible,” H.764 reads.

In 2017, millions of Americans whose information was profiled by Equifax were exposed following a cyber breach. Earlier this month, the company provided a full brief on the massive data leak and confirmed that data on the names, social security numbers, birth dates, and addresses of at least 143 million U.S. consumers, as well as around 209,000 credit card numbers along with their espective expiration dates, were stolen.

The H.764 draft bill further shows that the state aims to require data brokers in adopting “information security program with appropriate administrative, technical, and physical safeguards” to protect the people’s information from any form of security risk.

Meanwhile, considering that there are people who may not be familiar with data brokers, the new law also seeks to push companies to adhere to policies that would require them to properly inform consumers of what types of data they are collecting and the consumers' right to opt out of these services.