New Vermont Law Regulates Data Brokers

The Green Mountain state is the first in the country to enact (without its governor's signature) a new law establishing a registry and security standards for data brokers.  A data broker is defined in the law as a "business.... that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship."  The law further defines "brokered personal information" as personally identifying "computerized data elements about a consumer," such as name, address, biometric data, or other information that would "allow a reasonable person to identify the consumer with reasonable certainty" and which is "categorized or organized for dissemination to third parties."  It does not include publicly available information that relates to a person's business or profession.