Vermont Enacts First U.S. Law Governing Data Brokers

With summer approaching, we would hope to see new flavors of ice cream coming out of Vermont. Instead, Vermont has just delivered a new law that imposes data security and privacy-related obligations on data brokers and, beginning January 1, 2019, will require them to register annually with the state. The law is the first in the United States specifically governing data brokers.

The New Law
The Vermont legislature acknowledges in the introduction to the new law that data brokers provide information that is "critical to services offered in the modern economy," including targeted marketing and sales; credit reporting; and decisions by banks, insurers, and others as to whether to provide services.