[M]onths after a first-in-the-nation law on data brokers took effect, only a small fraction of companies believed to be buying and selling Vermonters’ consumer information are fully complying.
One of the companies offering incomplete information to the state is Equifax, a credit reporting company that spurred the creation of the law after a data breach in 2017 exposed the personal information of 143 million Americans.
Last year, as part of a sweeping package of new measures to regulate data brokers, legislators passed a bill establishing a mandatory registry for the businesses that broker consumer data.
The registry was intended to help reveal which data brokers are operating in Vermont, give consumers a better idea of what information the companies collect, and provide the public with instructions about how to opt-out of data collection, if possible.
But since the registry went live in January, only about 140 companies have registered. The Attorney General’s Office reported last year that there are likely between 400 and 1,200 data brokers buying or selling personal information from Vermonters.
“Given what we know about how our data is used out there, anecdotally, I think we all expected it to be higher than this,” said Chris Winters, the Vermont’s deputy secretary of state, whose office manages the registry.
The Washington Post first reported on the state of Vermont’s data broker registry last week.
The Post wrote that while some data firms have yet to register with the state, others offer incomplete information about their collection practices and how consumers can opt out of them.
Several registered brokers including Truthfinder LLC, a company that provides online background checks; Forewarn, a data service used in the real estate industry; and Datastream Group Inc., a marketing data company, say that consumers can opt out of some data collection, but offer no instructions, or details about how to do so.
But while the legislation establishing the data broker directory requires companies to register with the state, it doesn’t necessarily require them to provide complete responses about their collection practices.
“If you read the law closely, it does not appear that the law addresses that situation,” said Assistant Attorney General Ryan Kriger. “So that’s an issue.”
Data brokers who don’t register with the state, however, can be fined $50 per day, and up to $10,000 each year.
Kriger said the Attorney General’s Office can’t comment on whether it is investigating any firms skirting the new regulations.
The attorney general’s office has been reaching out to companies it believes may not be in compliance and encouraging them to register.
Kriger said the office is trying to foster “a culture of compliance,” over cracking down on companies that may have yet to register.
“I don’t think that the goal of this law was to make Vermont the police of the data broker industry,” he said.
The Attorney General’s Office doesn’t know of all of the data brokers that operate in the state, and often relies on tips from academics, businesses and journalists to learn of brokers that aren’t in compliance, Kriger said.
Rep. Michael Marcotte, R-Coventry, who chairs the House Commerce and Economic Development Committee, which wrote last year’s data broker regulations, said he wasn’t surprised to hear only 140 companies had registered.
“I think when we did the legislation we knew that not everybody was going to register,” Marcotte said. “We knew the good players were going to register.”
He said that his committee is expecting a report in January on the new law from the Attorney General’s Office, and will be looking at it again in the next legislative session.
“We’ll take another look at it next session and see what else needs to be done to further encourage those brokers to register in the state,” he said.
