Vermont Modifies Provisions on Data Brokers and Consumer Credit Protection

Vermont recently enacted H.764 to modify its provisions relating to the regulation of data brokers in connection with the security of consumer personal information, and the protection of consumer credit.  The new provisions (1) require data brokers to register annually with the Secretary of State and to maintain adequate data security standards, and (2) remove financial barriers for consumers to place or remove a security freeze on their credit reports on file with the national credit reporting agencies.

Under the Vermont Statutes governing the protection of personal information, new defined terms are added to include “data broker” and “data broker security breach,” among others.  A “data broker” means a business that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.  A business that meets this definition must register annually with the Secretary of State, pay a registration fee of $100, and disclose certain information about the data broker’s data collection practices.  Further, data brokers are required to maintain minimum security standards by developing and implementing a comprehensive information security program to protect personally identifiable information.  A violation of these data security standards is considered an unfair and deceptive act in commerce, for which the Attorney General is authorized to bring an enforcement action.

In addition, under the Vermont Statutes governing consumer protection and fair credit reporting, a consumer may now place or remove a security freeze on his or her credit report at no charge, regardless of whether the consumer is a victim of identity theft.  Previously, only victims of identity theft were exempt from paying the $10 fee to place a security freeze and the $5 fee to lift temporarily or remove a security freeze.  The amended provisions eliminate these fees and prohibit credit reporting agencies from charging a fee to place or remove a security freeze.

The provisions governing the regulation of data brokers are effective on January 1, 2019, and the provisions governing consumer credit reports are effective immediately.