Lead brokers have long been subject to telemarketing laws- a lead vendor could not knowingly sell leads to a calling company which is violating the Telemarketing Sales Rule (“TSR”), for example. This would cause the broker to be directly liable for the caller’s illegal actions under the TSR’s “accomplice liability” rules. But what they haven’t been subject to are the registration and license requirements found in more than half the states.
Vermont has changed that—and I expect more states to follow.
How businesses use consumer data is the topic of countless news stories and government investigations—and now the state of Vermont has passed a license requirement for data brokers, the first in the nation. Effective January 1, 2019, data brokers were required to register with the Vermont Secretary of State and pay a filing fee of $100. See https://legislature.vermont.gov/Documents/2018/Docs/ACTS/ACT171/ACT171%20As%20Enacted.pdf. (Vermont Act 171, 2018).
Data broker is defined as “a business that knowingly collects and sells or licenses broker personal information to third parties, but with whom the consumer does not have a direct relationship”. The term includes both entities like lead brokers which sell consumer information, but also other businesses which share lists through barter exchanges or other non-monetary deals.
Like the General Data Protection Restriction (“GDPR”) in the European Union, which applies only to European residents, this law applies only to Vermont residents, however, nationwide businesses must account for the rules if any Vermont residents are included in their data. Again, similar to the GDPR, the Vermont law requires businesses to comply with certain behavioral rules including: reasonable data security, training, designation of an employee to maintain the data security program, etc. The full description of behavioral restrictions can be found at: https://legislature.vermont.gov/statutes/section/09/062/02447.
Fines for failure to register with the Vermont Secretary of State begin being assessed February 1, 2019, so there is no more grace period with regard to registration—fines can be assessed effective immediately for failure to register.
Other states are considering similar laws this legislative session, see, for example, N.D. HB 1524, so I expect more licenses and rules soon.
Please contact me if you would like to discuss.