Vermont lawmakers are considering a bill that would make the state the first in the nation to monitor the far-reaching activities of so-called "data brokers."
Data brokers collect, analyze and sell the wealth of information available online and in public records about who we are, where we are and what we do.
Consumers are largely unaware of the information and how it’s used.
Data brokers might sell the information to a business marketing a legitimate product or to a bank or credit card company to help them confirm a customer’s identity. But they can also make far more questionable commercial uses of the information and even sell it to criminals.
“Even the legitimate members of this business are intentionally selling data to people that obviously don’t have the best interests of people at heart,” says Assistant Attorney General Ryan Kriger.
The Attorney General’s office supports the bill, which would require data brokers to identify themselves.
“The key element of this bill is, if you are buying and selling Vermonters’ data, you need to register in the State of Vermont so we know who you are,” says Kriger.
Data brokers use information collected from online searches and purchases, as well as data from brick and mortar businesses. They search public records and even file freedom of information requests.
“Even the legitimate members of this business are intentionally selling data to people that obviously don’t have the best interests of people at heart.” — Assistant Attorney General Ryan Kriger
The bill would require them to disclose where they obtained the data and the nature of the information. They would also be required to explain their procedures for vetting people who buy data and preventing illegal use of the information.
The legislation would not stop the collection and use of personal information, nor would it give consumers control over how their data is used.
However, Kriger says it could help shine a light on shadier data brokers.
“It does not curtail anything. It does require that data brokers have reasonable systems in place to know that their customer is who they say they are, and they’re not using the data for criminal purposes,” he says.
The state would also have the ability to pursue brokers that have not registered.
A report called The Scoring of America, issued by the World Privacy Forum, explains how extensive an individual’s digital trail is and how the data can be used.
Pam Dixon, the organization’s executive director, told House Commerce Committee members that personal data is frequently used to create consumer "scores" in a wide range of areas.
“For example, there’s a ‘frailty score,’ there’s a consumer ‘propensity-to-spend score,’ a ‘succeed-at-work score,’” Dixon explained.
"If we're the first ones in the country to do it, we've got a great potential to have a nice expensive lawsuit on our hands." — Rep. Robert Frenier
Sometimes the score simply means someone will be offered a discount or coupon, but Dixon says the scores can also have an impact on an individual’s insurance premiums and employment opportunities.
Unlike credit scores under the Fair Credit Reporting Act, Dixon says consumer scores aren’t regulated.
She suggested that lawmakers expand the legislation to include a requirement that brokers reveal which scores are based on data collected about Vermonters and an explanation of what the score means.
Dixon called the Vermont bill a modest first step.
“You would be the first state, so you would set a precedent. I don’t know what the other states would do. I would hope that they would follow,” she said.
Dixon estimates there are 4,000 to 5,000 companies involved in collecting, analyzing and marketing consumer data.
They include companies that provide addresses, phone numbers and other personal information for a fee.
Erica Olsen with the National Network to End Domestic Violence told committee members that the easy availability of that information makes it very difficult for survivors to keep their abusers from finding them.
“Almost always the survivors that we talk to have already been found multiple times and they are trying to figure out why this person keeps finding them,” Olsen said.
Dixon said there is not nearly enough government oversight of the data collection field. She said it is incumbent upon the government “to provide safety for individuals and provide a reasonable assurance of good and fair and non-deceptive business practices.”
Lobbyist Charles Storrow testified on behalf of RELX Group, the parent company of LexisNexis, which collects data about individuals and sells it to businesses and government.
Storrow said much of the work done by the company is already subject to federal regulation.
“The committee might want to explore that a little bit more to find out what the lay of the land is there [to see] if there are gaps and holes that really do need to be filled,” said Storrow.
He also argued that the bill’s requirements could force his client to reveal trade secrets and it put it at a competitive disadvantage compared to companies that aren’t required to register.
At least one committee member also questioned the need for the legislation.
“I don’t think we know enough about the industry to regulate it. If we’re the first ones in the country to do it, we’ve got a great potential to have a nice expensive lawsuit on our hands,” said Chelsea Republican Rep. Robert Frenier. “As an old newspaper man, I always get leery when somebody wants to ask questions and insists on knowing my sources. The difference between these guys and the Wall Street Journal escapes me.”
The proposed bill would also require public agencies that provide personal information to a data broker to keep a record of it.
The law would not apply to companies that use or sell data they collect on their own customers.
