Montpelier
Data brokers collect, analyze and sell the wealth of information available online and in public records about who we are, where we are and what we do.
Consumers are largely unaware of the information and how it’s used.
Data brokers might sell the information to a business marketing a legitimate product or to a bank or credit card company to help them confirm a customer’s identity. But they can also make far more questionable commercial uses of the information and even sell it to criminals.
“Even the legitimate members of this business are intentionally selling data to people that obviously don’t have the best interests of people at heart,” Assistant Attorney General Ryan Kriger said.
The state Attorney General’s Office supports the bill, which would require data brokers to identify themselves.
“The key element of this bill is, if you are buying and selling Vermonters’ data, you need to register in the State of Vermont so we know who you are,” says Kriger.
Data brokers use information collected about online searches and purchases, as well as that collected by brick and mortar businesses. They search public records and even file freedom of information requests.
The bill would require them to disclose where brokers obtained the data and the nature of the information. They would also be required to explain their procedures for vetting people who buy data and preventing illegal use of the information.
The legislation would not stop the collection and use of personal information, nor would it give consumers control over how their data is used.
However, Kriger said it could help shine a light on shadier data brokers.
“It does not curtail anything,” he said. “It does require that data brokers have reasonable systems in place to know that their customer is who they say they are, and they’re not using the data for criminal purposes.”
The state would also have the ability to pursue brokers that have not registered.
A report called The Scoring of America, issued by the World Privacy Forum, explains how extensive an individual’s digital trail is and how the data can be used.
Pam Dixon, the organization’s executive director, told committee members that personal data is frequently used to create consumer “scores” in a wide range of areas.
“For example, there’s a ‘frailty score,’ there’s a consumer ‘propensity-to-spend score,’ a ‘succeed-at-work score,’ ” Dixon explained.
Sometimes the score simply means someone will be offered a discount or coupon, but Dixon said the scores can also have an impact on an individual’s insurance premiums and employment opportunities.
Unlike credit scores under the Fair Credit Reporting Act, Dixon said, consumer scores aren’t regulated.
She suggested that lawmakers expand the legislation to include a requirement that brokers reveal which scores are based on data collected about Vermonters and an explanation of what the score means.
Dixon called the Vermont bill a modest first step.
“You would be the first state, so you would set a precedent,” she said. “I don’t know what the other states would do. I would hope that they would follow.”
Dixon estimates there are 4,000 to 5,000 companies involved in collecting, analyzing and marketing consumer data.
They include companies that provide addresses, phone numbers and other personal information for a fee.
Erica Olsen with the National Network to End Domestic Violence told committee members that the easy availability of that information makes it very difficult for survivors to keep their abusers from finding them.
“Almost always the survivors that we talk to have already been found multiple times and they are trying to figure out why this person keeps finding them,” Olsen said.
Dixon said there is not nearly enough government oversight of the data collection field. She said it is incumbent upon the government “to provide safety for individuals and provide a reasonable assurance of good and fair and non-deceptive business practices.”
Lobbyist Charles Storrow testified on behalf of RELX Group, the parent company of LexisNexis, which collects data about individuals and sells it to businesses and government. Storrow said much of the work done by the company is already subject to federal regulation.
“The committee might want to explore that a little bit more to find out what the lay of the land is there (to see) if there are gaps and holes that really do need to be filled,” said Storrow.
He also argued that the bill’s requirements could force his client to reveal trade secrets and put it at a competitive disadvantage compared to companies that aren’t required to register.
At least one committee member also questioned the need for the legislation.
“I don’t think we know enough about the industry to regulate it. If we’re the first ones in the country to do it, we’ve got a great potential to have a nice expensive lawsuit on our hands,” said state Rep. Robert Frenier, R-Chelsea.