Written By ESR News Blog Editor Thomas Ahearn
As of March 1, 2019, more than 120 “data brokers” have registered with the Vermont Secretary State as required by the landmark Vermont Data Broker Regulation (Act 171) that took effect on January 1, 2019. To search for a current list of data brokers, select “Data Broker” on the dropdown menu for “Business Type” on the Secretary of State search feature at www.vtsosonline.com/online/BusinessInquire/.
Vermont Data Broker Regulation
The Act defines a data broker as “a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” An annual registration is required between January 1st and 31st following each calendar year in which a company meets the data broker definition.
The Vermont Data Broker Regulation requires data brokers to maintain certain minimum data security standards. In December 2018, the Vermont Attorney General issued guidance on the Data Broker Regulation to help address questions on process and scope. The guidance is not legal advice but is intended to assist data brokers affected by the regulation and help them comply with the law.
The Federal Trade Commission (FTC) regulates data brokers in the U.S. and issued a report in April 2012 that contained recommendations on protecting consumer privacy. In June 2012, the FTC fined a data broker $800,000 for not protecting consumers as required under the Fair Credit Reporting Act (FCRA) in the first FTC case addressing the sale of online data in the employment screening context.
In April 2014, two data brokers agreed to settle FTC charges that they violated the FCRA by providing reports about consumers without taking reasonable steps to make sure that they were accurate or that their users had a permissible reason to have those reports. In May 2014, the FTC issued a report that recommended Congress enact legislation to make data broker practices more visible to consumers.
Data brokers “can assemble thousands of attributes each for billions of people” which are used to create “detailed (and often erroneous) consumer profiles” that can determine eligibility for employment, according to an article by FastCompany.com, which includes a list of data brokers, information on how – and what type of – data is collected, and websites that provide data broker opt-out instructions.
“Sometimes consumers or their lawyers send mass mailings to numerous background screening firms requesting that they be removed from the firm’s database, but that message misses the mark when it is sent to a background screening firm that does not collect data for reuse or reselling,” said Attorney Lester Rosen, founder and Chief Executive Officer (CEO) of Employment Screening Resources® (ESR).
Rosen explained that his company is not a data broker since all background checks are provided solely with explicit authorization and disclosure under the FCRA and applicable state law, with a permissible purpose under the FCRA, and used only once for an employer with a job applicant’s consent. “Our data is not reused or sold,” said Rosen. “That is much different than a data broker that acquires information for future use.”
ESR Protects Consumer Information Used in Background Checks
Employment Screening Resources® (ESR) – a leading global background check firm – undergoes annual SOC 2® Type II audits to confirm that ESR meets high standards set by the American Institute of Certified Public Accountants (AICPA) for protecting the privacy, security, and confidentiality of consumer data used in the background check process. To learn more, visit www.esrcheck.com/Why-ESR/SOC-2/.
NOTE: Employment Screening Resources® (ESR) does not provide or offer legal services or legal advice of any kind or nature. Any information on this website is for educational purposes only.
© 2019 Employment Screening Resources® (ESR) – Making copies or using of any part of the ESR News Blog or ESR website for any purpose other than your own personal use is prohibited unless written authorization is first obtained from ESR.