Law / United States / 
Vermont
Data broker duty to protect information: comprehensive information security program
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Security, Governance
- Audit expectation
- periodic
- Who audits it
- Self
As of .
What it requires
- If you are a data broker (as section 2430 defines the term in each version), the duty in section 2447 reads the same before and from : the only change in section 2447's own text on that date is that the Attorney General's rulemaking authority in subdivision (d)(2) refers to the provisions of the section where it referred to the provisions of the chapter. The definitions the duty relies on do change on that date: section 2430 rewrites the definition of data broker, and rewrites personally identifiable information so that it excludes all publicly available information (until then it excluded only publicly available information lawfully made available from government records) and does not require a name where any listed data element is sufficient to perform or attempt identity theft against the consumer. Develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to the size, scope and type of your business, your resources, the amount of data you store and the need for security and confidentiality of personally identifiable information.
- Adopt safeguards in the program that are consistent with the safeguards for protection of personally identifiable information and information of a similar character set forth in other State rules or federal regulations that apply to you.
- At minimum, designate one or more employees to maintain the program; identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of paper, electronic and other records containing personally identifiable information, with a process for evaluating and improving the safeguards, including ongoing employee training (temporary and contract employees included), employee compliance with policies and procedures, and means for detecting and preventing security system failures.
- At minimum, have security policies for employees on the storage, access and transportation of records containing personally identifiable information outside business premises, disciplinary measures for violations of the program's rules, measures that prevent terminated employees from accessing those records, and reasonable restrictions on physical access to those records and on their storage in locked facilities, storage areas or containers.
- At minimum, supervise service providers: take reasonable steps to select and retain third-party providers capable of maintaining appropriate security measures consistent with applicable law, and require them by contract to implement and maintain appropriate security measures for personally identifiable information.
- At minimum, monitor regularly that the program operates in a manner reasonably calculated to prevent unauthorized access to or use of personally identifiable information, upgrade safeguards as necessary, and review the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of those records.
- At minimum, document the responsive actions you take in connection with any incident involving a breach of security, and carry out a mandatory post-incident review of events and actions taken, making changes in business practices relating to protection of personally identifiable information where needed.
- To the extent technically feasible, include secure user authentication protocols; secure access controls that restrict access to those who need the information for their job duties and give each person with computer access a unique identification and a password that is not a vendor-supplied default; encryption of records and files containing personally identifiable information that travel across public networks or are transmitted wirelessly, and of such information stored on laptops or other portable devices (or a protocol that provides a higher level of security); reasonable monitoring of systems for unauthorized use or access; up-to-date firewall protection and operating system security patches for files on an Internet-connected system; up-to-date system security agent software with malware protection; and employee education and training on the proper use of the computer security system and the importance of personally identifiable information security.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 2447(d)(1) makes a violation an unfair and deceptive act in commerce under section 2453, and section 2447(d)(2) gives the Attorney General the authority to bring civil actions as provided under chapter 63, subchapter 1. Section 2458(b)(1) in that subchapter allows the court, in an action by the Attorney General or a State's Attorney, to impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. Section 2447 states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General, who has the same authority to adopt rules and to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of title 9 (9 V.S.A. section 2447(d)(2)). A violation is an unfair and deceptive act in commerce in violation of section 2453 (section 2447(d)(1)).
What this law does
A data broker shall develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, that contains administrative, technical and physical safeguards appropriate to the size, scope and type of its business, the amount of resources available to it, the amount of stored data and the need for security and confidentiality of personally identifiable information.
The safeguards must be consistent with the safeguards for protection of personally identifiable information and information of a similar character set forth in other State rules or federal regulations applicable to the data broker. The program must at minimum provide for designation of one or more employees to maintain it.
The program must at minimum identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of records containing personally identifiable information, and include a process for evaluating and improving the effectiveness of the current safeguards for limiting those risks.
The program must at minimum provide for supervision of service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate security measures and by requiring them by contract to implement and maintain appropriate security measures for personally identifiable information.
The program must at minimum provide for regular review of the scope of the security measures at least annually, or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing personally identifiable information. The program must at minimum provide for documentation of responsive actions taken in connection with any incident involving a breach of security and for mandatory post-incident review of events and actions taken.
To the extent technically feasible, the program must at minimum have the computer system security elements the section lists.
Personally identifiable information means a consumer's first name or first initial and last name in combination with one or more listed digital data elements, among them a Social Security number, a driver license number and a financial account number, when the elements are not encrypted, redacted or protected by another method that renders them unreadable or unusable by unauthorized persons.
Until , personally identifiable information does not mean publicly available information that is lawfully made available to the general public from federal, State, or local government records. From , personally identifiable information does not include publicly available information.
From , personally identifiable information does not require a consumer's first name or first initial and last name if any of the listed data elements is sufficient to perform or attempt to perform identity theft against the consumer. A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.
The Attorney General has the same authority to adopt rules and to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of title 9. From , the Attorney General's authority to adopt rules under subdivision (d)(2) is for implementing the provisions of the section, where it was for implementing the provisions of the chapter before.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.