
Vermont passes first law to crack down on data brokers - anigbrowl
https://techcrunch.com/2018/05/27/vermont-passes-first-first-law-to-crack-down-on-data-brokers/
======
erentz
I’m still not understanding the controversy and kickback around these
regulations. The hysteria around GDPR has been silly.

My home country has a Privacy Act, it’s terribly weak and has little
enforcement but the principals in it were drilled into me from the very start
of my career. Customer data is really important. It must be kept private and
not shared. And we should only have what we need to have for whatever we’re
doing for them. I don’t know why those principals are so hard for people to
swallow. Now in the states when I hear mobile carriers are selling my location
data without my consent, and so on, I get completely irate. It boggles my mind
why people think that kind of behavior should be allowed.

~~~
Mirioron
>I’m still not understanding the controversy and kickback around these
regulations. The hysteria around GDPR has been silly.

Because it puts a whole bunch of people out of a job and ruins the user
experience for many things. Every news site I go to I get greeted by a pop up
that won't go away until I interact with it. Apparently similar things are
happening with phone apps as well. And while this is happening I've read about
people having their app revenue drop 90% in some cases.

We're not even a full week in yet, so we don't know what the full effects of
this are going to be.

>It boggles my mind why people think that kind of behavior should be allowed.

It's not about whether data abuse is okay or not, but rather it's about the
consequences of taking such a heavy-handed approach as GDPR did.

~~~
petre
> Because it puts a whole bunch of people out of a job and ruins the user
> experience for many things.

No, really, it is the advertisers who ruined the experience in the first
place. And almost every site tries to make you agree to data collection
without giving you another option, or hiding the other option under several
menus. That's why I closed the TC page.

~~~
Mirioron
The advertisers are the reason why many of these jobs existed in the first
place. Developers don't run off of hot air and exposure.

~~~
heavenlyblue
Then it’s probably just the time to fire all of them.

I work for an ad arb business. We don’t collect user-identifiable data and
still make loads of money.

Your point of view would seem to justify child trafficking if that would pay
the bills for most of the people in the industry.

------
matte_black
We’re going to end up with some HIPAA like regulations on collecting data and
it’s going to be a massive pain in the ass.

The scary part is the big companies will have the money to lobby for
regulations to be written in a way that is easy for them to comply with while
shutting out smaller companies and startups.

~~~
downandout
This law applies only to data brokers in Vermont. From the article:

 _Data brokers in Vermont will now have to register as such with the state;
they must take standard security measures and notify authorities of security
breaches (no, they weren’t before); and using their data for criminal purposes
like fraud is now its own actionable offense._

It defines data brokers as businesses in Vermont that buy and sell data on
people with whom they have no direct relationship. Seems like a reasonable law
- unlike GDPR, they aren’t trying to reach outside of their jurisdiction, they
aren’t trying to wipe out entire business models, there are no absurd fines,
it’s easy to know if you’re violating it (because you would know that you have
setup a data brokerage in Vermont), etc. My guess is there are only a handful
of “data brokers” as they define that term within Vermont, so this affects
very few people.

~~~
niftich
Your reading that they define 'data broker' as a business in Vermont is not
substantiated by the text of the bill [1].

Some excerpts that define some key terms:

 _" (2) "Business" means a commercial entity, including a sole proprietorship,
partnership, corporation, association, limited liability company, or other
group, however organized and whether or not organized to operate at a profit,
including a financial institution organized, charterd, or holding a license or
authorization certificate under the laws of this State, any other state, the
United States, or any other country, or the parent, affiliate, or subsidiary
of a financial institution, but does not include the State, a State agency,
any political subdivision of the State, or a vendor acting solely on behalf
of, and at the direction of, the State.

(3) "Consumer" means an individual residing in this State.

(4)(A) "Data broker" means a business, or unit or units of a business,
separately or together, that knowingly collects and sells or licenses to third
parties the brokered personal information of a consumer with whom the business
does not have a direct relationship."_

[1]
[https://legislature.vermont.gov/bill/status/2018/H.764](https://legislature.vermont.gov/bill/status/2018/H.764)

~~~
downandout
What you’re not understanding is that this is a _state_ law. They can only
regulate the activities of businesses that operate _within their own state_.

They use the broad definition of a “business” because in the US you can be
incorporated in Delaware and actually operate in Vermont. This is actually a
common thing - most US corporations are incorporated under the laws of either
Delaware or Nevada but operate within their home state. But the state only has
the ability to regulate the actual operations of businesses _operating within
Vermont._

~~~
geocar
There's lots of ways a Vermont court could apply their laws to a Delaware
corporation operating out of Delaware: Renvoi, significant contacts test,
"better rule" test, and so on.

------
eveningcoffee
I believe that these practices should be completely outlawed.

I could in principle not see it anything less than a form of unlawful
surveillance.

~~~
nightsd01
That’s a bit extreme. Most of this data gets used for targeted advertising.
While that sounds (and sometimes is) shady, it also enables a lot of niche
companies that had a much harder time existing before.

For example, what’s the point in showing ads for custom quadcopter parts to an
80 year old grandmother who doesn’t know what a quadcopter is?

Data should be regulated and protected much more than it currently is. But the
idea of banning it entirely would have a lot of negative effects. Let’s be
smarter than that.

~~~
pacala
If I need quadrocopter parts, I'll search for quadrocopter parts. I don't need
your ads to push quadrocopter parts on me on the hope that I might be slightly
more interested in them than an 80 year old grandmother.

I need you to build a good product and display it in a good store.

~~~
ende
This really cuts to the core of the issue. Consumers will naturally seek out
the things they wish to buy. Nobody needs to be distracted from their
activities to be told what to buy.

All advertising should be strictly confined to designated areas specifically
intended for consumer searching.

~~~
tdb7893
There are a lot of movies I went to after I saw an ad for it which I never
would have searched for on my own (and I can say the same about restaurants
and a couple other peoducts). Consumers aren't going to search for something
they don't know exists in the first place

~~~
wlll
Yeah, but if you hadn't seen those ads, and not watched those movies, would
your life really be worse than it is now?

> Consumers aren't going to search for something they don't know exists in the
> first place

If a consumer doesn't buy something they don't know exists, does it really
matter?

Life, at least for me and the people I know, doesn't revolve around finding
things to spend money on.

~~~
oliv__
The economy does.

~~~
wlll
Perhaps this is because I'm not an American, but my life doesn't revolve
around "supporting the economy". The economy is supported when I go round
living my life, not the other way round.

~~~
TeMPOraL
Exactly. Also: free market works well when the aggregated signals from
customers are _honest_. Then it allocates resources efficiently. Advertising
is all about disrupting this mechanism, injecting and generating fake signals
that skew the market.

------
oliv__
I'm all for spreading information but I can't help but cringe at the frowny,
holy attitude Techcrunch displays here like they just discovered this stuff is
happening. Please. Spare me the tears. You knew about this all along, it just
wasn't fashionable to write about it before.

------
sarcasmic
For more details, see the Vermont Attorney General press release [1] and the
H.764 bill full text [2].

Cynical prediction: Vermont has less than a million residents. It may be both
easier (as in less effort) and less expensive, if you're a data broker, to
just cease trafficking in the data of anyone tangentially associated [3] with
the state of Vermont.

[1] [http://ago.vermont.gov/blog/2018/05/24/a-g-new-data-
broker-l...](http://ago.vermont.gov/blog/2018/05/24/a-g-new-data-broker-law-
is-good-for-vermonters/) [2]
[https://legislature.vermont.gov/bill/status/2018/H.764](https://legislature.vermont.gov/bill/status/2018/H.764)
[3]
[https://en.wikipedia.org/wiki/Vermont#Population_changes](https://en.wikipedia.org/wiki/Vermont#Population_changes)

~~~
CPLX
I believe that would count as the law functioning as intended.

~~~
Mirioron
This would also come with the flip side of the coin, which is blocking access
to users from Vermont. Server time isn't free.

------
shubb
This crackdown on data brokering bothers me. I'm writing from the medical data
industry.

Data isn't neccesarily about unwanted creepy stuff. In other industries,
customer data can be used to recomend the right stuff, or make the kind of
movies people want to watch. That stuff enhances peoples lives - in
individually small but additive ways.

In my industry, data really can save lives. For instance the prime minister of
my country apparantly wants to apply AI to peoples GP records to spot people
who have undiagnosed cancer. This seems pretty viable to me - even in the most
simple case you could quickly spot families with high cancer risk, offer the
young women in them gene sequencing, and then offer the ones that are carrying
super high risk cancer genes preventative treatement. You'd certainly save
lives this way.

There are a lot of very scary ethical questions in my industry. Widespread use
of genetics to price insurance. Employers requiring employees give access to
medical records before confirming employment. And much more.

But I do worry this backlash will make it much harder to do good.

~~~
pjc50
One word: consent.

It's a critical part of medical ethics anyway.

~~~
shubb
Yeah, consent is required by law and codes of practice for medical data most
places.

------
curun1r
How many businesses have a point of presence in Vermont? I can't imagine many,
and if any do, they'd probably just move rather than comply with a law that
would harm their business.

This strikes me as being largely symbolic and not likely to have much of an
impact, unless other states follow through with similar consumer protections.
However if Deleware were to pass legislation like this, that would be a lot
more meaningful.

~~~
llukas
UE, Vermont... next please ;)

------
_salmon
Through the article, I looked at Acxiom and it seems like they have an opt-out
form. Who knows if they actually obey it but they probably have your data
anyway so it's worth a shot:
[https://isapps.acxiom.com/optout/optout.aspx](https://isapps.acxiom.com/optout/optout.aspx)

------
crobertsbmw
It seems so obvious that this is happenening, but I’ve never really thought
about it before. Like the article says, “that’s the point.”

------
64kbisalluneed
Amen!

