4 ms·

For more details, see the Vermont Attorney General press release [1] and the H.764 bill full text [2]. Cynical prediction: Vermont has less than a million resi

For more details, see the Vermont Attorney General press release [1] and the H.764 bill full text [2]. Cynical prediction: Vermont has less than a million residents. It may be both easier (as in less effort) and less expensive, if you're a data broker, to just cease trafficking in the data of anyone tangentially associated [3] with the state of Vermont. [1] http://ago.vermont.gov/blog/2018/05/24/a-g-new-data-broker-law-is-good-for-vermonters/ http://ago.vermont.gov/blog/2018/05/24/a-g-new-data-broker-l... [2] https://legislature.vermont.gov/bill/status/2018/H.764 https://legislature.vermont.gov/bill/status/2018/H.764 [3] https://en.wikipedia.org/wiki/Vermont#Population_changes https://en.wikipedia.org/wiki/Vermont#Population_changes

michaelbuckbee 8y ago
There are some number of companies making the same decision wrt GDPR and the EU, so it wouldn't surprise me. That being said, there will come a tipping point where it _does_ make sense and regulation like this is part of how it gets there.
- AnthonyMouse 8y ago
  > That being said, there will come a tipping point where it _does_ make sense and regulation like this is part of how it gets there. That's assuming the jurisdictions have the same rules as one another. If they have different rules, or conflicting rules, or rules that conflict with some other jurisdiction's data retention requirements, it becomes a huge mess. And the probability of the US adopting the GDPR verbatim is practically nil.
  - swsieber 8y ago
    Moreover, the chance of a verbatim GDPR in the US being interpreted the same way is even smaller. Though I do have hope that there will be a common base that gives compliance amongst all regulatory areas.
CPLX 8y ago
I believe that would count as the law functioning as intended.
- Mirioron 8y ago
  This would also come with the flip side of the coin, which is blocking access to users from Vermont. Server time isn't free.
downandout 8y ago
It may be both easier (as in less effort) and less expensive, if you're a data broker, to just cease trafficking in the data of anyone tangentially associated [3] with the state of Vermont. Why would that be? AFAICT, this law merely sets standards for data brokers operating within the state of Vermont. It doesn’t try to dictate what anyone outside the state can do with data from people in Vermont, like GDPR does. Given Vermont’s size, my guess is that there are very few companies in Vermont that this law actually applies to.
- niftich 8y ago
  You're wrong. Having read the bill, specifically page 57 of the Official 'As Passed by Both House and Senate' PDF and its environs, it's clear that they intend to regulate the brokering of information about 'Consumers', where that word is defined to mean "an individual residing in this State." Meanwhile, 'data broker' is defined as 'business' that engages in the brokering of data (obviously paraphrasing), where 'business' isn't bound by being incorporated in Vermont, but applies worldwide.
  - downandout 8y ago
    I am actually not wrong. You have to understand the context. State laws only apply to businesses operating within the state. States in the US cannot regulate the activities of entities that are not within their jurisdiction. If a state in the US starts saying it has the power to regulate businesses in other states and countries, that would be news. Also, please read the article we are commenting on: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. That is what this law does. Nothing more, nothing less.
    - ende 8y ago
      Originating from outside of a state does not bar a state’s ability to regulate a business’s interactions with the citizens of that state.

michaelbuckbee 8y ago

There are some number of companies making the same decision wrt GDPR and the EU, so it wouldn't surprise me. That being said, there will come a tipping point where it _does_ make sense and regulation like this is part of how it gets there.

AnthonyMouse 8y ago
> That being said, there will come a tipping point where it _does_ make sense and regulation like this is part of how it gets there. That's assuming the jurisdictions have the same rules as one another. If they have different rules, or conflicting rules, or rules that conflict with some other jurisdiction's data retention requirements, it becomes a huge mess. And the probability of the US adopting the GDPR verbatim is practically nil.
- swsieber 8y ago
  Moreover, the chance of a verbatim GDPR in the US being interpreted the same way is even smaller. Though I do have hope that there will be a common base that gives compliance amongst all regulatory areas.

CPLX 8y ago

I believe that would count as the law functioning as intended.

Mirioron 8y ago
This would also come with the flip side of the coin, which is blocking access to users from Vermont. Server time isn't free.

downandout 8y ago

It may be both easier (as in less effort) and less expensive, if you're a data broker, to just cease trafficking in the data of anyone tangentially associated [3] with the state of Vermont. Why would that be? AFAICT, this law merely sets standards for data brokers operating within the state of Vermont. It doesn’t try to dictate what anyone outside the state can do with data from people in Vermont, like GDPR does. Given Vermont’s size, my guess is that there are very few companies in Vermont that this law actually applies to.

niftich 8y ago
You're wrong. Having read the bill, specifically page 57 of the Official 'As Passed by Both House and Senate' PDF and its environs, it's clear that they intend to regulate the brokering of information about 'Consumers', where that word is defined to mean "an individual residing in this State." Meanwhile, 'data broker' is defined as 'business' that engages in the brokering of data (obviously paraphrasing), where 'business' isn't bound by being incorporated in Vermont, but applies worldwide.
- downandout 8y ago
  I am actually not wrong. You have to understand the context. State laws only apply to businesses operating within the state. States in the US cannot regulate the activities of entities that are not within their jurisdiction. If a state in the US starts saying it has the power to regulate businesses in other states and countries, that would be news. Also, please read the article we are commenting on: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. That is what this law does. Nothing more, nothing less.
  - ende 8y ago
    Originating from outside of a state does not bar a state’s ability to regulate a business’s interactions with the citizens of that state.