3 ms·

It may be both easier (as in less effort) and less expensive, if you're a data broker, to just cease trafficking in the data of anyone tangentially associated [

It may be both easier (as in less effort) and less expensive, if you're a data broker, to just cease trafficking in the data of anyone tangentially associated [3] with the state of Vermont. Why would that be? AFAICT, this law merely sets standards for data brokers operating within the state of Vermont. It doesn’t try to dictate what anyone outside the state can do with data from people in Vermont, like GDPR does. Given Vermont’s size, my guess is that there are very few companies in Vermont that this law actually applies to.

niftich 8y ago
You're wrong. Having read the bill, specifically page 57 of the Official 'As Passed by Both House and Senate' PDF and its environs, it's clear that they intend to regulate the brokering of information about 'Consumers', where that word is defined to mean "an individual residing in this State." Meanwhile, 'data broker' is defined as 'business' that engages in the brokering of data (obviously paraphrasing), where 'business' isn't bound by being incorporated in Vermont, but applies worldwide.
- downandout 8y ago
  I am actually not wrong. You have to understand the context. State laws only apply to businesses operating within the state. States in the US cannot regulate the activities of entities that are not within their jurisdiction. If a state in the US starts saying it has the power to regulate businesses in other states and countries, that would be news. Also, please read the article we are commenting on: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. That is what this law does. Nothing more, nothing less.
  - ende 8y ago
    Originating from outside of a state does not bar a state’s ability to regulate a business’s interactions with the citizens of that state.
    - downandout 8y ago
      Read the quote I pasted from the TechCrunch article and you’ll understand how this law works. And no, Vermont has no authority to impose regulations on businesses in California for example, nor were they trying to with this law.
  - fuck_google 8y ago
    You do not seem to understand that GDPR also only applies to businesses operating within the EU. It is just that a company is interpreted (under certain circumstances) as operating within the EU if they handle personal data of individuals located inside the EU. This has been the case for national regulation as well, so there really isn't much of a change except unification of the rules and enforcement thereof.

niftich 8y ago

You're wrong. Having read the bill, specifically page 57 of the Official 'As Passed by Both House and Senate' PDF and its environs, it's clear that they intend to regulate the brokering of information about 'Consumers', where that word is defined to mean "an individual residing in this State." Meanwhile, 'data broker' is defined as 'business' that engages in the brokering of data (obviously paraphrasing), where 'business' isn't bound by being incorporated in Vermont, but applies worldwide.

downandout 8y ago
I am actually not wrong. You have to understand the context. State laws only apply to businesses operating within the state. States in the US cannot regulate the activities of entities that are not within their jurisdiction. If a state in the US starts saying it has the power to regulate businesses in other states and countries, that would be news. Also, please read the article we are commenting on: Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense. That is what this law does. Nothing more, nothing less.
- ende 8y ago
  Originating from outside of a state does not bar a state’s ability to regulate a business’s interactions with the citizens of that state.
  - downandout 8y ago
    Read the quote I pasted from the TechCrunch article and you’ll understand how this law works. And no, Vermont has no authority to impose regulations on businesses in California for example, nor were they trying to with this law.
- fuck_google 8y ago
  You do not seem to understand that GDPR also only applies to businesses operating within the EU. It is just that a company is interpreted (under certain circumstances) as operating within the EU if they handle personal data of individuals located inside the EU. This has been the case for national regulation as well, so there really isn't much of a change except unification of the rules and enforcement thereof.