In the United States, Vermont has passed a law which they hope will assist in cracking down on data brokers. The law requires data brokers to register themselves with the state and provide information on an ongoing basis with regards to the practices and methodology they are using.
At the moment, data brokering is a shady business as Cambridge Analytica and the Facebook scandal have demonstrated. These entities work to collect your information by whatever means necessary, including accessing social media profiles, manipulating advertising platforms to create offers that encourage people to leave their details, and good old-fashioned cold calling, where a cover story is used to fill in gaps in people’s profiles.
This law is interesting for two reasons; firstly, it is the only one of its type that exists in the world, and secondly, it puts the onus on data brokers rather than law enforcement. This means that if a company or individual is found to be data brokering without registration, that is more than enough to convict them. At the moment, the law – due in no small part to the shadowy nature of the industry – has been restricted in what it can do to prosecute data brokers. After all, how does a law enforcement agency define data brokering? It could just as easily be seen as database management or research. Now, the definition will be broad enough for agencies and analysts to understand the difference, and prosecute the guilty.
This will also open up avenues for tax prosecution, because with enforced registration will become forced company registration. Many critics are pointing out that this is rather heavy-handed, but it is likely that the law will be toned down over time to allow for legitimate entities such as political research teams and such. In the meantime, anyone in Vermont who is potentially collecting data for commercial reasons, without the targets being aware, should tread a very fine line.