Data Brokers and the Right to Be Forgotten Have you ever looked up a telephone number online and then been presented with an offer, for a price, to obtain a complete report on the owner of that number – current and past addresses, age, income, home ownership, marital status, credit, etc., etc., etc.? This article discusses Vermont’s new law aimed at “shin(ing) a light on companies…that buy and sell the personal information of millions of Americans with whom they have no direct relationship.” The law requires all data brokers that trade data on state residents to register and provide information about how they operate. Laws enacted or under consideration by other states may force data brokers to provide methods for data subjects to have their data removed. The EU’s GDPR has prompted discussion of the “right to be forgotten” in many of the United States. Language of The California Consumer Privacy Act includes this: “A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.” With action on privacy rights accelerating, organizations that collect and process personal information must address these issues promptly or risk penalties for non-compliance.


John Brokaw
GLC National Records Director