Can I use third-party email marketing tools that collect personal information in Vermont? What are the requirements?

Use of Third-Party Email Marketing Tools in Vermont

Yes, you can use third-party email marketing tools that collect personal information in Vermont if you are a financial institution, subject to certain requirements. According to VTCR 21-030-004 § 14, the opt-in requirements in Sections 8 and 11 do not apply when a financial institution provides nonpublic personal information to a nonaffiliated third party to perform services for the financial institution or functions on the financial institution’s behalf, if the financial institution:

• Provides the initial notice in accordance with Section 5;
• Enters into a contractual agreement with the third party that prohibits the nonaffiliated third party from disclosing or using the information other than to carry out the purposes for which the financial institution disclosed the information, including use under an exception in Sections 15 or 16 in the ordinary course of business to carry out those purposes; and,
• For joint agreements for marketing, provides only the consumer’s name, contact information, and own transaction and experience information within the meaning of the federal Fair Credit Reporting Act and the Vermont Fair Credit Reporting Act.

Therefore, if you use a third-party email marketing tool, you must ensure that the tool is contractually obligated to use the personal information only for the purposes for which it was disclosed and that the tool only uses the consumer’s name, contact information, and own transaction and experience information for joint marketing purposes.

Limits on Sharing Account Number Information for Marketing Purposes

You must not, directly or through an affiliate, disclose, other than to a consumer reporting agency, an account number or similar form of access number or access code for a consumer’s credit card account, deposit account, or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. You shall not provide an account number or similar form of access number or access code, in an encrypted form. However, there are exceptions to this rule. Paragraph (a) of VTCR 21-030-004 § 13 does not apply if you disclose an account number or similar form of access number or access code:

• To your agent or service provider solely in order to perform marketing for your own products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account; or
• To a participant in an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program.

Conclusion

In summary, you may use third-party email marketing tools that collect personal information in Vermont if you are a financial institution, subject to the requirements outlined in VTCR 21-030-004 § 14. Additionally, you must not disclose account numbers or similar access codes to nonaffiliated third parties for marketing purposes, except under certain exceptions outlined in VTCR 21-030-004 § 13.

Jurisdiction

Vermont

• Privacy