Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party marketing automation tools that collect personal information in Vermont? What are the requirements?

Using Third-Party Marketing Automation Tools that Collect Personal Information in Vermont

Yes, you can use third-party marketing automation tools that collect personal information in Vermont, but you must comply with the Vermont Consumer Protection Rule VTCR 21-010-016 § 14. This rule provides an exception to the opt-in requirements for disclosure of nonpublic personal information for service providers and joint marketing.

Under this rule, a financial institution may provide nonpublic personal information to a nonaffiliated third party to perform services for the financial institution or functions on the financial institution’s behalf, if the financial institution:

  • Provides the initial notice in accordance with Section 5
  • Enters into a contractual agreement with the third party that prohibits the nonaffiliated third party from disclosing or using the information other than to carry out the purposes for which the financial institution disclosed the information, including use under an exception in Sections 15 or 16 in the ordinary course of business to carry out those purposes
  • For joint agreements for marketing, provides only the consumer’s name, contact information, and own transaction and experience information within the meaning of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681a (d)(2)(A)(i) and the Vermont Fair Credit Reporting Act, 9 V.S.A. § 2480a (2)(A)

Therefore, if you are using third-party marketing automation tools that collect personal information in Vermont, you must ensure that the financial institution providing the information complies with the requirements of VTCR 21-010-016 § 14.

Requirements

To comply with VTCR 21-010-016 § 14, the financial institution providing the information must:

  • Provide the initial notice in accordance with Section 5
  • Enter into a contractual agreement with the third party that prohibits the nonaffiliated third party from disclosing or using the information other than to carry out the purposes for which the financial institution disclosed the information, including use under an exception in Sections 15 or 16 in the ordinary course of business to carry out those purposes
  • For joint agreements for marketing, provide only the consumer’s name, contact information, and own transaction and experience information within the meaning of the federal Fair Credit Reporting Act, 15 U.S.C. § 1681a (d)(2)(A)(i) and the Vermont Fair Credit Reporting Act, 9 V.S.A. § 2480a (2)(A)

If the financial institution providing the information complies with these requirements, then the opt-in requirements in Sections 8 and 11 do not apply.

Conclusion

In conclusion, you can use third-party marketing automation tools that collect personal information in Vermont, but you must ensure that the financial institution providing the information complies with the requirements of VTCR 21-010-016 § 14. If the financial institution complies with these requirements, then the opt-in requirements in Sections 8 and 11 do not apply.

Jurisdiction

Vermont