SmartTranscript of Senate Judiciary - 2025-04-23 - 9:30AM

[Chair Nader Hashim]: Go ahead. Alright. We are back in senate judiciary. It's April twenty third, and we have Sarah. I don't wanna mispronounce your last name. Aceres. Aceres from the parent general's office to share some thoughts on h three forty two. [Sarah Sanders]: Yes. Good morning. For the record, Sarah Sanders, attorney general excuse me, assistant attorney general. I am a lawyer in the consumer protection unit, so I know the consumer protection act fairly well. Would it be helpful before I kinda jump in on that bill to I know the attorney general gave you kind of a an overlay of exactly what we do in the consumer space, but would it be helpful for me to do that, specifically with data privacy? Yeah. We have plenty of time as well. So great. So as you probably know, data privacy is a priority for the attorney general. She long touted that our data belongs to us, and we should have the right to control that data. She'd often like to say our data, our choice. And I think you all know what data brokers are, but just for the sake of clarity, they're in the business of buying and selling our personal data. And that data could be anything from your name and address to actually your very sensitive health information. And the defining factor for data brokers is that they do not have a direct relationship with the consumer. So me, a consumer, I might have a direct relationship with a website, Amazon, where I actually buy the thing. There isn't that type of relationship when it comes to consumers and data brokers. These are companies that will interact with the front facing company like an Amazon or a store, for example. But they will then take that data usually, almost always, without our knowledge, and they'll use it in different kinds of ways. They'll repackage it. So maybe it's not identifying us. Maybe sometimes it is. And they'll do things with it like sell it for marketing purposes to companies to kinda figure out who their key demographic is, or they might even use it for more nefarious purposes, where there's one company you probably all heard of, Clearview AI, where they'll actually scrape our publicly available photos, and they'll repackage our faces to create facial vectors to use in their facial recognition database. And then they'll sell that product to law enforcement to use for identifying suspects. So we all are essentially in a perpetual police lineup in assets, and nobody knows that this is going on. So that's a really good example of what a data broker is. All this to say, this bill, h three forty two, it deals with data brokers and consumer protection in a more narrow sense because it will give certain public facing individuals the right to tell a data broker they don't want their personal information disclosed, and they should have that freedom when it comes to their old data. And then regarding enforcement, this bill, strikes a good balance, I think, between allowing those public facing individuals to seek recourse against a data broker when they're harmed. And it also carves out a role for our office to essentially have a monitoring mechanism where we can spot trends to see whether there are large amounts of Vermonters affected by a certain bad actor or data broker, and we can then potentially enforce against them that way. And as you know, but just to be clear, our office brings enforcement actions on behalf of the entire state. We do not bring them on behalf of individuals. And so we really do have to see a trend where there are lots of verbatim in order for us to reinforce action. Okay then. [Member Philip Baruth]: One thing I'll mention off the [Sarah Sanders]: bill, the cross reference to the CPA, I believe it's on let me see. On page seven of the bill, I have c one b where we have the attorney general has the same authority to adopt these rules to prevent provisions, conduct civil investigations, and transfer insurances of just continuing civil actions, etcetera. That's very run of the mill for consumer bills in Vermont. You will see that language peppered throughout various consumer protection bills, so we like that. And I think I'll probably stop there and take any questions and do that. [Chair Nader Hashim]: Maybe any questions or comments? [Sarah Sanders]: So understanding that you bring, you know, charges on behalf of the state, so it's kind of it has to be a bigger thing with this. So this don't contain the private right of action. Without that, how would an individual do anything if this isn't being followed? So I believe there's a fifteen day period where, for example, you as a legislator legislator, if you go to a data broker, say, I don't want you to disclose or redisclose my information from here on out, and they do not honor your request within fifteen days, then you have the ability to sue. Yes. Because there's a private right of action in the bill. My question was if that private right of action gets taken out of the bill, what would an individual be able to do? I see. Probably not much. I mean, they would have to depend on our office to break through them. Like I said, we can't do that for individuals. That is what I thought. Thank you. [Chair Nader Hashim]: The the question that I have regarding notice being provided to the data broker. Can you provide any additional information or perspective on that? Because it my understanding is that if this were to pass, your office would create sort of boiler plate form that private citizens could use to send notice to the data broker. But can can you just provide some more information on how that would work and how and and whether the notice would be sufficient? [Sarah Sanders]: Sure. So I got are you asking logistically how it would work? [Member Philip Baruth]: I [Chair Nader Hashim]: guess logistically, and and whether or not we need to clarify that the notice needs to be sent to a registered agent of the data broker Mhmm. Rather than just, you know, any email that they could find on their website. You know, the the issue being that the data broker could say, we never received notice. We have no idea what they're talking about. Mhmm. Any thoughts on that? [Sarah Sanders]: Yeah. That's an interesting question, not one that I've thought about before this. I guess, you know, stepping back to the logistic point, we have various forms on our website that we already have implemented. The most, glaring example, I guess, is the, security breach notice form. So companies, if, they've experienced a security breach under our security breach notice act, they're required to let our office know, and we've created a form that makes it very easy for companies to notify us. So I would expect that we'll do something similar lightly in tandem with stakeholders to make sure that, you know, the form has what it needs. As far as the notice piece, [Chair Nader Hashim]: I'll have [Sarah Sanders]: to get back to you on that. I'm not sure how that piece would work, and I'm not sure I would want to depend on our office to find the correct contact. That may be something that data brokers would need to be beholden to, but whether there needs to be a process in place for that, I'm not sure. So I would be interested to hear what data brokers have to say about that [Chair Nader Hashim]: one. Yeah. Yeah. My again, my my thought on it is that it's just to clarify, I think that, you know, it could be easy for a private citizen to, you know, go to the data brokers website and just find any random email that then, you know, they send a notice to. But I think that if it's written in the statute that they have to send it to the registered agent who's supposed to be responsible for receiving these types of documents, I think that could be a bit more helpful. But that's my initial take on it. [Sarah Sanders]: Yeah. I I think I [Chair Nader Hashim]: would tend to agree with that. [Sarah Sanders]: I mean, that would make it more efficient if nothing else. [Chair Nader Hashim]: Senator, did you have a question? [Vice Chair Robert Norris]: Oh, I was just gonna say that's been one of my concerns about this is if we pass the bill, there's still no one to help the individual find where they need to send these things. So if the bill set up a a database or or a portal, and you could go in and fill out your information, and then you hit send, and then send it to the five hundred major data brokers. That would make sense to me. But as it is now, it sets up a a machine to do something, and it allows for that thing to be done. But there's no one to help the average person at home. Let's say they're a deputy sheriff or, know, whoever's covered by this building, because it also covers the family of all the covered people. So you've got, you know, a random person who's smaller as a sheriff who wants to have their information taken off. There's no as far as I can see, there's no help in this bill for that, but there is a series of penalties if if they do send it to an address, whether it's the right address or the wrong address. So it you know, without putting too far from that, it just seems like it's not quite ready for prime time, this concept. I feel like it's half designed, and the other half that's missing is the connection piece for the individual. And then there's always gonna be questions about private right of action because that's the ongoing, you know, subject of debate. But for me, it's also that that interface space Mhmm. Portable activity. [Sarah Sanders]: One thing that may help, we have a data broker Yep. Registry through the secretary of state, and they do have their registered agents listed on there. That's my understanding. And so that may be an avenue that could be of use in this bill. [Chair Nader Hashim]: Can you click a button and pop the hall? [Sarah Sanders]: No. Not unless you hire someone to do that. [Vice Chair Robert Norris]: So there's, like if I remember right, there's five there's hundreds on that database. Mhmm. So, again, I I think the average person just can be daunted even if the addresses aren't there. You know? Because we are talking about something that will be actionable in court. So it seems the the front end of this just seems kind of loosey goosey in terms of whether or how people make connection to the data brokers. Mhmm. But then there are real world penalties if the data brokers don't respond on a very quick time table. [Sarah Sanders]: Yeah. I hear that point. I will say that is a problem that's ubiquitous throughout kind of the data privacy Yeah. Landscape. It the onus is on the consumer to figure out exactly who's collecting their data and if they want their data removed or not disclosed. It is the the burden is on them Yeah. To deal with that. That said, I think there was a in the bill, there's language around, and I'm I'm gonna interrupt you right now. I think you can use an authorized agent. Is that the term? So if you, the consumer, don't want to deal with the matter, then you can have an authorized agent do it on behalf of you. You can have them pop you out instead. And they're that's becoming a a larger business. And, actually, I just read this morning an article in the Wall Street Journal about deleting your data. And it really pinpointed the issue, which is it is extremely easy to collect and process your data, and it's extremely hard to stop that process. But I I wouldn't say it is a reason to check this bill. I don't I don't quite agree with the senator that it's not ready for prime time. We have seen this a very similar law in New Jersey that was passed, and it survived a constitutional scrutiny. The courts said the law was constitutional, and that is under appeal. But that we always like to see in Vermont a state who has who has gone first, so to speak. And the the law has has survived Sure. Constitutional screw. So or what it's wrong. [Chair Nader Hashim]: I I agree with your position on it. I think that [Member Philip Baruth]: should come down. [Chair Nader Hashim]: Yes. It would be nice if you could just click one button and send it to five hundred different data brokers. But I don't think that's [Vice Chair Robert Norris]: Yeah. [Chair Nader Hashim]: Because that's not yet an option, that we just shouldn't do anything at all. [Vice Chair Robert Norris]: And keep you on that [Chair Nader Hashim]: But I certainly don't think it's too much of a challenge to, you know, make a put some guidance on the floor noting that. But I think we're gonna add a registered agent to make it more clear. So I'll I'll I'll locate the registered agent in another state. Yeah. Generally, super secretary of state's database. I don't know. So it's and, you know, somebody who's determined to clear or to address their data being created around. I did have a lot of They wanna They should've been able to figure out how to figure [Member Philip Baruth]: out locate a registered agent. So [Sarah Sanders]: And I think I think this conversation we're having very much illustrates the problem is that date of birth burden have been able to operate that under the radar for a very, very long time without any regulatory constraints, and the legislatures and governments are trying to, like, catch up now. And it's one of those situations where Pandora is already out of the box and having to kinda close that box is proving to be very difficult for consumers. But I I agree with you. It's not a reason to [Chair Nader Hashim]: do something about it. Yep. Fixed all your concerns. Oh, yeah. Let me go. Perfect. No. That was just I'll just repeat what I just said. I was just saying that, you know, even though you can't necessarily click a button and Yeah. Send a notice to five hundred different brokers at once, I don't think that's necessarily a reason to not allow this at all. I think that one of the other remedies if if we were to also add a registered agent that they have to reach out to, rather than just a random email address, you know, the registered agent is authorized and responsible for receiving these types of notices. And on whatever standardized or boilerplate form that the AG creates, they can, make sure easily put some information about, you know, how to find a registered agent in whatever state, generally, to the secretary of state's database. Yep. Those are my thoughts on it. [Member Philip Baruth]: I don't know [Vice Chair Robert Norris]: if I'm speaking with you. [Sarah Sanders]: I'm just wondering, given that New Jersey has already implemented a law like this, if it might make sense to hear from somebody from New Jersey about how they implemented a law like this, if that might help us sort of envision what it looks like on the ground. [Chair Nader Hashim]: Maybe for which for which artist? [Sarah Sanders]: Well, so to hear some of, you know, to to potentially answer some of her of senator Baruth's concerns about how it actually unrolls and works for people given that New Jersey is doing it. It might be helpful to hear from them as to how it's going and how they're doing it. [Chair Nader Hashim]: Yeah. If there's anybody that you know of I'll skip that. To testify. [Sarah Sanders]: Our office also has several contacts, Cindy. They're trying to handle those things. We'll keep in touch with them. Yeah. Okay. Great. Thanks. [Chair Nader Hashim]: So the the hope for what I'm saying is to send this over to the actual committee of jurisdiction institutions, ideally, like, Friday or Tuesday of next week. My focus is to keep us narrowly focused on the private action and the attorney general's role in this. [Vice Chair Robert Norris]: So Do we have possession? [Chair Nader Hashim]: Yeah. We have the possession. [Vice Chair Robert Norris]: So because I I'm I guess what I'm flagging is my I can't see myself voting for the bill Mhmm. At this point. So I don't know if we've strawed in meeting with that. But that doesn't mean we couldn't send it to the other committee, but I don't I don't want to underplay mine. I mean, I have concerns about several areas of the bill. So I don't know where other people are. [Chair Nader Hashim]: So would we be able to transfer to institutions with our recommendations for our [Vice Chair Robert Norris]: Well, amendments? It goes with our report intact. Yep. So if it's a negative, you know, if if the vote were negative, it's possible to send it out a committee with a negative report, but doesn't bode well for a bill if if it's got a negative report up for a meeting. So [Chair Nader Hashim]: So what are the areas that need to be addressed that are your concerns? Well, I I mean, I guess I just have [Vice Chair Robert Norris]: I have my doubts that it accomplishes what it sends out to do. I mean, we've talked about this before. The Internet has placed your basic data is available in so many places that then having individual consumers go and try to eradicate that information in all of those places. Not that, you know, getting rid of it in fifty percent of the places might not in some way help, but I don't know. It just it seems to me like I I think of it in my mind as kind of wishful thinking, Bill. Wouldn't it be great if you could just erase this information from me then? But I I have a hard time believing that happens. But as you know, I also don't like the the fact that it's it's set up to be very, very haphazard and different for each consumer trying to interface with all of these ad bookers. And then the consequences of the ad bookers are very swift if it doesn't go to the right per seat. So for instance, the suggestion about the registered agent, I think it's not a bad suggestion, but we don't really know how these companies would perceive that or testify about what that might mean for that. [Chair Nader Hashim]: So Well, I mean, every company has to have a Yeah. Registered agent. But if [Vice Chair Robert Norris]: if that's just an agent person who receives these kind of documents for for them. Yeah. [Member Philip Baruth]: You know what I mean? They they generally are. [Vice Chair Robert Norris]: Okay. I I mean Yeah. I haven't heard that testimony. So I'm just saying it's of the data privacy bills that we've been through, KidsCode, s seventy one, this one Yeah. Is for various reasons. It's not my favorite. [Chair Nader Hashim]: Sarah, are you able to provide any testimony as to whether or not registered agents typically receive notice? [Sarah Sanders]: I don't personally know whether they do or not, but that's something our office could absolutely look into. I, again, go back to the state broker registry where they should have a registered agent on file. And I think I'm think of what I'm hearing is is that registered agent actually the one received notice. We could we can absolutely run that down. We can find out. [Vice Chair Robert Norris]: And is it the same for all companies? Like, might be one company have a, you know, completes department and another company has a privacy. They [Sarah Sanders]: do. But I I also would you know, we we're in very different space in that sense. We're the enforcer, and so I would be curious to know what the data brokers themselves have to say. I imagine they're opposed to bill. Well, I just mean as far as the register registered agent request check app. [Chair Nader Hashim]: Maybe we can also hear from someone from the secretary of state briefly who can put on the record what a registered agent is and what they do. Any other questions for confirmation? Thank you. Right. Thank you. Very charming. I'm sorry. I'm sorry. I'm sorry. I'm sorry. I'm sorry. Yeah. [Vice Chair Robert Norris]: Judge. Judge. Yeah. David Holland over there. Right? Yeah. [Member Philip Baruth]: So good morning. Morning. I'm a judge. Tom, so I think chief superior judge. If I could, I'd like to talk about this outside to a practical perspective. I guess the first question is, what's the intent? Is the intent to to go to battle with data brokers, or is the intent to protect the covered individuals? And if the intent is to protect the covered individuals, we support that, obviously, on one of them. I anything judges get print. We had prints yesterday. We had prints in other places. The practical import of this is that it makes it more difficult for someone to find out, for instance I'll I'll talk about judges, where a judge lives. If they're sitting at home and they're mad at the judge and they wanna find out where that judge lives, as long as it's not within that fourteen days where your information can be out there, it's after that time and you told them to take it down, they can't find it. Now we all recognize that that doesn't mean that in Vermont, someone's not gonna be able to find it. When you're appointed as a judge, it tells you what town you put in. It's all over the place. So you go to the town clerk and say, what address is this? Well, you look up some other website that's maybe not a data broker. Maybe before you became a judge, you were active in the church, and it has a piece of paper up on your church website that has your address on it. Mhmm. That's not a record. Mhmm. And so I think it's important from, you know, the risk the benefit of the party to to recognize, again, this can make it more difficult. And anything that makes it more difficult for someone to give harm to a public servant or any individual in the world is a good thing. But it's a it we have to look at it from the perspective in the courts of, okay. It's a good thing, but how does it really play out? Maybe someone decides, I don't like this bill, and I'm gonna start putting up addresses of judges, And then that's not protected. But they're a private citizen or a business that's not a data broker. And so it's in some ways like whack a mole. Right. You're trying to at that point in time. And we have in the in the judicial world, we we've actually met with a company who does this for business. There's a number of companies out there that go out, and they not and you can sign up, pay money, and they do this for you to try to get your your information off the Internet. If I'm not mistaken, your next witness is from Atlas, they do that. And so I was actually just looking at their website. It just that's a company that does just that. They removed your data from the web. And my understanding is in New Jersey, they were active, and that may be some questions to ask that witness about how it worked in New Jersey. Because when you're talking about, well, how do we know where to send it and who it goes to? My understanding is companies like Atlas do that for the covered employees. Mhmm. I don't think it's free. So you you would have people you you can set up a system for the covered employees to be able to figure out on their own how to do it, or the covered employees can hire a company like Atlas or some other company and pay to have it done. The private right of action that senator Hachin mentioned is something that in the courts, we look at and say, okay. How does that going to impact what we do? And the answer is in twenty twenty four, my understanding is that in February of twenty twenty four, there were a hundred and forty separate lawsuits filed in the state of New Jersey under their Daniels Act. They certainly have a lot more people who would be covered under theirs. But don't forget, ours also covers family. I don't know what theirs does too. So we don't have it's not just the employees. I as I read it, it would cover my family who lives out of state if they're part of my immediate family. It doesn't have any restriction about living in my household. So there are a number of people who would potentially be able to bring a suit. And as it's written, if on day fifteen, they haven't taken it down, anyone whose information is still up there can file a lawsuit seeking and there's a set called statutory damages. You don't have to prove any real harm. You can get a thousand dollars of statutory damages. If you have sustained actual harm, you can establish that you can also get those damages, plus you get attorneys' fees. [Vice Chair Robert Norris]: Yes. [Member Philip Baruth]: The concern that the courts have is that this has the potential to significantly impact our our courts with a large number of cases. I don't know well many. The attorney general's office indicated that they would be monitoring things. Well, I know that the private cause of action doesn't start until January of twenty twenty six. It would be very helpful for the courts in Vermont to understand what is the potential. I can't sit here today and say that we're going to be overwhelmed, and I can't sit here today and tell you that we're going to be a banana. Knowing that other states have had I think New Jersey had class action, large number of individuals filed. It's a they're having that at least a hundred and forty in one month and having those suits come out. It does bring with it the very real potential for us to be coming back to you saying, we need help. This this bill has we had so many cases now that we need extra judges or we need extra staff to be able to process. I don't know if that's going to happen. That's right. But it seems to me that if you actually delayed the private cause of action and allow the attorney to monitor and determine what is the actual problem that this bill were to go forward. Mhmm. That would let us know when we'd be able to go forward in a way with private cause of action, and we we would have a much better idea of what the problem is. If they came out and said that there were fifteen hundred violations identified, I think we would all agree there's fifteen hundred people in Irma violations. How many different people? Well, maybe there's three hundred different people. So that's three hundred cases potentially out there. Yeah. And that would give us an assessment of how how we can or cannot handle that. [Chair Nader Hashim]: Senator Boleskine? [Sarah Sanders]: I don't wanna speak for the attorney general, but I would imagine if there were three hundred cases, the attorney general's op that might reach the level that the attorney general's office might bring up suit on behalf of the state. I also think it's important to keep in mind that the population of New Jersey is a big teeny times the population of Vermont. So I think when we're using New Jersey numbers, we need to not suggest those would be the wrong numbers. [Member Philip Baruth]: I absolutely agree. That's what I said. I can't sit here and tell you it's going to go the wrong list. I can't tell you it's not going to. What I can tell you is if the goal is protection and not some kind of battle with data brokers or a game of, like, a gotcha, then, potentially, the attorney general's office would be able to maybe set something up to provide that protection, set up a system where instead of relying on the individual covered and the covered persons, that there's a an interface with the attorney general's office, and the attorney general takes on that bill, provide that type of protection. The law enforcement it's an interesting perspective too. The law enforcement agency, which public safety, and it also is consumer protection. So perhaps the attorney general's office could look at that. But I point out the private cause of action action because it it's easy to say and I I thought this said, well, we're nowhere near the population of New Jersey. Well, we don't know about the data brokers, the and the information they have and the violations and the number. We don't have to be in population of New Jersey to have fifty or a hundred violation separate covered people get violated. It's not it's not something that we can assess at this time. Do you have [Chair Nader Hashim]: thoughts on the fifteen days of if we were to make that thirty or sixty days, would that make things more reasonable for courts? [Member Philip Baruth]: As far as the time for curing Yeah. That's something for the data brokers. Yeah. But I but what I can say is this. I'm pretty confident that if it's fourteen days or fifteen days, you're gonna hear, well, we didn't have time. Or or they saved them up and and, you know, if it's a company doing it, we got so many on one day, we didn't have time to process it. Things like that. I would anticipate that. And the court's answer would be, well, that's not a defense. There's no defense for that. If you're sent that, you have fifteen days to take care of it. End of story. So that that's a better question, I guess, for the data brokers as to what it would take for that. [Chair Nader Hashim]: And do you have any thoughts on the conversation we were having earlier about notice being sent to registered agents? [Member Philip Baruth]: That's actually a question I think that your next witness might be able to answer because I suspect if they do that for individuals now in New Jersey, they would know where it goes to for that type of notice. You may also wanna commit from the other end. Maybe in your data broker registration, you have the data broker say, where do you want it? Sometimes a registered agent could be an attorney in the state, and It's a state. You know? If you're you're an attorney, if you have a company say we want you to be our registered agent, they sign you up. Not really intending that you're going to you're gonna receive process, but they probably aren't intending that you're going to receive thousands of letters to do this. So I I think it's a different different circumstance. I I was a registered agent for some businesses, and I can tell you this never would have been contemplated nor would I have done it unless they paid me by the hour. The other thing I I would just point out is, again, for judges. If the goal is safety, I I would be remiss if I didn't point out that the federal system has twenty five hundred dollars for judges for a home security system and eight hundred dollars a year for the monitoring. Yeah. We can we're when we're looking at public safety, when we're looking at the safety and protection of judges, it's probably gonna be something happening at court or at home. And I can tell you that it would be rather than having my address not up there, which someone's probably gonna find anywhere by going to the town clerk, I'd rather have a security system than judges. So if if you wanna really address public say the safety of the covered individuals, maybe also if you if you have fines here, maybe start a fine that's going to allow state employee the covered individuals to get get monies to put in home security systems, something like that. Maybe get the tax credit. But that's protection that is tangible. As a law enforcement officer, you know, in the past, you you certainly, I'm sure have experience and thought for for a different dimension of people. You should get a you should get a camera. You know? Which would you rather have? A camera or the data broker not have your address up? I think we know the answer. And so for for if we're if the goal is safety, there may be some other avenues, and there may be avenues within this bill structure that allow legislature to provide for that expanded safety for the covered individuals. [Vice Chair Robert Norris]: Hold it down. Yeah. Bless you. Thank you. [Sarah Sanders]: You have a statement, and I certainly appreciate you wanna take the, you know, the court's capacity into account. But as someone who actually has had my personal information pulled from the Internet and had a stalker show up at my house, I actually want both. I don't want the public information being used in that way because I can have a camera of someone screaming for this at my front door, and that doesn't make me any safer. And so [Member Philip Baruth]: Yeah. [Sarah Sanders]: I I feel pretty strong. And under this bill, I recognize legislators are covered, and I think it should be. I I think we have to start playing the game of whackable. I mean, we have we have seen such a wise in Biden's. I mean, Josh Shapiro's house, this shit burns down, and people would see his husband's head was smashed in with a hammer. Like, yes. People should have security systems that then won't watch the violence unfold at their house. Like, I I think we have to start playing the game of black hole and figure out how we give you the resources. And and I recognize I'm kind of emotional about it because I've I've had someone show up at my home in threatening me, and they've got my information off the Internet. [Member Philip Baruth]: I fundamentally agree with you. I don't hear me to say that I don't think this is a valuable bill. It is. But it's a it's a bump in the road. While someone can get that information, we don't know if there's success on this bill. We don't get that information. You don't know how many people didn't show up at someone's door because they couldn't access the information because of of the success of this bill. Do I support this type of bill? Absolutely. As I said when I started, we as much public protection, a safety that we can get is important. But that's also accomplished with the bill that got a private cause of action with the attorney general still having the opportunity to be able to address this. And I agree with the belt and suspenders approach. You wanna do everything you can. So you wanna have this out here. But I also think that that security system because if someone is monitoring your home or is there, you might be able to see them if you're not there, and that can identify. And so I I do think that having the best of having all of that there, that's why I suggest if you go with this bill, it actually provides an opportunity to do just that, and that is provide you protection, getting the information off the Internet, but it also provides you an opportunity to provide a hand safety, with cameras and other things that might also, be an additional remedy. Anything further? Well, just just for my [Chair Nader Hashim]: own knowledge, what from a [Member Philip Baruth]: court perspective, what is the, you know, time involved to class action positive? Depends on the case. [Chair Nader Hashim]: Yeah. And that I think [Member Philip Baruth]: it really does. It depends on the case. It could be something that comes in. It's not that much. It could be quite a bit. [Chair Nader Hashim]: Good. [Vice Chair Robert Norris]: Yeah. Great. [Chair Nader Hashim]: Thank you. Thank you. We have Matt on the Zoom. Matt, can you hear us? [Matt Adkisson]: Matt is here. Can you hear me, guys? [Chair Nader Hashim]: Yes. I [Member Philip Baruth]: can hear [Chair Nader Hashim]: you. Great. Thanks for being here. Floor is all yours. [Matt Adkisson]: Great. Good morning, senators. Happy to be with you. My name is Matt Adkisson, and I'm the founder of the Atlas data privacy organization. I'm here in my personal capacity as a privacy and security advocate, so please take everything I share with you as as my personal opinion. At Atlas, we protect tens of thousands of judges, prosecutors, law enforcement officers, and other public servants and their family members. We have filed over a hundred and fifty enforcement actions to compel compliance with Daniel's law, and those cases are active in federal and state court. And I'm sure we'll talk some more about those. At the top, there are just a few points I would make this morning, and then I'm happy to answer questions. First, the threat environment for judges and other public officials we protect is bad and getting worse rapidly. If you read the news, you can see what's happening for yourselves. It's no surprise. We at Atlas gather a lot of signals intelligence from the population we protect and from our federal and state law enforcement partners. I wish I could tell you that relatively rural Vermont will be spared from the breakdown of civil society and the increasing violence that's coming our way, but that's just not the case. You guys are at risk as much as anybody else, unfortunately. Second, there is no higher authority than yourselves tackling this problem. DC has its hands tied for the most part. To quote Aaron Brockovich's book, Superman is not coming. You're it. If you want your people to be protected, it's up to you and you alone. Third, don't make perfect the enemy of the good. As I heard one of you just say to judge Zonay, start playing that game of whack a mole. It is worth it. It will build momentum for continual improvements. It will protect people, and I believe it will save lives. Fourth, the process of Daniel's law enforcement, assertion of rights, and compliance is working pretty efficiently in New Jersey. Using services like Atlas and others. We have plenty of competitors. Covered persons in New Jersey have been able to efficiently assert their rights. Also, federal judges covered under the federal analog of Daniel's law. And, again, I'm not a lawyer. I can't speak for the courts, but my perception is by consolidating cases and common issues of factual dispute and discovery, the courts are pretty efficiently adjudicating the enforcement actions that have arisen under Daniel's law. Lastly, you will hear a lot of noise and misinformation about a private right of action. I experienced that myself when I was at the state house for the house testimony. I would say just use your common sense. Industries do not regulate themselves. Never have. Attorney general offices do not have the resources to fight for every individual covered person whose rights are violated. You hear that from the AGs themselves. A private right of action has been a battleground for decades because it is effective. To illustrate this point and and to end, I'll just share with you the words of some other folks briefly who've talked about this. I'm quoting from an Associated Press story titled Mississippi attorney general predicts more tobacco lawsuits by states. In the story, this is from Mike Moore who is the attorney general of Mississippi who led the tobacco litigation on behalf of the states. Mister Moore said a number of doubts were raised two years ago when he pioneered the concept of suing the tobacco companies to recoup smoking related Medicaid costs. Quote, when we first filed our case, people said all kinds of things to me. It's a frivolous lawsuit. You don't have a chance. Well, we've won every hearing we've had. Next is testimony from a Vermonter, Anthony Roisman, who was providing testimony in the nineteen seventies related to the Clean Water Act. I believe he served as the chairman of the Vermont Public Utilities Commission not too long ago. He's talking about the Clean Water Act. It says section five zero five is intended to provide a right to sue polluters. The objective of the section is to allow citizens to defend their rights and not depend upon the government. It will provide citizen assistance to the government, which cannot monitor and sue every violator. It is logical that citizens should be given a greater opportunity to protect their environment. And then later on, he says, frankly, I believe the real but unstated objection of the industry opponents is that industry fears not frivolous litigation, but all too well founded litigation in which citizens are successful. And farther down, most importantly, the possible imposition of the costs of the defendant's lawyers will be a substantial deterrent to individual citizens for whom the possible economic burden, no matter how remote, would be unacceptable. And he's testifying on behalf of the Sierra Club where I believe he was an advocate. While organizations such as the Sierra Club might continue to bring these suits, I feel that it is not enough. The citizen who sees his favorite trout stream or swimming hole destroyed by pollution should have the unfettered right to go to court to redress his grievance. He should not have to depend on big environmental groups or the government any more than he should have to depend upon big government to fight his battle for him. Lastly, James Carville, the raging Cajun, from his book titled Had Enough, talking about, toward in the health care context. George Bush likes to say that, quote, no one has ever been healed by a frivolous lawsuit, end quote. In fact, he likes saying it so much that he said it in his State of Union speech. Of course, by frivolous lawsuit, he means any lawsuit. So let me share with you what some, quote, frivolous lawsuits have accomplished over the years. Did they heal the people in whose name they were filed? No. Because in most cases, those people were dead. What they did do is prevent more people from dying and make companies think twice when they were deciding what would be more costly, fixing a problem or forgetting about it. Then he goes on to list a number of important cases, flammable pajamas that resulted in kids dying, toxic shock syndrome, faulty football helmets, Ford Pintos exploding, and so on, where it was only due to a prior right of action and citizens asserting their rights in court that relief was found. So, again, we hear a lot of noise about the prior right of action. We have not experienced any successful systemic successful enforcement of privacy rights in the US without a prior right of action, which is just the ability for individuals to go to court and seek relief. So I'll end my statements there. Happy to take any questions. Thank you. [Chair Nader Hashim]: Thank you. Can you share any thought that you might have if you were here for the conversation earlier about sending notice to registered agents, whether or not that's more helpful and more and clarifies the issue a bit more. [Matt Adkisson]: It's an interesting idea if a company so there, I guess, there are two parts to it that come to mind when I hear that. The first is whether the notice could be sent electronically to a registered agent. I'm familiar with registered agents in the context of a physical mailing, which I think would make the system more burdensome and less efficient for all involved. So if the registered agent were to set up an electronic address, that might work. But we also deal with a lot of companies who have no, obviously, findable registered agent. You know, we are dealing with a lot of companies, a lot of data brokers who are operated by groups overseas, including in jurisdictions that the US doesn't have any authority over, China, Russia, places like that. And I can tell you, you know, in so far as I can share what's public, you know, we are chasing some of these groups literally around the globe as they attempt to evade service, I would say. And so service can be effectuating service on some of these groups, especially the worst actors can be incredibly difficult, certainly not within the capacity of, an individual. I would say thousands cost thousands of dollars in some individual cases or tens of thousands of dollars in some cases to try to effectuate service in under the Hague Convention in far flung remote jurisdictions. And, again, that we have we're dealing with some bad actors who are evasive in in in that service. So it's hard for me to imagine an interesting, maybe longer conversation about about what the details would be, but I can't see it really being effective based on our experience in New Jersey. [Chair Nader Hashim]: So I guess a different question then, just to make it a bit more broad. When you send when your business sends notice to data brokers, who do they who who do you folks reach out to? And and how do you ensure that you're successfully providing notice to the data broker? [Member Philip Baruth]: Well, in [Matt Adkisson]: most cases, what our platform is, and and I think our competitors operate the same way, we're just a email service provider. So we're a platform. Individuals come on, and they make choices. They themselves are sending notices to folks. We learned early on that if you try to send opt out or privacy requests from your own personal email address, you are deluged with spam as a result. And there are a lot of folks, whether it's incompetence or malice, who will take that personal email address and will, will bombard it with material you didn't want. And so the concept became allow individuals to set up a privacy specific email address that has some protections and is fit for that specific purpose. So that's the way our platform operates. And, again, I think others operate pretty similarly. One of the services we provide is we will research data brokers to help individuals understand the landscape and help them make more efficient choices about who they may wish to send notices to. And part of that research effort involves identifying, email addresses that the data broker or the company could receive a privacy notice at. [Vice Chair Robert Norris]: K. Committee, any questions? [Sarah Sanders]: Then so you do that on the behalf of individuals that are covered, not on behalf of the state? [Vice Chair Robert Norris]: That's correct. [Chair Nader Hashim]: I'm just curious. I'm just curious. Is that, like, just random people coming to your website, or are you soliciting people in the public that you've covered? I'm just curious how customer [Matt Adkisson]: We came to New Jersey at first at the request of the state's largest law enforcement union, the PBA. They cover about with active and and retired members, they cover about seventy thousand active and retired law enforcement officers, and then family members, are covered under Daniel's law, so that's an additional group. The PBA contracted with us in order to provide that service to that large group of law enforcement officers. Subsequently, we had similar arrangements set up with other law enforcement associations and unions in the state covering state police and prison guards and other folks like that. So I'd say overwhelmingly, the vast majority of the covered persons that we protect are members of those labor unions and associations or a family member who's invited by a print by a primary member. It certainly is possible, for and I'm sure it has happened for folks to come individually to our website, and sign up, but, it would be a small percentage of the folks that we represent [Chair Nader Hashim]: Right. [Matt Adkisson]: To to sign up individually on [Chair Nader Hashim]: their [Matt Adkisson]: own without the benefit of of membership in a labor union or association that's helping them get this coverage. [Chair Nader Hashim]: And forgive me. I've never heard of your company. Were you What? Around before this law, or is this something that kinda took effect after this law came to be? [Matt Adkisson]: We started the company before we ever knew about Daniel's Law. We started it to help folks in California principally assert privacy rights under that state's statewide privacy law, the CCPA. We were not focused on law enforcement to start. It was a broad approach to help whoever we could. We got a very clear signal pretty early on that the threats targeted at judges, prosecutors, law enforcement officers, and their families were uniquely dangerous and that these individuals needed the benefits of these laws probably more so than the average member of the public. And so we pivoted our attention to focus on that group because there was no private right of action in California's CCPA law when requests would be sent out and ignored, there was no recourse. The attorney with some very obscure edge cases, the only enforcement authority under the CCPA at that time was vested in the attorney general, and the attorney general did not enforce the law. We so we we essentially had admitted defeat. And as we were winding things down, we heard about the murder of judge Solis's son, the passage of Daniel's law about a year after the law passed. Ended up getting in touch with the New Jersey State PBA. They asked us to build this program with them, and here we are two years later. You know, did did not anticipate that, it would turn into what it has, but, you know, I heard at least one of you talk about personal experiences with some of this type of threat traffic. Once you spend time with people who've been threatened, once you've seen it for yourself, it's hard to look away. It's hard not to wanna help and not to wanna try to protect these folks, and so that's what we spent the last couple years doing. [Chair Nader Hashim]: Further questions, comments? Great. Thank you, Matt, for, very tough one. [Matt Adkisson]: Absolutely. Thank you, senators. [Sarah Sanders]: Thanks, Nancy. [Chair Nader Hashim]: In person. Not [Sarah Sanders]: today. So thanks for holding that time. Hopefully, on Friday, if you [Chair Nader Hashim]: continue to work on that. And I feel like you had somebody you wanted to talk [Sarah Sanders]: to me. Sure. [Chair Nader Hashim]: Yeah. Okay. Alright. So So we need their defenses. Okay. So I think Any closing thoughts or anything on this meeting? [Sarah Sanders]: Okay. [Chair Nader Hashim]: Correct? So we'll we'll be down to you on the folks we're gonna care from, and either we're going to just send this over to institutions to perhaps make our own changes, but this will figure it out over the next couple days.

Play Clip Play Full Video Pause

SmartTranscript of Senate Judiciary - 2025-04-23 - 9:30AM

This is useful for seeing what happened at the meeting without wading through the whole transcript: