Vermont Legislature SmartTranscripts:

[Representative Jill Krowinski, Speaker of the House]: Will the house please come to order and members kindly take their seats? Members, we will be taking up two bills during this block. We will take up house bill nine fifty five which is an act relating to next steps in transforming Vermont's education system and then we will hear only the floor report for S71 and act relating to consumer data privacy and online surveillance and then we will break for dinner. So with that members at 01:48 today the clerk emailed you the senate proposal of amendment on house bill nine fifty five which is an act relating to next steps in transforming Vermont's education system. The senate proposal of amendment is also posted on the house overview webpage and paper copies are available at the main table. With that member from Pulte, can you please offer us a motion to our rules to take up House Bill nine fifty five for immediate consideration pending its entry on the notice calendar.

[Representative Patricia McCoy]: Madam Speaker, I make a motion to suspend rules in order to take up H955 pending for immediate consideration pending its entry on the notice calendar.

[Representative Jill Krowinski, Speaker of the House]: The member from Pulte moves that we suspend our rules to take up House Bill nine fifty five for immediate consideration pending its entry on the notice calendar. Are you ready for the question? If so, all those in favor please say aye. Aye. All those opposed please say nay. The ayes appear to have it. The ayes do have it and you have suspended rules to take up house bill nine fifty five for immediate consideration. House bill nine fifty five is an act relating to next steps in transforming Vermont's system. The bill passed the senate in concurrence with a proposal of amendment member from Cornwall.

[Representative Peter Conlon]: Thank you, madam speaker. In fact, house bill nine fifty five has been on a journey, quite a journey through the Senate, and we appreciate all the work they've done on it. However, there still remain differences between our two sides in areas such as the timing of class size minimums, schools potentially charging tuitions or fees once the foundation formula is in, details around school construction, recommended groupings of merger committees among others. So with that, the house education committee voted eleven zero zero to not concur with the senate and to ask for a committee of conference.

[Representative Jill Krowinski, Speaker of the House]: The member from Cornwall moves that the house refuse to concur in the senate proposal of amendment and that a committee of conference be appointed. Are you ready for the question? If so, all those in favor Point of favor, please say speaker. Member from Fairfax, what's your point of order? Inquiry. Can the member repeat the straw poll? Member from Cornwall.

[Representative Peter Conlon]: Yes, thank you. It was eleven zero.

[Representative Jill Krowinski, Speaker of the House]: Will the house please take a brief recess? Will the house please come to order? Members kindly take their seats. Member from Cornwall.

[Representative Peter Conlon]: Madam speaker, we took two votes, in rapid succession downstairs. I got the two confused. It was in fact ten one zero.

[Representative Jill Krowinski, Speaker of the House]: The so the question is, shall the house refuse to concur in the senate proposal of amendment and that a committee of conference be appointed? Are you ready for the question? If so, all those in favor, please say aye. Aye. All those opposed, please say nay. Aye. Ayes appear to have it. The ayes do have it and you have refused to concur in the senate proposal of amendment and requested a committee of conference. Pursuant to your action, the chair appoints the following members to serve on the part of the house, The member from Cornwall, representative Conlon. The member from Brattleboro, representative Kornheiser and the member from Linden, representative Quimby. Member from Pulte, can you please offer us a motion to suspend our rules to message our action on House Bill nine fifty fifty five to the senate forthwith.

[Representative Patricia McCoy]: Madam speaker, I make a motion to suspend rules in order to message our actions to the senate on h nine fifty five forthwith.

[Representative Jill Krowinski, Speaker of the House]: The member from Pulte moves that we suspend our rules, message our action on house Bill nine fifty five to the Senate forthwith. Are you ready for the question? If so, all those in favor please say aye. Aye. All those opposed please say nay. The ayes appear to have it, the ayes do have it and you have suspended our rules message or action on House Bill nine fifty five to the Senate forthwith. Member from Pulte, on our notice calendar is senate bill 71 which is an act relating to consumer data privacy and online surveillance. Can you please offer us a motion to suspend rules to take up senate bill 71 off the notice calendar for immediate consideration?

[Representative Patricia McCoy]: Speaker, I make a motion to suspend rules in order to to to take up off the notice calendar for immediate consideration s 71.

[Representative Jill Krowinski, Speaker of the House]: A member from Pulte moves that we suspend our rules to take up senate bill 71 off the notice calendar for immediate consideration. Are you ready for the question? If so, all those in favor, please say aye. Aye. All those opposed please say nay. The ayes appear to have it, the ayes do have it and you have suspended rules to take up Senate Bill 71 for immediate consideration. Senate Bill 71 is an act relating to consumer data privacy and online surveillance. The bill was referred to the committee on commerce and economic development which recommends that the house propose to the senate to amend the bill as printed in today's calendar. The member from Bradford, representative Priestley will speak for the committee. Please listen to the second reading of the bill. Member, we need to hear the second reading of the bill.

[Representative Peter Conlon]: S 71, an act relating to consumer data privacy and online surveillance.

[Representative Jill Krowinski, Speaker of the House]: Now member from Bradford.

[Representative Monique Priestley]: Madam speaker, there is a transaction happening right now at scale involving every single person in this chamber and every person who sent us here. You don't see it on your bank statement. Nobody asked for your signature, but it is happening and it is generating billions of dollars for some of the most powerful companies in the world. Every time a Vermonter searches for a symptom online, visits a news website, uses a navigation app on a rural road, or simply carries a phone in their pocket, data is collected about them. Not in some abstract theoretical sense, precise geolocation, health interests, financial behaviors, political leanings, religious affiliations. That data is packaged, sold, resold, and then used to build profiles of individual Vermonters that they have never seen and cannot access. This is not a hypothetical future risk. It is the operating model of 2026, and Vermont has had almost nothing to say about how it's regulated. We are a small state. We do not have armies of regulators. We do not have the resources to fight these companies one lawsuit at a time. What we have is this, the power to establish in law what we as a community believe is owed to the people who live here. The right to know what is being collected about you, the right to correct it, the right to delete it, the right to say no. These are not radical ideas. These are basic principles of human dignity applied to a digital world that has moved faster than our laws have. For years, the company's profiting from this system have told us that regulation would hurt Vermont's Vermont's economy, harm small businesses, and stifle innovation. What they haven't mentioned is that they are already using Vermont family's most sensitive data to build competitive advantages over small businesses they claim to be protecting. They sell targeting data back to advertisers, which drive up costs for local businesses that cannot compete. They collect data on patients, on children, on domestic violence survivors, and sell it to whoever is willing to pay. The innovation they're asking us to protect is in many cases innovation of finding new ways to profit from people without their knowledge or consent. Vermont has moved carefully on this. We have studied other states. We have worked with industry, with advocates, with the attorney general's office, and with our colleagues. What is before us today is a framework that gives Vermonters some measure of control over their information, sets clear rules for businesses, and gives our attorney general enforcement authority. You can find our stricel amendment of s S71 on page 3,770 in today's calendar or on the House Commerce and Economic Development Committee webpage. S71 creates a comprehensive data privacy law for Vermont. Effective in January 2028, the Vermont Data Privacy and Online Surveillance Act is intended to provide consumers with various rights to their personal data with businesses that operate in the state, including the right to delete their data and to opt out of their data being sold. Section 2415A begins creating the short title of the act and then sets forth the definitions that will be used throughout the sub chapter. There are 50 definitions in this bill, many of them cross references to other state and federal laws, But most of the definitions are substantive, including biometric data, collect and consent. Biometric data is used is data generated from the processing of a person's unique characteristics like one's fingerprints or iris scans. Biometric data is sensitive data, which is a term defined later in the bill. Consent means a clear affirmative act signifying a consumer's freely given specific, informed, unambiguous agreement to allow the processing of personal data related to the consumer. This definition is important as the bill requires the consumer to consent before certain types of data processing or selling. A controller is a person who alone or jointly with others determines the purpose and means of processing personal data. Controllers and processors are the main types of entities regulated by this bill. De identified data means data that does not identify and cannot reasonably be used to infer information about or otherwise be linked to an identified or identifiable individual or device linked to the individual. This type of data is not personal data and is not subject to the most of the regulations in this bill. Other important definitions of this bill include personal data, which is any information including derived data and unique identifiers that is linked or reasonably linkable alone or in combination with other information to an identified or identifiable individual or to a device that identifies or is linked to or is reasonably linkable to one or more identified or identifiable individuals. Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects, including an individual's economic situation, health, personal preferences, interests, reliability, behavior, location, movements, or identifying characteristics. Publicly available information means information that is made available through federal, state, or local governments or to the general public from widely distributed media or information that a controller has a reasonable basis to believe that the consumer has lawfully made available to the general public. This type of information is also not considered personal data. However, there are several exceptions. Biometric data, information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website, either in exchange for payments or free of charge, genetic data, and information provided by a consumer on a website or online service made available to all members of the public for free or for a fee where the consumer has maintained a reasonable expectation of privacy in the information. Sensitive data includes personal information like one's religious beliefs or immigration status, health data, precise geolocation data, neural data, financial account information, government ID numbers, and more. Section twenty four fifteen b is the applicability section. A controller that processes the data of more than 35,000 Vermonters is considered governed by this bill. Also, a controller that collects or processes the sensitive data or sells the personal data of more than 3,000 Vermonters is governed by this bill. Section 2415C lists what is exempted from this bill. Exemptions include state and local governments, various various health care and HIPAA related exemptions, exemptions related to the federal laws that already provide consumer privacy, including the Fair Credit Reporting Act, the Drivers Privacy Protection Act, Grammle Schbylie Act, and the Farm Credit Act. Most insurance companies are exempt as well. Section twenty four fifteen d sets forth the consumer's personal data rights. Briefly, consumers will have seven of the following rights. One, the right to know whether a controller is processing the consumer's data. Two, correcting inaccuracies in the consumer's personal data. Three, deleting the consumer's personal data. Four, obtaining a copy of the consumer's personal data. Five, opting out of targeted advertising, the sale of personal data, and certain types of profiling. Six, if profiling of the consumer resulted in an automated decision that affected the consumer negatively, question the results, investigate the personal the personal data that led to the decision. And seven, obtain a list of third parties to who the controller has sold the consumer's personal data to. Also, consumer will have the right to use an authorized agent to allow the consumer to authorize its rights pursuant to this section. The rest of the section provides a timeline for the controller to respond to requests of the consumer and the procedure for appeal. Section 2415E provides the duties required of controllers. Controllers will be required to limit the collection and collecting the personal data of consumers to what is reasonably necessary and proportionate in relation to the purposes for which it's processed. A controller cannot process that any and data sorry, process that data for any new material purpose without getting the consumer's consent. Controllers cannot process or sell the sensitive data of consumers without their consent. If it's the sensitive data of a child, it must be processed in accordance with COPPA and if applicable, the Vermont age appropriate design code act. Controllers must allow consumers to revoke previously provided consent and cannot sell the personal data of a minor. The bill allows controllers to offer different prices to consumers who voluntarily participate in a loyalty or rewards program. The rest of this section requires controllers to provide a privacy notice and a way to allow consumers to exercise their personal data rights. Section 2415F sets forth the duties of processors and contracts between controllers and processors. In essence, processors must adhere to the instructions of the controller and assist the controller in complying with the bill. Section twenty four fifteen g creates the requirement for controllers to produce data protection and impact assessments if they perform certain duties. An impact assessment is required if a controller conducts processing activities that presents heightened risk of harm to consumers. Data protection assessments must identify and weigh the benefits may flow from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing as mitigated by safeguards that can be employed by the controller to reduce the risks. Additionally, each controller that engages in any profiling for the purposes of making a decision that produces any legal or similarly significant effect concerning a consumer must conduct an impact assessment for the profiling. The attorney general may require that a controller disclose any data protection or impact assessment that is relevant to an investigation conducted by the attorney general. Section twenty four fifteen h creates the requirements for managing de identified data. In essence, controllers must take reasonable measures to ensure any de identified data remain so and does not attempt to re identify the data. Section twenty four fifteen I provides the construction of duties in this bill, which provides clarifications that some normal business operations of controllers is not intended to be a violation of this act. These operations include providing a product or service specifically requested by a consumer, responding to a security incident, and using personal data for certain internal uses. Section twenty four fifteen j provides that the bill will be enforced through the consumer protection act. The attorney general will have sole enforcement and consumers are explicitly not given a private right of action. Section 2,415 ks is a consumer health section and provides additional protections for consumer health data, including the prohibition on creating a geofence within eighteen fifty feet of a health care facility. Section two of the act provides intent language clarifying that the general assembly expects future appropriation and resources be provided to the attorney general's office for enforcement of the act. It also suggests that the attorney, sorry, that the general assembly ensure businesses are given resources to comply with the act. Section three creates an eighteen month cure period for enforcement of the act. Starting in January 2028, the attorney general shall issue a notice of violation to a person that deems to have violated the act and not begin legal action if it believes there is an opportunity to cure. This cure period lasts until 07/01/2029. The act if passed would take effect on 01/01/2028. This bill would establish Vermont's first comprehensive consumer data privacy law. It gives Vermonters the right to know what personal data a company is collecting about them and why. The right to access that data, the right to correct it when it's wrong, the right to delete it, the right to take it with them to another service, and the right to opt out of having it sold or used for targeted advertising, including through a simple global opt out signal that works across platforms. These rights belong to Vermonters and businesses will will be required to honor them. It requires businesses that collect and process data to be transparent about what they're doing, to collect only what they actually need for the purposes they've disclosed, and to get consent before processing the most sensitive categories of information. It requires consent for the collection and use of sensitive data, including health information, precise location, genetic data, biometric identifiers, financial account information, and data revealing racial or ethnic origin, sexual orientation, immigration status, and gender identity. It prohibits using geofence technology to track people near near health care facilities, including reproductive health clinics and mental health providers. And if a company knows or willfully disregards that a user is 18, it cannot sell that person's data or use it for targeted advertising. What this bill does not do is equally important. A business must have processed the personal data of at least three, 35,000 Vermonters in the prior year, the sensitive data of at least 3,000, or offered personal data for sale for at least 3,000 people before the law applies at all. The local hardware store, the small nonprofit, the community organization running a mailing list are not covered by this bill. Federal frameworks that already govern healthcare, financial data, education records, and credit reporting are left in place. HIPAA, GLBA, FERPA, and FICRA are exemptions, are built directly into this bill, meaning entities covered by those laws and not covered by this law. It does not apply to the press to openly overseeing academic research or to government entities in their ordinary course of their work. Enforcement belongs solely to the attorney general. There's no private right of action. That said, intent language states if the resources needed for meaningfully meaningful AG enforcement are not provided, this body may consider adding a private right of action in the future. The law does not take effect until January '28, and there is an eighteen month cure period before this bill is eligible to be enforced, which ends 06/30/2029. Additionally, the attorney general's office is explicitly directed to provide guidance along the way. Your house committee on commerce and economic development had hard conversations. There are additional protections as some committee members believe Vermont's deserve Vermonters deserve that we will have to come back to in future sessions. That is the legislative process. But right now, today, a company can collect data about where Vermonter goes for healthcare, what medications they research, who they communicate with, and where their children go to school. They can package that information and sell it. They can share it with data brokers who sell it again. And Vermonters have no right to know any of this is happening, no right to stop it, and no recourse when it causes harm. When this law takes effect, a Vermonter who wants to know what a company has collected about them will be able to ask. A Vermonter who wants the data deleted will have the right to request it. A parent whose teenager's information is being used to serve targeted ads will have legal ground to stand on. None of that exists today. This bill brings us closer to offering the protections afforded to residents of several of our neighboring states. We heard testimony from the following. Executive director of the Vermont Medical Society, founder and CEO of Mighty, Vermont resident, founder of Schock, director of policy and legislative affairs of the attorney general's office, Red Clover Advisors, president of the Vermont Bankers Association, counsel of the Vermont Chamber of Commerce, founder and CEO of discernible inc, government relations director to primer, Piper, Egleston, Kramer, deputy director of the electronic privacy information center, chief operating officer of Check My Ads, owner and principal compliance consultant for Gazelle Consulting, managing director and associate general counsel for CIFMA, legislative intern, Mariner Strategies, privacy enforcement attorney, Vermont resident, small business consultant, former attorney adviser to the FTC commissioner, Rebecca Kelly Slaughter, lobbyist for Vermont Retail and Grocers Association, compliance and privacy officer for h twelve v t, Internet Safety Labs, economic security policy and outreach director for the Public Assets Institute, president of Vermont Ski Areas Association, senator from Connecticut State Senate, privacy for cars, board chair of the technology alliance, Vermont Arts Council, data services, center for democracy and technology, professor of law from Georgetown University Law Center, Common Good Vermont, co director, the United Way of Northwest Vermont, executive director, Health First, advocacy director of ACLU of Vermont, policy analyst of consumer reports, legislative council, vice president of Vermont government oh, sorry. Vice president of government affairs, Vermont Chamber of Commerce, consumer protection advocate for VPERG, de identified data expert, founder and principal AgilityLab Consulting, private library technologist, director of AI and privacy for the Consumer Federation of America, cofounder of Front Porsche Forum, partner of Lean and Public Affairs. The bill passed out of committee favorable with an amendment on a vote of eleven zero zero. Your committee on commerce and economic development respectfully request your support on the amendment of this bill.

[Representative Jill Krowinski, Speaker of the House]: And now members, we will recess for break. And so the house will stand in recess until the fall of the gavel at 06:30PM sharp.