Vermont Legislature SmartTranscripts:

[Rep. Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Friday, 01/30/2026 at 11:00 in the morning. I'm from the the order of. Take testimony. Page two eleven. So we have the attorney general's office with us, and we have the secretary of state's office with us as well. Who would like to go first? Laura?

[Lauren Hibbard (Deputy Secretary of State)]: For us to go first or for the attorney general's office to go first?

[Rep. Michael Marcotte (Chair)]: It's Why don't we hear from you first?

[Lauren Hibbard (Deputy Secretary of State)]: Alright. Can I testify concurrently with David?

[Rep. Michael Marcotte (Chair)]: Sure.

[Lauren Hibbard (Deputy Secretary of State)]: That's just easier for us so that we can communicate although harder for David. Good morning for the record. My name is Lauren Hibbard. I'm the deputy secretary of state, and I have with me.

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: Good morning. David Hall, your record, Director of Business Services Division in the Secretary of State's office.

[Lauren Hibbard (Deputy Secretary of State)]: A pleasure for us to be here with you and to talk about this bill. As you all know, our office does house the registry of data brokers and we have been looking at this bill closely with the lead sponsor, our office and the attorney general's office and have asked from for some key modifications from its original state. And I have to admit, I have not had an opportunity to review the bill as currently drafted in great detail. And so I'll have to turn to David on some of those details. But on a very high level, we really want to make sure that the data broker structure that Vermont has built and currently has is as strong as possible before we start adding additional responsibilities in our office. Most notably, the option and requirement that was in the original draft to build an opt out for Vermonters. We felt like that was too early in the process of where we are now in Vermont with the registry of data brokers. And we are asking to have a study about that our office would be responsible for obtaining, studying how other states are providing opt out for consumers, the cost of that, and the mechanisms that would be required to provide that. So that was our key biggest concern. And I believe that now has been addressed.

[Rep. Michael Marcotte (Chair)]: Okay. Questions for Lauren or David? Is it the time frame that you're looking at to gather the information and get it back to us?

[Lauren Hibbard (Deputy Secretary of State)]: Well, so we had a really productive call with the folks at California Privacy, and, you know, they are a month in to having opt out so and they are the first to have it. And they built a system fairly quickly, but it took two years. And I believe a good amount of money. So what I forget the exact number, but I remember thinking it was a good amount of money. And so I would really like to have us have the report back to this body within probably more

[Rep. Michael Marcotte (Chair)]: than

[Lauren Hibbard (Deputy Secretary of State)]: two years, because it takes a year or two for operationally for you to learn how something is working. And for us to have a really productive engagement with them. I think we want to know how it's been on the ground for them for a period of time. So that would be my inclination. David, I'd invite you to add any more details from that conversation or about thoughts about the bill as well. Because again, I just I was speaking very high level.

[Rep. Michael Marcotte (Chair)]: Sure. Mr. Chair. So

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: from from my notes, the the California system costs $4,000,000 to build over two years. It was very interesting to hear because it was the first system in the country. You know, they sent out their RFI, their request for information. They got some feedback. Ultimately, the range of proposals that they received were from half $1,000,000 to $10,000,000. So they felt like nobody really knew what it was gonna cost or what it was gonna look like to build it. But in the end, it was about it was just over $4,000,000. And, you know, it's I I guess what struck me about that as well is the the the primary technological feature that makes the whole thing work is identity verification system, essentially. Because it's obviously through the internet accessible worldwide, anybody can come to it. They have to verify California residency and identity, which they have a population of 40,000,000 people. That's a pretty significant undertaking. So the fact that they built this thing and have it running and have adopted regs following on several iterations of that statute is, I think, pretty impressive. But I don't think that they were shy about saying it was a big lift. It was really challenging. Think it's appropriate to say we talk to them about models. Right? Like, is this something that we build from scratch in Vermont? Does it cost the same, or is it cheaper because it's smaller? We don't know. And are there possibilities, mechanisms by which we might be able to utilize, leverage their system? And they were very gracious in saying they would work with us to review the possibilities. But I think it's fair to say there are a lot of legal, procedural, and technical issues surrounding either path, whether it's we go our own or we try to integrate with them. So it's a dynamic situation and they're definitely leading, but they are a couple of months in. I guess I'd also mentioned they said they had received thus far roughly 160,000 or 70,000 inquiries from California residents. So it's, you know, it's coming along.

[Rep. Michael Marcotte (Chair)]: It makes sense to build into the language that maybe you give us, you know, an update next year of how things are going, what you're learning. And you're looking at report back in '27 or '28?

[Lauren Hibbard (Deputy Secretary of State)]: Mister chairman, I think we would be looking at '28 or '29. And to be really brass tacks about it, I think we would want a committee to help us with this work, including someone from ADS, perhaps a legislative member, and some money so that we can hire a consultant because this is work that is outside of what the capacity of our team right now. So we would need some study language that includes some named participants and some and and a financial allocation.

[Rep. Michael Marcotte (Chair)]: K. Any ideas on the amount of money you're looking at?

[Lauren Hibbard (Deputy Secretary of State)]: I'm I will come up with the number. I don't have one off the top of my head. I'll have to look at what other reports. We we have not hired a consultant as the Secretary of State, at least to my knowledge in my time there. But what has become very clear is our team is so small. The cost of reporting on things that are outside of our current scope is just an incredible burden. So this is where we're needing to do this.

[Unidentified Committee Member (House Commerce & Economic Development)]: So if I can broaden our conversation to the rest of the bill a little bit, I was going to ask about staffing and the registry, right, as as we're updating the registry and then a registration fee that we would increase significantly. So I guess lots of questions, right? But the question is, how is the staffing now? I know we talked about another bill, and it said your staffing was pretty much as capacity, and it would be hard to add anything else. And so I'm curious if there are other parts of this bill that make you feel like you need to add staff. And then if this increased registration fee could help cover either the additional staff necessary or the consultant for both, how would we look at any of that?

[Lauren Hibbard (Deputy Secretary of State)]: So thank you very much for that question. We support the increase of the fee, primarily so that it can help support the enforcement functions that, as we envision it, would occur at the Attorney General's office, in terms of ongoing enforcement. And, you know, within the Secretary of State's office, we really don't have enforcement powers in the majority of our spaces, with the exception of the Office of Professional Regulation. In our election space, and in our business services space, we really rely on our partners at the Attorney General's office to do the enforcement work. And so we were envisioning the increase of fees as a way to help support the AGOs work. And I'll let the AGO speak on what they envision for enforcement. But in terms of staffing of the registry itself, I think David has done an incredible job as the director. And he has a very small team. He has a there are a total of six responsible for all business entities in the state, including data brokers. We absolutely could put a position in this bill for his division. But in full transparency, our current plan is to ask for a position for his his division in the big bill, because we didn't have another vehicle that I mean, I guess this could have been the vehicle, but we we thought the big bill was the best vehicle for that position, and the most transparent would have the most conversation around it. We really strive to make sure that especially small business owners have the ability to talk to someone as quickly as possible, and get answers to their questions as quickly as possible. We did just build a brand new system for his division for the Business Services division, that's available to people twenty four hours a day, seven days a week, the questions come at that same clip. And our team is beyond capacity at this time. So that's why we're asking for that position. If we had considerably more duties around data brokers, including opt out, I do think that we would need to consider adding a position, because we would be invariably fielding a lot more questions about that functionality from people who are not in our system all the time, or business owners, that would be consumers. And when we did speak with Cal Privacy, they said that one of the biggest things in the last month that they have learned is the volume of consumer questions and consumer concerns, and that they've had to really figure out a way to streamline those communications have some automatic responses. They have a whole system for it. But I would anticipate that that would be probably our biggest lift outside of the creation of the system itself, if that's what we did. So I do think if we had more functions in this space besides the registry, that we would need an additional staff person. But again, at this point, we're asking, please don't give us more additional functions than the registry. Let's study how it's going in another state. And really explore, I think we have a responsibility, a due diligence to see if we can join the California system, the IT system in some way, because that would be undoubtedly the most economical.

[Unidentified Committee Member (House Commerce & Economic Development)]: Lauren or David, I was just wanting to do California legislature, Cal privacy team do a study that could be like referenced or anything? Or is that do they just do it?

[Lauren Hibbard (Deputy Secretary of State)]: Correct me if I'm wrong, I don't think they did a formal study. I think they studied it as a group, but they didn't publish a study, for instance.

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: I think if I recall correctly, we actually asked them that and they were just like, Nope, they just told us to do it. And we had to go. Okay, okay. And did. Thanks.

[Lauren Hibbard (Deputy Secretary of State)]: They looked at a lot of resources. They did a lot of research. They talked to data brokers. They talked to consumers. But I don't think they have anything published that we can, like,

[Unidentified Committee Member (House Commerce & Economic Development)]: copy for lack

[Lauren Hibbard (Deputy Secretary of State)]: of a better word.

[Rep. Michael Marcotte (Chair)]: Wonder if we could put one of them on on this committee that we wanna put together.

[Lauren Hibbard (Deputy Secretary of State)]: I don't know the the the politics of that, and I defer to you.

[Rep. Michael Marcotte (Chair)]: Did they say that they would be available as a resource to this?

[Lauren Hibbard (Deputy Secretary of State)]: They sure did. They were very gracious about that.

[Rep. Michael Marcotte (Chair)]: I think that would help a lot.

[Lauren Hibbard (Deputy Secretary of State)]: I think it would help a lot too. And, you know, they are really in terms of the program and their IT system in the infancy. So for us, that's why we would like to sort of see how that develops and, and see how it's going and use them as the example to see if we want to follow that route or go a different route. And I do think there's a lot of exciting things that could happen in the IT space around their work. That would make it simpler for the consumer and for data brokers, quite frankly.

[Rep. Herb Olson (Member)]: Yep. So Herb Olson, I appreciate your thoughts and when you talk about the need for some sort of ID verification system that that I appreciate that. I'm wondering whether California or anyone has thought about some sort of a build back mechanism in for the purpose of, you know, designing something and enforcing that kind of matter. Might take a little load maybe off your budget or whatever.

[Lauren Hibbard (Deputy Secretary of State)]: My understanding is that they have a sub fee to their fee to support the system for data brokers. I haven't looked into that. We obviously would need to explore that. That would be something that we would have to look at in the study. And we can probably work with legislative counsel on some of the specific language about what should be examined as part of the study. But yes, fee structure, and the impact of the system on the fee structure should should be considered. I would think I don't believe they're charging a fee to the consumer. I believe it's only a fee to the data broker.

[Rep. Herb Olson (Member)]: Jonathan? So yeah, I understand the fee issue. What I was thinking of was a little bit different from, a fee or an enhanced fee or whatever. Some regulatory agencies have a build back authority where they're able to charge the regulated entity for the costs of enforcement, that kind of thing.

[Lauren Hibbard (Deputy Secretary of State)]: Yes. So you I think probably the Attorney General's office would be the better office to talk to about that. But yes, I understand what you're saying. It would be sort of a recoup of legal fees by the state of Vermont from the data broker. And there's a couple of different structures. And we have been talking with the Attorney General's office about this, of ways to model requirements for data brokers to make it simpler to obtain fines and fees back from them when there is an issue with, you know, an enforcement issue. So I think I would defer to my colleagues there. But yes, I would encourage the legislature to streamline the enforcement as much as possible, because this is really a new space and to make it as easy as possible for the Attorney General's Office to recoup money for the enforcement work, I think would be prudent.

[Rep. Herb Olson (Member)]: Thank you.

[Rep. Anthony 'Tony' Micklus (Member)]: I just want to express my strong support for working with the state of California in terms of getting some software down right. I'm in the IT industry, 90% of what we do is taking other people's ideas. There's no need to reinvent the wheel. So I just want to, for the record, state, I strongly support working with them to come up with our own system or using their system with a subscription fee or whatever.

[Lauren Hibbard (Deputy Secretary of State)]: This is essentially the exact question I asked them earlier this week is, would you be open to a subscription fee? We can keep our data siloed. And we got into the weeds of you know, how much would need to be modified to have a Vermont instance and, and what what would that cost? And how would we pay for that? And, know, there's, there's a lot of conversations that need to be had. And I could tell that they were quickly getting excited about that idea or that possibility. We certainly were excited about that idea or possibility. And you have our office's commitment to really look into that because it would invariably save us a lot of money as a state.

[Unidentified Committee Member (House Commerce & Economic Development)]: Just add on on Micklus' thing that I know other states are having this converse same conversation. Had a call with

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: them and stuff too. So, yeah, it seemed like great.

[Unidentified Committee Member (House Commerce & Economic Development)]: Thank you for thank you for taking the time to do that.

[Lauren Hibbard (Deputy Secretary of State)]: That was very productive. I thought it was an excellent use of our time.

[Rep. Michael Marcotte (Chair)]: David,

[Lauren Hibbard (Deputy Secretary of State)]: did I miss any big pieces of the bill that that we should touch on? I know I'm leaving the enforcement piece to the Attorney General's office because I really do think that they would be the primary enforcement mechanism. But I do you want to talk about the timeliness of registration perhaps?

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: Sure.

[Lauren Hibbard (Deputy Secretary of State)]: Thank you. Sorry.

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: No speed That's all right. I think we support this change that you have about a, well, not necessarily prospective, but a more immediate duty to register. Right now, it's it's, you know, as you are all sure well aware, it's a one year look back, and the way you've changed it, it's a thirty day duty and then an annual in July. I think that works well for us, and I think it's better data, frankly, because it's more timely, and we don't have to wait eleven months to learn that last year you were a data broker. I was looking at the pieces about the consumer rights web page as well. I see any problem, you know, with what with the substance of it. I I wanna make sure that, like, what we have is responsive to what you want to see. So, you know, right now on our website, you can go find data brokers. Something that I don't like that I'm working on is that you can't search for all of them using the search functionality. You have to know the name, which I think is, you know, I I can see originally why somebody would design it that way because when you go to the site, you're looking for a business, right? But sometimes people want to be able to access all of the data and that we have that functionality for other things, for LLCs, for example. So, should see that working differently soon. So that's something that you need to legislate. We're just going to fix that. You also have already the bulk data download, which data brokers are in that. And it is an Excel or CSV file It's sortable, downloadable. So, you could go right now and for any given type of entity, including a data broker batch, you could get everybody. So, you do have that capability. It's just in the bulk download, not search download. And as I'm looking at the language, it says a downloadable spreadsheet of data brokers that are registered. I think we checked that box already. I'm perfectly comfortable with it being here. A link to a page on each registered data broker's website that allows consumers to to leak. That one gives me a little bit of pause because managing a direct link to 400 or 800 other websites could be a real challenge. I think having the information and let it be accessible to a consumer is a good idea. Part of what they need to tell us is where is the what what is the URL and keep it up to date. Having us manage live links is is those change all the time. They break, and and I would rather people not be calling my staff and be like, why doesn't the, you know, the web page for data broker x y z work? You know? Like, dude, I don't know. I don't know if you can say dude in testimony. Sometimes I do. Sorry. Old habits die hard. So that's something to consider. An email or letter template intended for a consumer to use to send a data broker, you know, to follow-up. I mean, I don't I don't object to to drafting that as a template. I I don't know if that's a if that's a one size fits all. I'd have to think about that. You know what I mean? Like, how much nuance would need to go into that kind of communication? Or is that easily reduced to a uniform template? I'm sure I could come up with something, but let me think on that one. And then the last one, any additional information of the rights? Certainly, can definitely populate on our site good information about data brokers, about the bill, about updates. We can push out notices to businesses. You know, so far, consumer access of to the data broker info is we just don't have a lot of data on that. I imagine that if we get to the point of offering the opt out, then that's gonna change the dynamic and and have our role be as much consumer facing as it is data broker facing. But right now, most of the work that we do in the service we provide is to help data brokers navigate their duties. So that's really all I can see for now. Do want to give other specific questions?

[Rep. Michael Marcotte (Chair)]: Great, thank you. Lauren, are you hopping off?

[Lauren Hibbard (Deputy Secretary of State)]: I'm gonna stay on just to hear the conversation if that's okay with you.

[Rep. Michael Marcotte (Chair)]: No, that's great. I have another question for you, not related to this bill, another bill. And it's on your old hat is OPR.

[Lauren Hibbard (Deputy Secretary of State)]: I'm happy to answer it now or later or however you see best.

[Rep. Michael Marcotte (Chair)]: Well, if you're gonna stay on, why don't we hear from Todd and then

[David Hall (Director, Business Services Division, Vermont Secretary of State)]: Thank you.

[Lauren Hibbard (Deputy Secretary of State)]: I think that'd be great. Yep. Thank you.

[Rep. Michael Marcotte (Chair)]: Good day.

[Todd Daloz (Assistant Attorney General)]: Assistant attorney general. Now I'm that way, don't make a mistake. Todd Dayloz, assistant attorney general. Thank you for having me in again. My apologies that you've enjoyed my company quite so much this week, but I am really excited to talk about h two eleven. I think it is yet another space that this company is doing terrific work updating a really important piece of consumer protection and a really important tool for consumers to protect their own data and privacy. So I just wanted to start with that appreciation, you know, reiterate our support for the direction this bill is moving. Vermont was a leader in data protection in the data broker space maybe ten, twelve years ago when this bill first passed or this law first passed, and it's great to see the energy around updating it. I think likely there will be, you know, further iterations as this moves through this body and and hopefully downstairs with the senate as well. But generally speaking, we really support it. We think there's real value in deletion for consumers. We think that that ability of consumers to control the access to their data is incredibly powerful and important. And the bill's ability to do that, especially in the initial stages before the secretary of state has an opportunity to really look at how Cal privacy is moving, look at what the industry may provide in that technological space is a great first step. So again, really support that. I was also in on the phone call with Cal privacy, and I'll just reiterate what deputy secretary Hibbard said. Seem they seem like really valuable partners, really interested and engaged in helping support Vermont. And I think there's a real opportunity here to expand their work in a way that supports this, you know, in a kind of federalized state by state system. So we'll continue to stay engaged in that as much as it remains helpful. You know, the registry really sits with the secretary of state, but, of course, it's important for us to see how that all works because the enforcement side is where things end up if the registry isn't clicking. A couple notes, you know, on the bill, generally notes of appreciation to begin with. I think the updating on penalties and fees makes a lot of sense in the current time period, especially the removal of the cap on penalties. And I say that and flag it because we have had cases that would have had higher penalties because of a failure to register, a repeated multi year failure to register. And so withdrawing that penalty cap helps us go after those industries more aggressively and ensure further compliance, which, again, for the most part, we see across the board with with folks who are registering. It may make sense, too, to just share a little bit of our enforcement perspective. And I think joining us is assistant attorney general James Lamoille, who does a lot of this work. And so if there are specific questions, James is here as a resource. I'm not gonna make him jump in necessarily on testimony unless any of you ask any question below, like, an inch deep, and then James will answer all. So on enforcement, you know, it's just to share with you how we have been enforcing law. I think it's helpful to sort of see how this work plays out and has played out. So, you know, one avenue for enforcement is media reports, and I'll give you an example of that. There was a there were some reports in in national media around activity in a certain industry, not what we would think of as traditional tech industry, but there was an entity that worked with this consumer facing industry, the airline industry, that was taking consumer data, packaging, and selling it. And through the media reports, we were able to follow-up and under the existing law, enforce and receive, you know, the penalties and get them again to comply. And it they're now compliant. That's what we look for in any enforcement action. Right? It's not to make the money. It's to get people to follow Vermont law. So media popular media is one avenue. But, of course, that only works as well as the fourth estate work. Right? And and we all know the challenges that the media is facing right now. So I flagged that just to say that's that's one area. Another area is a lot of advocates out there, privacy advocates, and otherwise will flag potential bad actors in the field, make reports to us like any enforcement agency. You get reports, and that's another way that we go in and look. There are also multistate actions where other enforcement entities across the country will reach out and say, hey, we think these folks are acting in your jurisdiction. Would you like to join us in an enforcement action? Those tend to be the higher level bigger players, but they're also very valuable. It's kind of nationwide coverage or as close as it as we can get. But the last one, which is most relevant to the bill, is auditing the registry. So one thing we have done specifically under Chris Curtis, who's been here before, look back on the registry and say, okay. Year one, two, three, x, y, z broker was registering, then they didn't. Let's reach out. Let's see. Let's make sure there's not a lapse there. And so we think that as the registry expands, as the coverage of the bill expands, there will be more value to that. Again, it's a way of assuring compliance with the law. And so we'd continue to work on that. There were some questions around payment bill back repals. And I would say in this instance, as an initial starting point, I think an increase in the fee based on what we believe will be the increased costs of running the program is merited. That includes some enforcement costs and and some languages in the bill that you've seen now includes a bonding requirement of about $20,000. You know, that number is really meant to reflect what we think will be the kind of late fee, not malfeasance, just oversight, administrative oversight. And I think we'll see a lot less of that with the automation that exists in the industry. I don't think we're we're no longer asking somebody to remember to pay the bill at the end of the month. Right? These industries are very tech savvy, and they'll be very capable of ensuring that they're continuing to register. Those that don't, we want a simple administrative process to seek remedies that doesn't necessarily require us to file cases in court. And so that's what the bonding requirement should do. Certainly interested in hearing from industry about how they reflect on that. Because, again, our goal there is to sort of make a streamlined process to ensure that that Vermont recoups the costs that you have all chosen to place on businesses that aren't compliant within a timely manner. I have a couple thoughts on a couple specific notes I might make on the bill, but I wanted to pause and just see if there are questions, concerns, anything I can answer or James can answer around currently how things act, operate, where we see them go.

[Rep. Michael Marcotte (Chair)]: So

[Rep. Herb Olson (Member)]: when you talk about I think that's a great way to keep track of things. In terms of you talking about, I think, fee income, sports enforcement, is fee income sufficient to do periodic audits?

[Todd Daloz (Assistant Attorney General)]: I think we anticipate it will be. Okay. We also I think it'll depend on the scope of enforcement. I think if numbers I've seen, and I I am not the expert in this space, but I think we have somewhere in the four to 500 registered data brokers, and we anticipate it's like double that who should be registering. So there'll be a time creative ensuring that that expands and that that will take time and effort. We've looked at and just to respond kind of on the build back point, because I think that is a valuable avenue to look at. There is a tension around ensuring that there's enough work to build back for to justify hire. Right? If we don't know the scope of the work, we may have a body, but no means of funding the position. And so I think that'll take a little while. And maybe that's something we can we can look at in concert with the Secretary of State as they're studying this over the next couple of years. Yeah. Of course.

[Unidentified Committee Member (House Commerce & Economic Development)]: Talking about the phone call with the California privacy folks and potential of us coming alongside them. You used the expression, I believe it was federally, state by state. Now I for the clarification, you meant small f federally and thing in in the state path.

[Todd Daloz (Assistant Attorney General)]: It's a great question. In my head, it was a small f, so I appreciate you flying it. Meaning, a state by state solution as opposed to a federal. Yes. Clarification. Appreciate you.

[Rep. Michael Marcotte (Chair)]: I think we we need audits. We just auditing Vermont as we're looking, like, at California, where did how many do they have registered? The other states and then comparing a tire list because it's probably they probably are doing business in the month, really.

[Todd Daloz (Assistant Attorney General)]: I'm going let James correct me on this one. James, if you're there. It's so weird. But we have the audit at this point. There he is.

[Rep. Michael Marcotte (Chair)]: Thanks, James.

[Todd Daloz (Assistant Attorney General)]: So correct me if I'm wrong, James, but the audit at this point was really just a retrospective who was registered in Vermont in the past years. Are they still registered in Vermont? Let's reach out and see if they should be registered in Vermont. I think what you're suggesting, chair, is where where I think we see enforcement going, especially if the bill expands or or the law expands in the way the bill anticipates. Because that is where we're gonna sort of find the folks who either don't yet know that they should comply or have ignored compliance to date. James, anything you wanna

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: No. That that's that's correct. That's the way the auditing happened in the past. And and, yes, that idea going forward, we already have, we have some lists of what other date com data brokers have registered with other states that have not registered with Vermont, and that is it's a pretty long list, so we are in the process of reviewing it and reaching out to those companies and figuring out who else should be registered, who is not, and making sure they take what action they need to.

[Todd Daloz (Assistant Attorney General)]: And not to overstep here, but James, maybe if you could identify yourself for the record.

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: Oh, yes, sure. Sorry. James Lamo, assistant attorney general with the Consumer Protection Unit.

[Rep. Michael Marcotte (Chair)]: Thank you. Yeah. I think that's I think that's important. How how would you determine if those data brokers are have Vermont specific identifiers in their databases.

[Todd Daloz (Assistant Attorney General)]: We'll leave that on yeah. Go ahead, James.

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: Yeah. We will we send them subpoenas seeking information about what kind of data they collect. It's generally premise you know, explains to them, here's what the Vermont data broker registry law requires as of now. Here's who needs to register. Tell us about the activities you conduct. Tell us tell us if you engage in these activities that are clearly meeting the definition. And if you contend you're not a data broker under our law, explain to us. And sometimes we certainly hear from folks who say, no. We don't have any Vermonters data, or we don't engage in these certain types of activities, or we fall within one of the listed exceptions, something like that. But, yeah, there's not an easy way to do that beyond sending them a subpoena and asking them to give us, written responses, which they, which provide answers to help us figure out whether or not they should risk it or not.

[Rep. Michael Marcotte (Chair)]: Sounds like you're gonna be busy.

[Rep. Jonathan Cooper (Member)]: I'd like to hear more detail if possible, James, how long does that take and how much back and forth is there? And what is the do you ever disagree with the entity that you're contacting and how is that resolved?

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: Yes. So it it depends on the entity, of course. Know, sometimes you send a subpoena and you get a email back twenty minutes later saying, hey. Let me tell you why we don't qualify, or oops, we're gonna register right away. We're very sorry, and work that from there. And sometimes it takes longer. Sometimes we don't get an answer at all. And we, you know, add them to the pile of, okay, how do we figure out how to follow-up with this, you know, company that's in Oregon or something like that and try to get them to answer our subpoenas if they're ignoring us altogether. So there's not one answer one way that it works. But, yeah, generally, we rely on getting them to provide us a written statement of what they do and whether or not they engage in the activities listed. And if they are saying to us, we don't qualify as a data broker for the following reasons, and we don't agree with those reasons, we tell them that and we, you know, argue that. I know the the we had a resolution with that Todd was speaking about earlier, and the company contended that they did not qualify as a data broker. And we said, we don't agree with you, and here's why we don't agree with you. And they opted to pay the penalty and to sign an assurance of discontinuance promising to register going forward. Even if they, you know, still wanted to contend that they're not a data broker, they accepted our judgment. So, you know, of course, ultimately, if someone really insists they're not a data broker and we really think they are, we can sue them. That, of course, is time consuming and,

[Rep. Michael Marcotte (Chair)]: you know,

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: not the preferred solution, but we can definitely do that. And then they know that. So hopefully that encourages most folks to comply and be reasonable.

[Rep. Jonathan Cooper (Member)]: And it seems like it's no different really from any other industry where you take these actions.

[Rep. Michael Marcotte (Chair)]: Yep. Yep.

[Todd Daloz (Assistant Attorney General)]: Yeah. I mean, just to follow-up and highlight what you just said, Jonathan. I mean, that's completely that's the consumer course of action in across the title nine chapter 63 scope of business. I'll just jump ahead if there are no other questions. There are just a couple little edits, and I'm also happy to just speak with ledge counsel about them. The one that I thought was worth at least raising, especially with deputy secretary Hibbert on the line, if she's still here, is on page 30. This is section twenty four six 2446E enforcement, page 30, line 16. It has dual enforcement authority there. And I believe from the deputy secretary's testimony, they're comfortable with just the AG testifying. So if that's okay with the committee, we're comfortable with that change as well. I think some of the other edits are really about well, it it's very specific to the bond, but we would we would be interested in the section that talks about what a data broker what the penalties are ensuring that part of the penalties include if you give us a faulty bond. That's also a violation, not just if the information you've provided is inaccurate or untimely, but if if the assurance you've provided to the people of Vermont is also flawed. We would like that included as a penalizable, and that would require the process, James suggested.

[Rep. Michael Marcotte (Chair)]: I would imagine that they take out a surety bond that you're named as as the indemnifier. Right?

[Todd Daloz (Assistant Attorney General)]: Yeah. I mean, the the statute, as drafted, the bill says runs to the benefit of the state of Vermont. So that would include us. But it also allows whatever the damages are. I mean, for the most part, where it sits, it would really be and what we envision it. And and the idea is it's the administrative penalties, and it's to simplify that process so that we're not going through a litigation.

[Rep. Michael Marcotte (Chair)]: You'll be notified by a foreign company if the business fails to pay for I

[Todd Daloz (Assistant Attorney General)]: will have to check. We use this in another somewhat similar space. I'm not aware that we necessarily get notification of a bond no longer being valid, but we can check on that.

[Rep. Michael Marcotte (Chair)]: You can't give anything to that. In the law? Tell the bone company that they had some other product.

[Lauren Hibbard (Deputy Secretary of State)]: Oh, I'm just curious. I was going to ask whether or not you use this type of mechanism in other industries. I'm curious what other places.

[Todd Daloz (Assistant Attorney General)]: Yeah. I mean, it's interesting because, to me, it's a little archaic now, but also in the consumer protection space, charitable solicitations. So I don't know if we were talking about this actually offline yesterday, Rutland, but we used to get a lot of phone calls on landmines of organizations fundraising. And there's an industry that supports organizations to fundraise. And there are some, as with a lot of spaces, some less reputable actors in that space. And so Vermont, likely this committee passed a law years ago requiring certain information to be provided. And among the pieces of information was registration by the paid solicitors. So those companies that we're calling on behalf of fundraising on behalf of, they had to pay a they still do have to pay an annual registration fee. And then they pay per solicitation, not per phone call, but per campaign that they run. And with that is a $20,000 surety bond, right, to the state. So that's that was the space that we had looked at and said, okay, there's a registration requirement. There's a regular check-in. This simplifies sort of administrative enforcement. And that's that's where the idea sort of came from.

[Unidentified Committee Member (House Commerce & Economic Development)]: I'm going to open a can of worms. And so apologies in advance. Curious on the definition of data broker and how you should be informed by, and if you have any comments to that.

[Rep. Michael Marcotte (Chair)]: Yeah. Right there. We have looked at it,

[Todd Daloz (Assistant Attorney General)]: right, because this it changed. Am I right? There's a good deal of language struck.

[Unidentified Committee Member (House Commerce & Economic Development)]: And then at the end of page four and the top of page five, it clarifies that in a way that, to me, makes a lot of sense. And I'm curious from the enforcement perspective.

[Todd Daloz (Assistant Attorney General)]: Yeah. So we have and I don't know, James, if you've taken any more time. So I'll start. And if you've got anything to add, I think we were generally comfortable with the the shift in in definition. I think it's a more inclusive definition, which I think was was the goal. I don't know is and and again, James, I might look to you for this one. I don't know as we've thought about it from where we have not been able to enforce, but thought we should have been able to enforce. But I think that broadening of language in terms of shifting from I am working with x company for x for y service. That's not a data broker relationship. But if I'm gonna run out of letters, aren't I? Company a is purchasing that information, then that's they're they're in the data broker space. I don't know, James, if you've got further thoughts on that, you know, what really focuses on the direct relationship line.

[James Lamoille (Assistant Attorney General, Consumer Protection Unit)]: No. I I don't have any further thoughts. I I think it seems seems fine. It's it's not an issue that we've had a problem with so far.

[Unidentified Committee Member (House Commerce & Economic Development)]: For me, it's the last line in the definition. Still a data broker if you are selling information that you didn't gather directly from that first person interaction. And I think that's an important definition.

[Rep. Michael Marcotte (Chair)]: Other questions? Okay. Great. So if you could keep working with Rick and with Monique and same with David and Lauren, try to put some shape around this committee and then some more thoughts on yeah. Well, I guess, you know, interim reports, possibly just to let the committee know how things are going as we go down the road of trying to get this stood up. Okay, great. Thank you. Thank you. The other question we're working on is H two zero five, which is a non compete bill. So a question came up when the vice chair and I were meeting with chair Black from healthcare. And I know healthcare is looking to make sure that there are no non competes at all in the healthcare industry. One question that she had was traveling nurses that come into the state and were part of this compact, licensure compact. The company that hires them, not the Vermont company, it's but the company that they work for, has a non compete. They're not in Vermont. Does that follow does that does that contract that they have follow them here in Vermont and because they're licensed somewhere else that the option fee solution that we wanna put in does not follow, it doesn't apply to them.

[Lauren Hibbard (Deputy Secretary of State)]: So I have to preface this that I'm a little out over my skis because I'm not in traveling nurses contracts very frequently. Can I just ask a question about what the intent is? You you want the traveling nurse contract, which may or may not have a non compete to apply in Vermont if the nurses in Vermont or to not apply if the nurses?

[Rep. Michael Marcotte (Chair)]: Yeah. So it it it would not apply in Vermont. So that that piece prior to the contract would not apply in Vermont, because we have some travelers that come into Vermont that like like the hospital they're working at or wherever, and they wanna stay. So they get but the company that hires them may use that non compete clause to not allow them to do that.

[Lauren Hibbard (Deputy Secretary of State)]: Right, and as a state, we like nurses to come and stay here. I'll just say that for the record, we really like that. I will have to look into this a little bit, I would imagine that I'm likely not your best witness. And I'm sorry punt on this, but I would get the hospital association to come talk to you about this, because they are responsible for managing those contracts. And those contracts, there's a contract, obviously, with the individual nurse when they become hired an employment contract. But there's also a contract that that traveling nurse company has with our hospitals. And so I would I would just talk to them about the provisions in both of those contracts. And I'm sorry, I don't I would love to be able to answer your question a little bit better. But I don't think I'm the best person for the job, unfortunately.

[Rep. Michael Marcotte (Chair)]: That's fair. Okay.

[Lauren Hibbard (Deputy Secretary of State)]: But I'll tell you that we do get a substantial amount of nurses who do really love the culture of Vermont hospitals. We're fortunate that it is better than some of the other places in the nation. And we have seen anecdotally nurses who are on traveling contracts come and stay here. And so I'll just speak sort of, not that you've asked me this, but anything you can do to encourage that, I would really support.

[Rep. Michael Marcotte (Chair)]: Great. Thank you very much.

[Lauren Hibbard (Deputy Secretary of State)]: Thank you.

[Rep. Michael Marcotte (Chair)]: I think that's all we have on the subject. We'll look for another draft and we'll keep moving forward. Great. Thank you all.

[Lauren Hibbard (Deputy Secretary of State)]: Thank you.

[Rep. Michael Marcotte (Chair)]: So committee, we can go to lunch. Or downstairs in Room 10 at 01:00, you know, any help with dental and housing. And you can bring food and drink with you. Nice. If need to, like the queen likes to do. Okay. So we can go off live.