Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Afternoon, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Thursday, 02/19/1926 at 04:09 in the afternoon, so we're just back from the floor. And so now we will take a look, redraft of page six thirty nine, have committee discussion, and possibly vote. So we have Rick Siegel with us, our legislative counsel. If we're ready, we'll bring him through.

[Rick Siegel (Legislative Counsel)]: Good afternoon, I'm getting ready. I'm almost ready. So we have, and it should be on the webpage, draft 4.2 of H. Six thirty nine. This is the genetic data privacy bill. And there's a few things that have been changed from the last graph and I'll go over those changes. They are highlighted, but also just kind of wanna let you all know what the changes are. So any background needed for the bill are going to go straight to the changes, Mr. Chair.

[Michael Marcotte (Chair)]: I think just sort of the changes and we should have that committee discussion.

[Rick Siegel (Legislative Counsel)]: Opposed to sharing?

[Michael Marcotte (Chair)]: Yes. Opposed to sharing?

[Rick Siegel (Legislative Counsel)]: Okay. Graph So 4.2, the first change is on page 11 of

[Michael Marcotte (Chair)]: the bill.

[Rick Siegel (Legislative Counsel)]: Okay. So this is in subsection d. This is the data security and access portion of the bill. So this is where a direct to consumer genetic testing company shall do several things, implement, maintain security procedures, develop procedures that enable consumer to delete their data. None of that has changed. There is an addition. So we are looking at the leading language is a direct to consumer genetic testing company shall, and then down to subdivision C, upon a request from a consumer to delete the consumer's genetic data or to destroy the consumer's biological sample pursuant to this subdivision. Notify any third party, including service providers that have received the consumer's data or sample from the company to delete the consumer's data or destroy the consumer sample not later than thirty days after the consumer makes the request.

[Monique Priestley (Clerk)]: Okay. I just have a question on the or. Like, with the or, does it mean if they had data and the sample that they could destroy one or the other but not not have to do

[Michael Marcotte (Chair)]: both? So

[Rick Siegel (Legislative Counsel)]: I thought about that.

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: Yeah. Yeah. Okay. Okay. No. I thought

[Rick Siegel (Legislative Counsel)]: when I when I wrote that, and I had the same question. Oh, good. So I think the way it's written you don't want to say and because they may not have both.

[Monique Priestley (Clerk)]: Right, that's what was wondering

[Rick Siegel (Legislative Counsel)]: If it's or, you can't say and or, but the implication here is that you have both, you've got to delete both. If you have either, more likely either, you delete the one you have. This went through editing, so I don't know they didn't catch it, but we can have a discussion if you think that reads otherwise. Obviously, I also was concerned initially about that.

[Anthony "Tony" Micklus (Member)]: What if we do, like, a list, like, the week consumer data, consumer's data, story of the consumer data, or both?

[Michael Marcotte (Chair)]: Break it into a one, two, three.

[Rick Siegel (Legislative Counsel)]: So on line 19, they have received the consumer's data sample or both.

[Monique Priestley (Clerk)]: What if it's like delete the cons any like, the including the following. And then it's like a data or or or ants. I don't know. Yeah.

[Rick Siegel (Legislative Counsel)]: But it's just gonna be those two. Yeah. Yeah. Yeah. Yeah. It's those are the two things the consumer can it's their genetic data. It's their account and genetic data. I'm sorry. Delete there. I'm looking at I. Robinette, I I. It is delete the consumer's account and genetic data. And then three, request to have their biological sample destroyed. So it's not really a So I guess what I'm saying is I'll just have those one two. Okay. Now there's still gonna be a conjunction there. Right? Not really changing the wording. It's just gonna be it's just gonna look different. So think about that. So it's gonna say, they have received the consumer's data or sample from the company to delete the consumers to colon, delete the consumer's data, semicolon, destroy the consumer's sample, semicolon, or both? Is that how you think it should read?

[Monique Priestley (Clerk)]: I don't. I don't like to learn both.

[Rick Siegel (Legislative Counsel)]: This is my life, so you

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: I don't

[Rick Siegel (Legislative Counsel)]: like to learn both. This process works in real time. Yeah.

[Jonathan Cooper (Member)]: And I hate to do it in real time too. But as long as you have the parallel construction of, you know, to delete and or to destroy and somehow separate them Yeah. I think you're golden. However you wanna do that. Just the parallel construction to me works. To delete it, consumers' genetic data. Or to so the parallel

[Rick Siegel (Legislative Counsel)]: construction Right. You received either or, and then you delete the one you received. So if you see both of them, you delete both of them. I think it's fine.

[Monique Priestley (Clerk)]: Oh, I see what you're saying. See what you're saying.

[Rick Siegel (Legislative Counsel)]: Yeah. Yeah. But again, I No. See what you're saying now. To how you all think about the

[Monique Priestley (Clerk)]: No. Yeah. I think yeah. Get it now. I get it. I don't think we need

[Michael Marcotte (Chair)]: No. I think

[Monique Priestley (Clerk)]: For the first yeah.

[Michael Marcotte (Chair)]: K. So you yeah. Right at the top,

[Monique Priestley (Clerk)]: it's Yeah.

[Michael Marcotte (Chair)]: Consumers requesting to delete their genetic Or destroy. Or destroy it. Yep. So it's up still up to the whatever the consumer wants done. Consumer says, I want you to delete and destroy. And that's what they that's what the request that's what they have to notify the third party to do. Right.

[Rick Siegel (Legislative Counsel)]: Yeah. It could be both. And then Right. We will tell

[Michael Marcotte (Chair)]: them delete both. Okay. Alright.

[Rick Siegel (Legislative Counsel)]: Alright. So then the thirty days. Everything else in here is thirty days, so I kept it thirty days. And so this was added because there was a question as to the direct to consumer company perceives this request. The service provider does not. So they have contracts, or they may have disclosed that information to a third party. At that point, if they request to delete it, the consumer would think it's deleted. But this clause ensures that any third party service provider that has received that data must also delete it within thirty days. Next change starts at the bottom of page 12. This is Herb Olson's question from last time. The question was what happens similar? What happens if there's a contract between a genetic company and a service provider? And they must abide by the contract, but then the contract ends or terminates what happens to the consumer's data that was part of that contract. So language was added to address that issue. Upon the termination of a contract between a direct to consumer genetic testing company and a service provider, the service provider shall immediately destroy all genetic data that the service provider retained during their contractual period and not disclose, transfer, or sell genetic data to a third party before it destroys the genetic data pursuant to that subdivision. So I think it closes a potential loophole that you brought up that, yeah, their contract's over and they're no longer governed by this by this law, but this would ensure that they are still governed and that they have to delete the data. Okay, next change is on page 13 at the bottom. So I brought this up, I'm not sure last time or this time before, the idea that law enforcement, government entity basically sends a request to a genetic company to disclose certain genetic data because they have either a DNA sample or they're maybe fishing for something. I know that Ancestry says they don't do that. 23andMe, they have policies in place, but there are more than just those two companies. And it's not always clear, and they could change their policy. One day Ancestry could say, You know what? We don't really we now want to work with law enforcement. They can change their policy at any time. Okay, so subsection G adds in this new clause. So the leading language notwithstanding any other provision in the section, a direct to consumer genetic testing company shall not disclose no changes to subdivision one. And that's the help sending it to companies that make decisions based on health insurance, life insurance, Or any information about a consumer to a government entity including the consumer's genetic data or name, A, without a search warrant issued by a court on a finding of probable cause or unless the consumer whose information is sought provides express consent to to disclosure upon being notified by the direct consumer genetic testing company. So the idea is if the government entity has a legit search warrant which would name somebody, then that would be disclosed without the consumer's consent. The law enforcement would have that right. If there is no warrant, the genetic company would have to ask the consumer for their consent to disclose their information to law enforcement. So I think you want to address this. You may not like what this is, but I think you do want to address because the way the bill was written to me, it was unclear if a company gets a law enforcement warrant or request. The law says they shall not disclose without the consumer's consent. And to me, that's maybe a problem, especially if there's a warrant. Because is the company going to ignore a warrant? Or are they going to ignore Vermont law? So in this, you and other states have also addressed this. They clarified, this is what we mean, that law enforcement has its own little connection to this.

[Anthony "Tony" Micklus (Member)]: I'm just wondering about a situation where, say, somebody has a warrant for, like, let's take one of my kids, for example, and they want my genetic data because I'm related, would that warrant against my kid for example, nothing's ever done anything wrong, they're good kids, apply where they could take my genetic data without my permission.

[Rick Siegel (Legislative Counsel)]: So there would be a search warrant with your kid's name on it, and the search warrant would say, we need Tony Micklus' information because we believe that his son, daughter, whatever, is a suspect. If they had probable cause, then and if you get a judge to get a search warrant, then you would not have to consent to that. They can get that genetic data if there's a warrant. Otherwise, they'd have to email you or contact you, say, hey. We had this request. So they could even though my name's not on the warrant.

[Michael Marcotte (Chair)]: Correct. Gotcha. Okay. They can't go on the phishing expedition either. Yeah.

[Rick Siegel (Legislative Counsel)]: Because the warrant's gonna have a name on it. You can't get a warrant that says, we believe these 50 people could be suspects. No, it's

[Michael Marcotte (Chair)]: gotta be like I mean, they would have to know that you deposited your genetic sample with the ancestry or any other. They would have to know that. We're good with this language.

[Anthony "Tony" Micklus (Member)]: I don't care what I just

[Michael Marcotte (Chair)]: I knew what I was thinking.

[Rick Siegel (Legislative Counsel)]: So the last change is not in addition. It's a removal of the cure period. This keeps it within the Vermont Consumer Protection Act that allows the AG to enforce or a person to enforce if they so choose. So no cure period. That was a decision of the committee chair to not include that. So having me to discuss that to the committee too. Just it's a

[Michael Marcotte (Chair)]: bringing us back to the original place. The committee so wants to have a cure period. I think we had a lengthy discussion on that. Anybody?

[Anthony "Tony" Micklus (Member)]: I guess my concern is, I think we're, you know, I'll go back to let's look at scams where you see where you'll get a a letter from the FBI saying, send this money or the FBI is gonna arrest you, and creating sort of that fear and panic. And I can see this transitioning to a data privacy thing. Perhaps there's somebody who gave their genetic data, but forgot some stupid little website or something like that. These comp this this pocket industry, which is the one that I'm concerned about, comes along and says, well, we'll we'll see if anything's gone on. And then they put one of these these companies in a in a state of panic. Now, realize right now, we have lots of companies that We have very few companies, and those companies are big and mature. But the law of zero, this is going to become cheaper and cheaper and cheaper. And it's only a matter of time before you can, not necessarily literally, lick your cell phone, and they're going to be able to provide you with genetic data for May. When we start to have that situation, my concern is what, you know, without this cure period, all this panic, you know, they get a letter from an attorney, we're gonna sue you, but you know what, if you pay us $15,000, we'll straighten this all out. Now, I understand harm to the consumer. And what I would like to know is, a fifteen or thirty day period, how does this cause more harm to the consumer? If you can prove to if you can show me that the consumer is going to have a lot more trouble, is gonna be much more harmed, then I'm okay with getting rid of the cure period.

[Michael Marcotte (Chair)]: Trying understand your scenario. So, you're saying that somebody might have done this years ago, forgot about it, and then they don't, so who are they going after?

[Anthony "Tony" Micklus (Member)]: So, in my mind, part of the reason for a cure period is to stop the panic and for whatever company is being subpoenaed or whatever to say, Okay, hold on, let's validate this claim. And why does that cause so much more harm to the consumer? Are they going to be further hurt because we waited a few days so the person could substantiate the claim? As opposed to the other side of things, where now this genetic testing company has to grab people on the shortlist, paying them lots and lots of money to address this right now.

[Michael Marcotte (Chair)]: Let me Go ahead, Todd.

[Todd Daley]: For the record, Todd Daley.

[Michael Marcotte (Chair)]: Hey.

[Todd Daley]: If I understand the scenario, I think we walked through one last week or the week before, so I'll lay one out that I think might respond to your concern, though I don't know about how old. I didn't quite catch that part. So correct me if the scenario play out. So what could be seen as a technical violation? The terms of the privacy notice are insufficiently clear and conspicuous, or there's not sufficient expressed consent required before a transfer of data. Those are all things that if there were a cure period, somebody could say, hey, look, you didn't give me enough information. I need you to fix that because I gave consent when I didn't meet. Company says, and they correct it. That would seem to be pretty simple and straightforward, right? It doesn't require location. The challenge is if as a result of the lack of clarity in the privacy notice or a lack of sufficiently expressed consent gathered, the company then had transferred data, had taken another step that the consumer consented, but wasn't clear on for the law. The company can say, no, no, no, we had consent. Right? The transfer was lawful. You don't have to claim about this unlawful transfer because you said yes. And we've cured the problem. The challenge is the data's gone. That's where we run into difficulties with any kind of cure period on the specific details. Does that make sense? So it's like, yeah, it looks technical on its face, but the results were lawful. They had consent or the notice was there. The argument is they've now fixed the technical problem, but the reality is there's been this significant transfer of data. I'll say beyond all that from a policy level, what we said, I've said it before and it may not make a difference to you, but we don't have any other cure periods. And so this scenario of other companies, we just haven't seen that actually happen in the marketplace. I get I think, but I'm Graning brought this up. There were cases in Illinois when Illinois passed its law, but we heard from ancestry, they haven't even gotten claims of Wyoming to cure, let alone responding to cases or very few. I can't remember exactly what Richie said. But the point I took for it was, even with the cure period out there, they're not even getting those requests. So why have the cure period either? I don't think it's changing the litigation plans. I think there's a lot of concern after Illinois passed its BIPA with the volume of lawsuits. It's just not something we've seen in Vermont anywhere else in consumer law. I don't know it's been seen with the three companies that we think are most involved, who seem to be pretty good athletes.

[Rick Siegel (Legislative Counsel)]: I appreciate the explanation.

[Michael Marcotte (Chair)]: What else? Are we okay to not include? Is there anything else? Bridgette, is there anything from your client to say?

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: Chair, think Morris, more strategies on behalf of Ancestry. Nothing that we haven't already said to the committee, but I appreciate it. Certainly disagree with taking out the cure period. As I said before, could also argue that there have been no claims because there is a cure period in Wyoming. You argue the other side of that argument. But we appreciate your time on this and all of the time you've given Ritchie to testify as well.

[Michael Marcotte (Chair)]: Thank you. Committee, are we ready to vote this Board? Any more discussion? So I entertain a motion to report favorably on h six thirty nine draft number 4.2. Second. Moved by representative Carris Duncan. Is there any other discussion? Not, I can call it in.

[Monique Priestley (Clerk)]: Representative Bosch? Yes. Representative Bootin? Yes. Representative Carris Duncan? Yes. Representative Cooper? This doesn't have another Representative Duke? Yes. Representative Nicholas? No. Representative Olson? Yes. Representative Priestley? Yes. Representative White? Yes. Representative Gray? Yes. Representative Markup?

[Michael Marcotte (Chair)]: Yes. Let's hold it for a second.

[Rick Siegel (Legislative Counsel)]: So he he he voted today remotely? Yes. It's every day. So he has three day?

[Michael Marcotte (Chair)]: It's every day.

[Anthony "Tony" Micklus (Member)]: It's just three every day?

[Rick Siegel (Legislative Counsel)]: No. He has three days to vote remotely.

[Michael Marcotte (Chair)]: Gotcha. I'd love

[Rick Siegel (Legislative Counsel)]: He can do more Let me double check.

[Jonathan Cooper (Member)]: Alright. Let

[Rick Siegel (Legislative Counsel)]: me double check. Oh,

[Monique Priestley (Clerk)]: He said three day votes in within a day.

[Rick Siegel (Legislative Counsel)]: No. No. No. Three three calendar days to vote. So he

[Monique Priestley (Clerk)]: You're right.

[Rick Siegel (Legislative Counsel)]: If there were, like Yeah. 10 bills all today, he can vote all 10. But let me double check that.

[Michael Marcotte (Chair)]: Yeah. He's voted three times.

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: Different days?

[Michael Marcotte (Chair)]: Yeah.

[Monique Priestley (Clerk)]: But he today, been he voted to get of the days. Yeah. So he can continue to vote for anything. As many bills as we've got. Oh, my

[Michael Marcotte (Chair)]: god. It's it's per day, not per bill. Yeah. Right.

[Rick Siegel (Legislative Counsel)]: Is it which which resolution is it? That's what he thinks. Let me confirm, but I looked at that earlier because I thought this would be this would come up.

[Monique Priestley (Clerk)]: Can you even hear me?

[Rick Siegel (Legislative Counsel)]: Yeah. We can. Yeah. Now. Okay. Now, I

[Jonathan Cooper (Member)]: have no place to hide.

[Rick Siegel (Legislative Counsel)]: Okay. If you if you want him to vote,

[Michael Marcotte (Chair)]: that's that's like if if he if he so chooses, yeah.

[Jonathan Cooper (Member)]: I would vote yes for this bill if I'm being asked.

[Michael Marcotte (Chair)]: We will ask you in a second.

[Monique Priestley (Clerk)]: HR five.

[Rick Siegel (Legislative Counsel)]: Is HR five renewed for 2026?

[Michael Marcotte (Chair)]: Think so. So I'll show

[Rick Siegel (Legislative Counsel)]: you the I'll share my screen real quick so you can see what I see. So this is HR five. I'm wondering it's '20 through the calendar year 2025, I think it was extended.

[Michael Marcotte (Chair)]: We voted on it the

[Rick Siegel (Legislative Counsel)]: first day. Each member of the House committee is authorized to vote remotely not more than three days. Okay. So unless they changed it in 2026, which I don't know why they would do that.

[Michael Marcotte (Chair)]: Here we go. HR eleven. Yep.

[Rick Siegel (Legislative Counsel)]: Same? Yep. So through their calendar 2026, each member

[Michael Marcotte (Chair)]: of house committees on the votes for a week. We're not

[Rick Siegel (Legislative Counsel)]: working for days. So I based on my understanding, you can vote today. Representative Cooper?

[Michael Marcotte (Chair)]: Yes. Great.

[Jonathan Cooper (Member)]: I'll be I volunteer. Yeah. The silence was deaf, man. Very uncomfortable.

[Michael Marcotte (Chair)]: It's just your hearing.

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: Okay. Yeah. Well, I'll be in this little tattoo.

[Rick Siegel (Legislative Counsel)]: Okay.

[Michael Marcotte (Chair)]: So Herb can get Herb a clean coffee and I know they're waiting for it.

[Rick Siegel (Legislative Counsel)]: Okay. So here I'll email you a copy.

[Jonathan Cooper (Member)]: You send it to me and then I'll send it tonight.

[Bridget Morris (Morris Strategies, on behalf of Ancestry)]: Yep. Yeah. I'll send everything you have to send

[Michael Marcotte (Chair)]: to that. Don't don't wait though because they are waiting. I that you got it. I can. Okay. Perfect.

[Jonathan Cooper (Member)]: Okay, committee. And it it was ten 01:01.

[Michael Marcotte (Chair)]: K. So, committee, thank you. Thank you for sharing the live script. So tomorrow, 09:00, we're with our UVM interns and for the new hearing students, early college students. Page five ish, the book could be headed here by one ish. That we can go off live in the morning.

[Monique Priestley (Clerk)]: Great for lots