Vermont Legislature SmartTranscripts:

[Edye Graning (Vice Chair)]: Good afternoon. It is Tuesday, April 8. This is the House Commerce and Economic Development Committee, and we are here taking testimony on S-seventy one, an act relating to consumer data privacy and online surveillance. We're going to start our afternoon session with Bobby Leonard from A12 Vermont.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Good afternoon, everyone. Vice Chair and members of the committee, you for the opportunity to testify today. My name is Bobby Leonard, and I am the privacy compliance and privacy officer at AgeWell, which is one of Vermont's five area agencies on aging or AAAs. But I am testifying on behalf of the Vermont Aging Network Consortium or VANC and all five of our AAAs. VANC is a member nonprofit organization made up of Vermont's AAAs. The AAAs are designated under the Older Americans Act to serve older Vermonters, individuals with physical disabilities, and their caregivers in every region of our state. Together, we provide and coordinate essential community based services such as case management, care coordination, nutrition and meal programs, volunteer services, caregiver support, health insurance counseling and education, wellness activities, information assistance and referrals, and support with benefit applications. Each year, the AAAs collectively serve tens of thousands of Vermonters, many of whom have complex health, functional, and social needs. All five of the AAAs are HIPAA covered entities. We already operate under one of the most comprehensive privacy frameworks in federal law, and we protect client information accordingly. Much of the data that we collect must also be retained for several years in order to meet Medicaid requirements, federal and state grant conditions, audit standards, and program integrity obligations. My goal today is straightforward, to explain in practical terms how draft 2.3 would operate in a HIPAA regulated health and human services setting like ours, and what that would mean for our staff, clients, and caregivers. As HIPAA covered entities, the AAAs already operate under extensive enforceable federal privacy requirements that govern how client information is collected, used, disclosed, safeguarded, and retained. Those obligations include limiting the use and disclosure of protected health information to permitted purposes related to care and operations, implementing administrative, technical, and physical safeguards, providing clients with a notice of privacy practices, explaining how their information is used and what rights they have, responding to client requests for access and correction within established timeframes, training staff, and being subject to audits, enforcement actions, and penalties for noncompliance. Importantly, in practice, the AAAs do not draw sharp internal distinctions between PHI and other types of client information when it comes to privacy protections. HIPAA's definition of PHI is specific, but we apply HIPAA level confidentiality, security, and disclosure requirements to all client data because clients experience this information as a single record, and they expect it to be protected consistently. HIPAA is specifically designed for health and human services settings. It balances strong privacy protections with the need for continuity of care, service coordination, accountability, and program oversight. And draft 2.3 does not replace this framework. Instead, it layers a general consumer privacy statute on top of an environment where client data is already uniformly protected under HIPAA based practices, even when the data is not technically PHI. In practice, the AAAs do not document services in discrete data categories. We document people's lives as they are lived with health concerns, functional needs, social circumstances, and personal context, all intertwined. A single conversation with with a client may naturally include information about their health or their mobility, details about what help is needed to live safely day to day and in the community, social or household circumstances affecting the client's well-being, and personal preferences that shape how services should be delivered. Those elements are not separable during service delivery. They appear together in the same notes, the same conversations, and often the same sentences, because that is how effective person centered support works. From the client's perspective, this is all simply my record, the information that explains who they are, what they need, and how services are helping. From a caregiver's perspective, this information is a context that allows them to understand and support a loved one. And from a staff perspective, this information is the necessary context required to provide appropriate and effective services. Draft 2.3 evaluates records through a different lens. Once the law applies, it regulates personal data at the level of individual data elements, not at the level of the service record as a whole. That means that within a single AAA client note, some information may fall within an exemption, while other information created in the same interaction for the same client may remain fully regulated under draft 2.3. This record level fragmentation is not how AAA services are designed or delivered. Two examples show how these distinctions emerge in everyday AAA work and why they create staff burden and client confusion without improving privacy protection. Example one, a client contacts a AAA and says, I want a copy of everything you have about me, and I want some of it deleted. Today's staff know how to respond under HIPAA. The client is given timely access to their record and staff explained clearly and consistently why service records generally must be retained to support care coordination, Medicaid compliance, audits, and legal accountability. Under draft 2.3, the same request becomes more complicated. Any non exempt personal data in the client's file is now subject to a statutory deletion right, unless retention is required by law. This means staff must review records, prepare a written denial explaining why deletion cannot occur, and provide information about appeal rights. From the client's perspective, this is confusing. The law grants a deletion right that in practice often must be denied. Even when staff handle the request correctly, the experience feels inconsistent and frustrating, and it places staff in the position of explaining why different rules apply to what the client experiences as a single record. Second example, the case manager documents an ordinary interaction in a client's file. Client reports difficulty standing for more than ten minutes, needs transportation to clinic, prefers morning appointments, daughter is backup contact. This single sentence includes several types of information, health related observations, functional support needs, personal preferences, and caregiver contact information. Some of this information would qualify as protected health information under HIPAA, Other information such as preferences and caregiver context are personal data, but often not PHI. Under draft 2.3, staff must treat these data elements differently, even though they were created together in the same interaction for the same purpose. For compliance reasons, staff must be prepared to explain which parts of the client note are exempt and which are fully regulated under the consumer privacy statute. For the client, however, this distinction is invisible. They reasonably experience this as one unified service record. What was once straightforward documentation becomes legally and practically fragmented. If draft 2.3 becomes law, the AAA's experience will not be a dramatic change in how we protect client information. We already protect client data to HIPAA standards. The change will be the administrative burden and the client experience created by applying a second privacy framework to non PHI personal data embedded throughout ordinary service records. For the AAAs and our staff, the most immediate impacts will be first, time diverted away from services to compliance, increased staff time spent triaging requests, determining what is exempt versus covered, preparing written denials and managing appeals. Second, more hesitation in documentation and coordination. Staff would feel pressure to sanitize notes or limit contextual detail, reducing effectiveness of service delivery and care coordination. And third, increased reliance on legal counsel and compliance services. Limited nonprofit resources will be redirected to legal review, policy development, staff training, ongoing compliance support to manage new consumer privacy obligations, reducing resources otherwise available for client services. For clients and caregivers, the most immediate impacts will be first, confusion about rights. Clients will reasonably believe they have rights, especially deletion, that frequently must be denied due to legal retention requirements, creating frustration and mistrust. Second, fragmented explanations for a single record. Clients experience or file as my record, but will receive different answers depending on whether specific elements are PHI or non PHI personal data. And third, more appeals and complaints. Confusion and perceived inconsistency will lead to more follow-up requests, appeals, and complaints, making the client experience more adversarial and further consuming staff capacity. In short, draft 2.3 would impose a new layer of process on top of an already regulated environment, producing more friction, more confusion, and less staff time for client services without meaningfully improving privacy protections beyond what already exist under HIPAA based practices. For the reasons just described, bank and the AAAs respectfully urge the committee to advance S-seventy one as it was passed by the Senate without adopting draft 2.3. The Senate passed version of S-seventy one takes a clear, structurally sound approach that recognizes that HIPAA regulated entities already operate under comprehensive, enforceable privacy frameworks designed for health and human services settings by regulating at the entity level rather than attempting to govern individual data elements within client service records. The Cena version avoids the operational, client experience, and resource limitation problems described today. Thank you for your time. I'm happy to answer your questions.

[Edye Graning (Vice Chair)]: Questions?

[Monique Priestley (Clerk)]: Yeah, thank you so much, Bobby. I have a question. So definitely we understand that there's certain data when it comes to clients that are HIPAA treated at the same level that HIPAA protects them and that kind of stuff. I think generally something that was coming up when we did this testimony previous, when we were working on the previous iteration of the Privacy Bill, was getting into situations where we were talking about medical, HIPAA treated data, and then talking about all the spaces where entities that have a mix of different populations data is not all of that data is covered by HIPAA. And so for example, on your website, I'm seeing I got trackers for Google and Bing. So if somebody is going to your Medicaid services or your Medicaid counseling, your Meals on Wheels, that kind of stuff, that those tag managers and stuff are picking up kind of my browsing history on me looking for those services, going into profiling about me, building that case. There's also an email newsletter collection. There's a donation portal. It looks like an AI chatbot or at least a chatbot of some sort. There's people's names popping up every thirty seconds saying Bobby just donated. Bobby L just donated. Barbara M is now donating $120 heck refuel from Essex Junction, Vermont. So it's got the donor names and their locations. I'm just those are the types of things that I'm curious. Those are not I don't think any of those are HIPAA cover HIPAA doesn't cover those interactions, your donor database, your email newsletter, the tag manager, the chat bot. And I'm just my search, my browsing. So I'm curious, especially if all of those things are happening. One is collecting data on my browsing history. It's sharing other people's data with me. And I'm also just curious about how I'm assuming that you go through some kind of protocols for data classification and governance and protection and how you feel about you doing privacy for I couldn't really tell if you were just for age well or if it's all of the individual kind of nonprofits. Actually, that would be helpful. As far as we're looking at nonprofits and things, especially when they're dealing with a mix of all of these different areas. Then something like a data breach happens and the donor database gets leaked. Whether or not those I would love to hear, are you treating that donor database, which potentially, if it gets breached, could lead to distrust with your donors, that would be helpful as well along with the AI and features that are on the website.

[Herb Olson (Member)]: Sure, thank you for all those questions.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Treat, so we're under HIPAA, we're classified as what's called a non hybrid covered entity, meaning we treat protected health information no matter where it lives to the HIPAA standard. And the decision we've made is just to treat all client records that way. It's easier, clients expect it. So if a client asks for their record, we give them their whole record, even though under HIPAA, HIPAA says that they have access only to their PHI, but we have these of these uniform records. In terms of the rest of our operations, if PHI lives in those environments, then we still need to apply HIPAA to it, and we still do. So for example, we've gone through our website with our web developer to make sure that the tags are not placed on any sort of page on our site that might be more closely linked to health information. So the federal government has actually issued guidance around this so that healthcare organizations who want to comply with HIPAA need to be mindful of that. That doesn't mean we don't have other sorts of pages on our website that are collecting that information for their own kind of internal purposes, but we've been thoughtful in ensuring that anything that speaks to a healthcare program of ours or a condition, that we're removing those out. Our AI chatbot, we have a kind of disclaimer on there, you know, please do not share protected health information. This transaction may not be covered by HIPAA. So we do the best that we can within the resources that we have to ensure that we are finding protected health information wherever it lives in our environment, because that's our obligation under HIPAA, and we're protecting it accordingly. As far as stuff that isn't protected, health information that wouldn't be governed by HIPAA, we take the reasonable precautions that any agency and organization of our size should do, regardless of what the type of data is. So a donor database, we're going to ensure that we're using secure platforms and that we have policies and procedures in place and folks are being trained on ensuring that those services and those programs and those platforms are meeting the expectation of our donors for privacy and security.

[Monique Priestley (Clerk)]: Yeah, I guess a follow-up question, Bobby. I mean, sounds like from your answer, and thank you, I know I threw a lot at you, that you would already be in compliance with the privacy law. And so I I guess, a question I don't know if I heard explicitly wanting to be exempt. But I'm curious why there would be a request to be exempt if you're already in compliance.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: So what we're asking for is for S-seventy one as written and passed by the Senate, which would exempt us as a HIPAA regulated entity at the entity level. And our concern, specifically in the context of client records, is it creates a kind of a dual compliance framework. So we have to comply both with the Vermont's consumer privacy statute when it's passed, if we're not exempted, and continue to comply with HIPAA. And it's gonna create client confusion. If we get a request for a client record, we're going to release that record regardless, right? That's a client's right under HIPAA. But if somebody asks us to delete part of their record, we have to go into the record and determine, is this HIPAA PHI that they're asking us to delete? They don't have a right under HIPAA to do that typically. Or is this Vermont consumer privacy, non PHI, and then we have to treat that in compliance with draft 2.3 as written. So yes, we comply with robust privacy and security kind of practices, especially for an organization of our size already. Our concern is confusion and friction between us and clients as we're trying to navigate what is, in our opinion, a fairly unworkable situation. You have to apply two different standards to one record.

[Monique Priestley (Clerk)]: But it does sound like you have multiple populations of people browsing the websites that are being tracked interacting with a chatbot that isn't typical clients, and your clients you're serving, and your donor database in the very least of populations that you're so potentially there is room for multiple there are no privacy protections under HIPAA for your donors and your chatbot. The people who might be saying, I have an urgent matter with this specific thing about my health, and I need help ignoring the fact that there's the HIPAA disclaimer, and they're giving sensitive information that isn't covered. And so that there might be room for standards to protect that data that they're entering into the system.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: So if we are not exempted at the entity level and this law passes without that exemption, then yes, I'm following your logic and I agree with your assessment.

[Unidentified Committee Member A]: Cool. Thank you.

[Unidentified Committee Member B]: Yep. You're welcome. How many people how often do you get requests for deletion of data? You think if this bill passes, do you expect that number to increase?

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: So we don't get it all that often. It does come up from time to time, and I do expect it to increase once this bill passes or once a comprehensive privacy bill passes in Vermont that allows that, because then folks will start to think, Vermonters will start to recognize that they have, for good reason, a right to request record deletion, data deletion from businesses and organizations that have their data. So I would increase, I would expect the frequency to increase. If we can continue to operate under a HIPAA, sort of framework, we have a workflow for handling that. We're able to resolve that in a certain way. If we have to piece on consumer privacy and then make these kind of data by data, record by record distinctions, I think it'll lead to confusion and kind of unnecessary staff work and cost that would be better spent focusing on client services.

[Unidentified Committee Member B]: So you expect it to increase a little, a lot?

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: It's hard to say. I don't know.

[Herb Olson (Member)]: Okay. Yeah, thanks very much, Mr. Windham. So, I think I get what your issue is. I think it boils Tell me if I'm wrong. It boils down to you you're in a HIPAA environment, and you know what the rules are for protected health information, but you're concerned that some of the information you collect or whatever is not within that rubric. And so I guess I got two questions. So I'm looking at the types of information that you're concerned about on page two of your written testimony. And it struck me that that was the kind of information that would kind of be in a doctor's record when you go in for a primary care visit or something. And they're trying to, you know, they're trying to figure out what you're, where you're Mhmm. Condensed too, right? So I I'm wondering why that information isn't protected health information covered under HIPAA. And then the other question I had is that in the general obligation of controllers and I guess you're thinking that you'll be a controller, although I didn't quite catch that. But controllers have an obligation to collect only collect the process only what's necessary and proportionate to provide, say a particular service, like you provide a service requested by the individual, in this case, your patient. So I'm having trouble understanding how these provisions would disrupt your operations?

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Sure, thank you. So your first question, it's tough to say in the context of any one given note what is protected health information and what is not. So the definition of it under federal laws, it needs to speak to past, present, or future healthcare services, payment, condition, and so forth. It also pulls demographic information into that definition. We have notes, we have records, we have clients where the services we're providing may not necessarily narrowly fit that definition, but for all intents and purposes, we don't have to worry about that currently because we just apply the HIPAA standard to all of this anyways. So when a client asks for their whole record, they're getting stuff that is PHI, they're also getting stuff that is perhaps non PHI, because nobody has come in and said we need to regulate the non PHI differently. If draft 2.3 passes, we now need to be more explicit in drawing those boundaries when it's not always clear, and then treat the non PHI under a Vermont framework and the PHI under the federal government framework.

[Herb Olson (Member)]: Yeah, okay. I'll need to brush up on the definition of protected health information. What about the notion that folks are there's a limitation and I guess you're thinking you're gonna be a controller, I don't quite grasp that.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: So we are a controller because we collect information and use it and we're defining those purposes, right? So we're providing services to clients, we're collecting their information in the context of the provision of those services. So under your statute, your bill, we would be a controller. And then in terms of the data minimization, what HIPAA requires us to do is follow something called minimum necessary, meaning that we have to use, we have to collect, use, and disclose only the minimum necessary information for the legitimate purpose that we have to collect that. So we're not supposed to be collecting more than is necessary for the purpose. So if we're providing services to a client, we're collecting what is necessary to provide effective service. When we're using that information internally, same standard. And when we're disclosing it with few limitations, we're also only disclosing the minimum necessary. So it's not called data minimization in the HIPAA context, but it is HIPAA's kind of analogy to what this bill calls data minimization.

[Herb Olson (Member)]: Right, so you're concerned about that the standards aren't similar enough then? They're the same in general, but not close enough, guess.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: I wouldn't say that. I don't think I'm concerned about that so much as, again, when it comes to a client's experience with their records and they're making requests for their records and our staff are having to think about this, that distinction between PHI and non PHI, I think is important. And some additional context I will add is that New Jersey recently updated its privacy bill earlier this year. They do not exempt HIPAA regulated entities, but they exempted PHI, as 2.3 does. I think they found it was unworkable, and they updated it to include what previous versions of this bill have included in the past. I'm not sure if it was 01/2021 or 02/2008, but that kind of data treated like PHI, indistinguishable from PHI, intermingled with PHI. So I see that as something that resolves a lot of the concerns that I'm sharing, if that is more tenable, because it allows us again to just continue to provide the services that we're providing, collect the data that is important for us to offer those effective services and not need to get hung up in what is PHI and what is not PHI. I So would offer that as something to think about.

[Edye Graning (Vice Chair)]: Thanks very much. Yeah, that's incredibly helpful. Jonathan?

[Jonathan Cooper (Member)]: Think I'll go where I thought representative Wilson was going a little bit to that bullet point of more hesitation, documentation and coordination. Pressure to sanitize notes or limit contextual detail. That pressure will come from where?

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: That pressure comes from if we have to operate under two frameworks, we're training staff to these frameworks, we're helping them, we have to focus on what is PHI, what is not PHI, ask them to think about this in the context of the work that they're doing in a way that they don't already have to. Because again, we don't need to make that distinction.

[Jonathan Cooper (Member)]: I sort of thought it was just the terminology seemed a little, have giving us professional development, I guess, set of circumstances around new standards or enhanced standards. But the notion of pressure does

[Unidentified Committee Member A]: seem

[Jonathan Cooper (Member)]: to be externally applied by some entity. And is it just perhaps you were describing a regulatory context? Or do you think that employers or regulators would be, say, you should limit contextual detail. Seems like a significant That seems significant to me. And so I just wanted to

[Unidentified Committee Member C]: hear more

[Unidentified Committee Member B]: about where that's coming from.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Yeah, no, I'm implying any sort of extrinsic pressure or internal pressure. I'm thinking about this as a privacy officer who would be responsible for training folks on how to make these distinctions. And as someone who used to do the work and knows what it's like to document services like this, like the services that the AAAs provide, and asking them to think about how they document their services in a different way in order to comply with two different privacy frameworks.

[Jonathan Cooper (Member)]: Have a sense of what that time commitment might look like as a compliance officer. Are we looking at months of work? Are we looking at something that would add for any legal

[Herb Olson (Member)]: employee or just an employee?

[Jonathan Cooper (Member)]: A week of training, twelve hours. I'm just curious if you have a sense of the scale of what's being proposed.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Yeah, I think it's really more of an ongoing thing because again, it's gonna like we might need to think about how to set up our software system so that notes are being tagged as this has PHI, this does not have PHI, this has both. That's not necessarily an ideal way, again, to think about this stuff. It's disruptive to the kind of relationship that our staff and our volunteers have with our clients. So there would be ongoing training and compliance and kind of documentation implications to draft 2.3, again, with a narrow PHI exemption without exempting this other client data that, for all intents and purposes, is very similar, but may not meet the statutory or the regulatory definition of PHI. Any

[Susan Moll (Public Assets Institute)]: other questions?

[Edye Graning (Vice Chair)]: Thank you so much. We really appreciate your testimony today.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Thank you all. Have a good day. Chris?

[Chris D’Elia (President, Vermont Bankers Association)]: Good afternoon, madam vice chair for the record, Priscilla, president Vermont Bankers Association. Thank you for the opportunity to speak with you. We've reviewed the bill and we appreciate appreciate the extensions that are in there, I think specifically on pages twenty two and twenty three, which acknowledge the fact that we have a regulatory regime that we operate under today, both at state and federal level. I will just highlight, and I sent this to the life counsel, I think there's one wrong citation to the Bank Holding Company Act, it should be 12, not 18, on the bottom of page 23, and he acknowledged that, I'll get started with that, I just want to make sure you get the right citation in there. Other than that, we appreciate the exemptions, and I think I answered any questions you may have.

[Edye Graning (Vice Chair)]: Any questions for Chris? Thanks

[Unidentified Committee Member B]: so much.

[Susan Moll (Public Assets Institute)]: Jamie.

[Unidentified Committee Member B]: Good afternoon, Madam Chair, members of the committee. I'm Jamie Feen with Primer this afternoon on behalf of the American Property Casualty Insurance Association. APCIA is a national trade association of over a thousand companies all out of the PNC. Members include national, regional, and local companies collectively they write about a little over two thirds of the market in Vermont, PNC and also on behalf of State Farm, which is the nation's largest PNC carrier, also has significant market share in Vermont. I don't think I'll be quite as brief as the previous wishes, but I'll try.

[Jamie Feen (on behalf of APCIA)]: I'll ask you to stay in the same world of regulated entities and GLDA but let me say the outset you know that insurers treat protection of personal information very seriously both from the policyholder standpoint but also from you know a company standpoint making sure that their systems are adequate. No company wants to get into this subject to a breach and losing their information. If you ask a CEO what keeps him up at night it's this kind of issue that Doug has had. Secondly, I think alluding to what Mr. DeLuier said, insurance companies like financial institutions are heavily regulated by DFR and by extension a little bit with federal government. Let me just sort of share with you examples of where that is. Have GFR has promulgated a regulation called privacy of consumer financial and health information regulation most recently updated in 2023. This is our GLBA state regulation for insurance companies. The scope applies to all non public financial information applies to all non public health information and it's primarily related to procuring and processing and maintaining insurance which is really the bailiff that covered by insurers are doing. In that regulation are required notices to policyholders. This regulation applies not only to existing policyholders but to applicants. It applies to beneficiaries, it applies to individuals that are involved in processing claims. So it isn't just existing policyholders. Significantly, and you've heard me mention this before, this regulation requires insurance companies to affirmably obtain consent and opt in before he can share any of this protected information with a non appealing third party. That's a very very high standing, higher than the standard in the hours of the bill, not a standard that's employed or adopted by the very very vast majority of states nationwide. I ask you to remember that when you hear comparisons between states, the ones already at a certain level and you just really can't quite compare in terms of you know what that standard means. The default is the companies don't share information unless it's processing policies. Also in place was sort of a companion regulation titled safeguards standards for safeguarding customer information and that's also sort of a GLBA regulated type regulation but it addresses the company's software side making sure they're snuff. There's a separate regulation related to record retention and requirements that companies have to have to keep documents before they can be deleted And then just a few years ago, this committee and this legislature adopted the Vermont Insurance Data Security Law, which is another sort of state statute that addresses the protection and in this instance also requires insurers to have a plan in place for how to protect and how to respond whether there's a breach or some sort of lapse. That also has ongoing certification by the companies to the Vermont Department of DFR every year to say they're in compliance with this statute that we have passed. DFR is our primary regulator they investigate, they review rates forms, they have market conduct ability to even further investigate, they also have significant enforcement authority to make sure companies are complying with the laws and regulations subject to their provision. Which gets me all to the portion of the draft related to exemptions. We're pleased the draft recognizes these statutory and regulatory obligations placed on insurers and prohibitively contains those exemptions. The first as was previously mentioned is on page 23, line 15 which is a data level exemption for GLBA. I will note that the wording here is a little bit different than what we've seen in other states including Connecticut. So, we appreciate the ability to take a little bit closer look at that. The other exemptions on page 24 line one that exempts that insurers and others that are directly regulated. And again this will collectively this will avoid regulatory regimes, will avoid two systems that insurers will have to create and comply with. It will avoid potential customer confusion and potential conflict. I use as an example that opt in requirement you know the notices that we signed to policyholders will reaffirm that opt and if there's a need to obtain it there's a separate form that the insurer has to then acknowledge. The bill outside of this contemplates notices without so then a policyholder could say hey wait a minute you told me you're not going to share my information unless I give you my consent you know the area telling me you're gonna share it unless I opt out of that information. So that's one kind of minor but important example of potential for consumer conflict and confusion. I think I'll just follow my lead for Mr. Julian, maybe wrap up there and see if you might have any questions. Appreciate the thought you've put into these exemptions recognizing breadth of regulatory oversight, statutory oversight, things and puts on insurers the appropriate practices. Happy to continue to work with you as we do the language closer.

[Susan Moll (Public Assets Institute)]: Any questions?

[Monique Priestley (Clerk)]: I just want to Jamie and Chris also, and for the committee, a lot of the work on the exemptions for this came after you guys really sharing how things worked. We did a chart with Maria Royal to really go through state and federal exemptions to make sure there weren't any loopholes and that kind of stuff that we were trying to make sure we're protected. And if anybody in the committee wants to see that chart that we did a couple of years ago, we still have that. But in general, those exemptions came from you guys sharing how that of wallet works. So I just want to appreciate that.

[Herb Olson (Member)]: Yeah, so thanks. Subdivision 16 exempts not only insurance companies, but PPAs and various kinds companies. And that marked out with something that you're familiar with. I'm not sure about the age.

[Unidentified Committee Member B]: Which starts with conditions? 24. 24?

[Herb Olson (Member)]: Yeah. So it exempts TPAs because they're under a third party administrative rule. I frankly, you know, so I'm willing to save a little time. I'm wondering if that rule is congruent with your obligation, the insurance company's obligations

[Unidentified Committee Member B]: Yeah, I haven't looked at that. That's right. Pretty little Olson. Honestly, I was focusing on the one prior to that. Yeah, sure. I can tell you, as we stated before, that the protections in place under the GLB regulations and in place under this statutory insurance security law that I referenced extend to tenders that insurers will So to the extent that these TPAs are supposed to handling whatever on behalf of an insurance company, those protections fall in the future. Okay, thanks. Any questions for Jamie? Eric?

[Unidentified Committee Member C]: Good afternoon.

[Eric Knoll (Center for Democracy & Technology)]: Hello. Good afternoon. Thank you for having me. Yes. Thank you very much for the invitation to speak remotely today as you're thinking through how to protect Vermonter's privacy. I commend your efforts at trying to protect privacy over the past several years. I know it has not been easy and having been part of these conversations at both the federal and many state level. Yes, it's very, very hard to strike the right balance. My name is Eric Knoll. I am the director of the privacy and data program at the Center for Democracy and Technology, a thirty year old nonpartisan nonprofit organization based in Washington, DC. And we focus on protecting individual rights, civil rights, and civil liberties in the digital age. While I may have spent most of my legal career in DC, I'm actually a born and raised Vermonter. I grew up in Williston. I did most of my schooling in Vermont, including graduating from the University of Vermont. One thing I learned during that time is that Vermonters really value their privacy, and it's probably not a huge surprise that I adopted that value as my own and grew up to fight for for a consumer's right to privacy as well. My experience is that Vermonters like to keep to themselves. Much of the state is rural where neighbors are few and far between. People prefer to live on mountains and dirt roads instead of in cities like Boston and New York. There's an ethos of privacy in the Green Mountain State built into the fabric of everyday life. I remember when I first got internet access back in the early aughts, I used a fake name. That name was Eric Neal, which, no, I did not strain many brain cells coming up with that one. But, but while the vast world of the internet was cool and exciting, my family knew that there were risks and unknowns, and we, took actions to protect ourselves. Almost thirty years later, we basically have the same expectations for individuals to protect their privacy online, but the scale of the Internet today makes that basically impossible. The Internet is orders of magnitude larger than thirty years ago, and the tsunami of privacy related information coming at people is overwhelming. It would be quite fitting as a result for Vermont to be a national leader on privacy protections by passing a strong strong comprehensive privacy law. Our goal for the Internet should be for people to be able to go online, purchase the goods they want, access the services they want, talk to their friends and family, engage in research, educate themselves, and generally use everything the Internet has to offer without worrying about the vast over collection and use of data about them from every corner of the Internet. People should be able to trust that those online services are collecting only the data needed to provide the service, which then would reduce the potential harms they would experience from, for example, the sale of that data in the vast data brokerage market or from inevitable data breaches or from the misuse of sensitive data. Basically, we need to stop making protecting privacy a purely individual problem. Unfortunately, what we have now is the opposite. Today, most state comprehensive privacy laws have largely followed the federal approach, the failed notice and consent model by merely requiring companies to disclose the per the purposes for processing data, and consumers either have to accept those privacy policies or not. Rather than place affirmative obligations on online companies, these states continue to bless the industry practices that got us into the privacy mess of today. This regime is based on the fiction that an individual somehow could sense to any and all data processing so long as as it's buried somewhere in a dense legalistic privacy policy. We know that people don't read those privacy policies. We know they don't view them as particularly effective or useful, and we know that if they did try to read those policies, it would take them hundreds of years or hundreds of hours per year. As a result, people have a sense of futility and feel a lack of control over privacy risks and often underestimate the risks of disclosing data. Because of the notice and consent approach, Vermonters and consumers everywhere are bombarded with all kinds of so called choice architecture built into the Internet. Cookie consent pop ups, opt out pop ups, lengthy privacy policies in terms of service agreements, and toggles for various unexplained or complicated privacy practices. Worse, notice and choice is even less effective than we might think at protecting Vermonters given the emergence of dark patterns which nudge people into sharing more data about themselves than they otherwise might. Many companies employ these dark patterns. I'm sure you've seen the highlighted accept all button on a cookie consent pop up, or you may have been nagged over and over again by a company to share your data with them. So even well meeting and well informed Vermonters may be tricked or goaded into sharing more data than they'd otherwise want. Vermont shouldn't follow suit. Such a permissive law would be a rotten deal for Vermonters whose lives have moved more and more online. In a state that values its privacy, companies have essentially a permanent seat inside everyone's home and smartphone collecting all information about those Vermonters to be used for a variety of purposes beyond simply providing the service, everything from fraud detection and product development to targeting intrusive behavioral ads and increasingly training of AI systems. Artificial intelligence is the new frontier in privacy policy, presenting many privacy issues like the mass repurposing of data collected for a different purpose and now being used for AI training, and the sensitivity and depth of data collected via AI prompts. It also presents civil rights issues as we know that AI systems can discriminate based on protected classes. AI is yet another example of why Vermont should refuse to let companies continue setting their own rules. If companies must only disclose their practices to Vermonters, then they can just add, quote, we collect and process data to train AI, end quote, to their policy, creating essentially a blank check to collect and retain indefinitely any data they want as that data can always be fed into an AI training dataset. A law purporting to protect privacy should not have such an easy workaround, and I encourage you all to continue considering that and other AI protections like anti discrimination provisions. It's time to right those wrongs, and I think you all can do that for Vermonters by refusing to maintain the status quo. Should place the privacy burden on the companies that benefit most from the collection and exploitation of that data, meaning it should be the company's responsibility to justify that data processing. To accomplish that, legislation should require companies to collect, use, and disclose data only to the extent needed to provide the service that's requested by the individual. And this is the real data minimization standard as has been adopted in Maryland and has been proposed throughout the country and at the federal level and is in today's bill. Contrary to their claims, companies can still create effective advertising systems with less data. Companies don't need behavioral data from years ago to target useful ads. They don't need your precise geolocation within feet to serve you a relevant restaurant ad in your town or city. In fact, behavioral data in general is a pretty poor proxy for inch for interest in products as we all use the Internet for a wide variety of reasons, not just to signal our interest in being sold something or interest in buying something. A regime that allows for higher quality data and less data processing overall would be better for companies and Vermonters. And I'd be remiss to say if I if I didn't add that privacy laws are only as strong as their enforcement, and the and they should be enforced through multiple channels. Companies don't comply with laws they don't think will be enforced, much like drivers violate speed limits when they don't think there are police ahead to pull them over or or a a speed camera. The Vermont AG should have rulemaking authority and civil penalty authority plus additional funding, and individuals should have a private right of action. Physical and economic harm have long been recognized as cognizable privacy harms for individuals. So private right of action that covers at least actual damages and injunctive relief should be table stakes and should be palatable to industry. With reasonable limits in place, Vermonters may finally be able to realize the dream of enjoying the fruits of the Internet without worrying about their privacy because they'll know that there are strong laws protecting their data. If you were hoping that the United States Congress would solve this problem for you, I would not hold your breath. Last week, House Energy and Commerce Republicans ignored years of bipartisan negotiations and introduced a partisan bill that would be a major step back for privacy protections while simultaneously present preempting state laws that are stronger and some that are much stronger. That's a nonstarter for those of us who advocate on behalf of consumers. Thank you again for inviting me to testify, and I look forward to answering any of your questions.

[Unidentified Committee Member C]: Thank you, Eric. Any questions for Eric?

[Herb Olson (Member)]: Herb? Yeah. Thanks very much. So if you weren't looking at, you know, a possibility of private right of action, you know, set that aside for the moment. What's your sense of whether the attorney general's office in a small site like Vermont would have the resources necessary to deal with a violation of law by, say, a company of the size of Google or Meta or Amazon?

[Eric Knoll (Center for Democracy & Technology)]: Yeah, I mean, that question applies to almost any state given the size of these companies that we're talking about. I think the focus should be on making sure that Vermonters privacy is protected. And so making sure that whenever companies are collecting the data about Vermonters that those companies are complying with the law. And that's why having injunctive relief is really important. Having having statutory damages is helpful to incentivize the enforcement of a privacy law like this, but the what we want is the companies to to comply with the law. So assuming that your AG has the authority to tell these companies to stop doing X, Y, and Z with the data about Vermonters, then it's much more likely that these companies will actually comply with the law. I completely understand the concern about the size and the litigation department of these companies is significant. And I know Katrina and others mentioned this morning about the consortium of states coming together, which I think is useful. But yeah, mean, I think it's an issue that all states confront. I think you just have to do your best to make sure that your constituents are covered and making sure that the companies are complying with the law as it relates to Vermonters.

[Herb Olson (Member)]: Yeah, just to follow-up. So, yeah, I get it. If the AG has determined that some company has violated the law, they can, you know, proceed in court. My question also, though, is sometimes takes a lot of investigation and analysis before you file something in court in order to vindicate that right. And I'm wondering whether you think the current setup without some sort of exam authority is sufficient.

[Eric Knoll (Center for Democracy & Technology)]: Some sort of what authority? Sorry.

[Herb Olson (Member)]: Examination authority. Some regulatory agencies have the ability to deal with the entities regulated by them and be able have the resources to do that investigation or counting whatever?

[Eric Knoll (Center for Democracy & Technology)]: Sure. I mean, certainly any amount of resources that can be invested in privacy enforcement, I think is vital. We can look, I mean, look at Texas. In my view, Texas's privacy law is not very strong, but they were seated with $5,000,000 for that office and have been able to turn that into billion dollar settlements with giant companies. And so it's been paying for itself over and over again. So I definitely would support something like that. And then of course you look at California which stood up its own privacy protection agency. And I think that has allowed them to not only just enforce with more vigor, but also sort of set some rules from the road for the road. You know, CCPA included some rulemaking authority. It allowed the agencies to do more sort of ex ante rather than ex post authority. And generally we like ex ante because it means companies comply with the law. They don't have to be told after the fact that they did something wrong. So I think either approach there is super helpful and would move the needle significantly.

[Unidentified Committee Member C]: Thank you.

[Edye Graning (Vice Chair)]: Edye? Thank you, Eric. Something that you said earlier in your testimony, I guess I'm not sure I heard it right, and I wanted to make sure that I did. You said that S-seventy one, as it came over from the Senate, would allow businesses to say, collecting data for an AI learning model and collect whatever data they wanted. Did I hear you right?

[Eric Knoll (Center for Democracy & Technology)]: So that is in reference to the most of the state laws that exist in states because the requirement is companies have to disclose the purposes for which they collect data. So if that's all a company has to do to justify data collection, then they can just say that they collect data for AI training and that's the end of the inquiry.

[Edye Graning (Vice Chair)]: Whether it's the main part of their business or not, They just have to disclose it. Okay. So we need to look and see if that's what S-seventy one does or if S-seventy. So as it came over from the Senate, it's a little bit I just That's what I was trying to understand.

[Eric Knoll (Center for Democracy & Technology)]: Sure. I think the version that is being reviewed today does not have that specific language in it. I was mostly just comparing it to what exists in other states now. The language in the bill now I think would be helpful because you are particularly for sensitive data, it's limiting it to what's strictly necessary to provide a service. But that is also somewhat of a movable line. And I suspect a lot of AI companies will will be able to sort of meander around that lines. And that's encouraged why you all to continue thinking about other protections for AI beyond just privacy, which I view as a necessary but not a sufficient protection for AI harms.

[Edye Graning (Vice Chair)]: We know we will always be playing catch up. We just hope to be able to be closer than miles behind.

[Eric Knoll (Center for Democracy & Technology)]: For sure. I hope that for you too.

[Unidentified Committee Member B]: Thank you. Other questions? Ready?

[Monique Priestley (Clerk)]: Thanks, Eric. I'm just curious if you could speak a little bit, and we had this a little bit with Senator Maroney this morning, but the you are you know, CDT in general is is all over the country in different states operating, and then also looking at the federal and and is is seeing the landscape of kind of like strong consumer protection bills and also like more industry favored bills and the mix and the interplay of all of those in the different states at all times. And so I'm curious if you can something Senator Moroney was talking about this morning was that if we are being told, for instance, to copy his work from 2023, and he's since updated it in 2025, and in 2026, he updated it to match actually a definition that we had. And that kind of interplay of states are never these bills are never a static thing. They're always being evolved. They're always interplaying off of each other. The amount of different pressure in different industries and all of the different makeup is also different in every state. And I'm just wondering if you could speak to that a little bit.

[Eric Knoll (Center for Democracy & Technology)]: Yeah. I mean, obviously, much like many issues, privacy is an evolving issue. We learn about new harms, new use cases, new you know, AI is obviously the most recent big use case that we're all trying to get our heads around. And so trying to harmonize as industry representatives often say, harmonize the state privacy laws to something that passed four or five, six years ago in other states, I think is missing an opportunity to actually go above and beyond what we were what a lot of states were thinking back then and say, okay, we see these new issues that are not addressed. We wanna address them in our law. You can also look to other states and see what's falling through the gaps. I think if you ask people in other states, do they actually feel like their data is more protected now that privacy that a privacy law has passed? I suspect the answer might be no or at least not as much as they would have thought because those laws don't really change that much. They basically just continue to put the obligation on on the user. And the the effect of at at the federal level of the states continuing to pass the same laws, then, of course, at the federal level, say, oh, let's just pass what the states have passed, fully preempt everything, and move on. And that's sort of what the house republicans did last week with their secure data act, which was take a bill that doesn't actually do much for privacy, preempt everything else, including Maryland's law that actually might do something for privacy. And then just sort of calls it a day and claims the issue has been addressed. But I don't think that's the case. And I don't think that's how we should be approaching privacy.

[Susan Moll (Public Assets Institute)]: Thanks, sir.

[Unidentified Committee Member B]: Questions?

[Unidentified Committee Member C]: Okay. Eric, thank you very much.

[Eric Knoll (Center for Democracy & Technology)]: Thank you all very much. Take care.

[Unidentified Committee Member B]: And? Good afternoon.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Hello. Hi everybody. Thank you for inviting me to come speak with you today. Can everyone hear and see me okay?

[Unidentified Committee Member C]: Yes, we can.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Okay, terrific. And I think that I will be sharing my screen. So if Jonathan can pass that control over to me, that would be terrific.

[Monique Priestley (Clerk)]: And Ann, might preface this presentation as because the committee was struggling with the difference between de identified and pseudonymous data. Ann is an expert, as she was saying, in de identified data, so that's what's next. It's a different tick than what we've just been hearing. I just want to Before Anne goes into I've gone to de identified rabbit hole with Anne, so I just want to make sure to preface this.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: No, appreciate that. And I was frankly asked at the last minute to appear and the reason that I was attempted was because I was invited to speak up on educational basis about de identification and pseudonymization. And those are among my very favorite topics. So I plan to be mostly a neutral explainer with a little bit of editorializing thrown in, and I will let you know when I'm editorializing. So if I'm not doing that, then I'm really just trying to help educate you guys in an area of the law that I have practiced in for a very long time. While that's getting set up, I'll add that I've been a privacy attorney for at least twenty five years and working specifically with de identification for most of that time somewhat amazingly. I was a Chief Privacy Officer in two global companies along the way and have had my own practice for quite some time where I have honed in on de identification in particular. I'm currently a senior fellow at the Future Privacy Forum and my comments and viewpoints will be entirely my own, not reflective of any organization I participate in. Do we have the are you ready to have me share my screen?

[Monique Priestley (Clerk)]: Yes. Yep.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Terrific. Okay. Is it up now?

[Herb Olson (Member)]: Yes.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Terrific. Okay. So, I have already made my lawyerly disclaimer and I will add that what I will be talking about today are these five topics, De identification under HIPAA and under state laws, since I know that you had interest in that area. Harmonization of de identification standards under state privacy laws. Pseudonymization and then the concept of banning the re identification of de identified data. Your bill that you're considering today, like most state laws, almost all of the state privacy, comprehensive privacy and consumer health laws lean pretty heavily on HIPAA de identification. So I think it's valuable for you to have some familiarity with how HIPAA de identification works. This particular diagram is right out of the HHS website and the important thing to know is that it is there are two methods and exactly methods only for de identifying data under HIPAA. If I were to bump into someone who told me that they did HIPAA de identification and I asked if they use one of which of these methods they use, expert determination or safe harbor, and say, oh, I don't use either one. We have a homegrown methodology. I would be inclined to say you actually have a legal problem, because HIPAA is very clear that you must use one of these two methods. And they are both laid out quite a bit in both the regulation and then in a lot of attendant literature, as well as HHS guidance. So, let's start with the HIPAA Safe Harbor method and I apologize for the little tiny type, But that actually tells a story in itself in terms of how much data has to be removed. This is essentially intuitive. If you had a list of 100 people and their names and addresses and they were all coming to an event and you wanted to quote de identify or anonymize that list to give it to someone, it would stand to reason that you would take out what we think of as PII, personally identifiable information. You would take out names and email addresses and phone numbers and other things like that that we call direct identifiers. There is a close to one to one correspondence between my phone number and myself. So those kinds of elements have to be removed of course under the safe harbor method. But what's interesting is, again, the fine print here, the length of this list, it is fairly extensive even though this is an old law and the world has changed a lot since then. Most importantly, I highlighted things that I thought were not necessarily intuitive that you folks would want to be aware of. Most importantly, I think from a perspective of understanding how strict the safe harbor method is, is up there under B and C. All geographic, subdivisions related to an individual that are smaller than a state or in most cases a zip three, must be removed. So if I simply say I'm thinking of a cancer patient in Chicago, I have flunked the safe harbor method because you are not allowed to identify the city. No geography smaller than a state or a zip three and even the zip three has some particularized conditions attached to it. The second aspect that is particularly challenging for research and science is that all elements of dates, except for year, must be removed when related to an individual. So think about the breadth of that date of birth. Yes, we can see that that is frequently used as a quasi identifier or indirect identifier. We have to spit it out at every doctor's office of course. But going beyond date of birth, date of treatment, date of surgery, date you took a medication, date the dosage of a medication was changed, date of adverse effect, date of hospitalization, date of discharge, date of death, You can begin to see how if you take out all of those dates, it's very difficult to do science to find patterns and correlations and look for meaning within the data. This is one of the reasons that researchers have been very troubled by the HIPAA Safe Harbor method since it was first being developed in the 1990s before it took effect in 2003. I also want you to note since you folks are thinking very much about technology that even though this was written quite a while ago, there are some tech elements that must be removed. Device identifiers, serial numbers. It's fairly easy to understand why that is identifiable. Actually all of these are if you understand the science of de identification enough. But do note that URLs, IP addresses, biometric identifiers must be removed as well as an overall catch all at the end, any other unique identifying number, characteristic, or code. So you will sometimes hear it said in public policy circles, oh, de identification doesn't mean anything. It's easy to defeat. I want you to remember, this slide as well as some other things when you realize how stringent HIPAA de identification actually is even under this safe harbor method. Moving on to the second method. This is also very important. Both methods are in use. Both methods are important. Back to the safe harbor. One of the advantages of the safe harbor method is that this is something that can be operationalized at scale fairly readily. You can build software programs to take out all of these elements and the biggest challenge will be that final one, the catch all, as well as something that I see I failed to put on the slide about how you can't have actual knowledge that an individual can be identified. But moving on to the expert determination method, this is also used on a very large scale in the realm of medical and research data. This is unique to the HIPAA standard other than most of the state laws now reference it. But to my knowledge, it's not found elsewhere in the world. It is a foundational standard in terms of allowing data to have privacy protections built into it while having a more flexible standard of allowing the data to be made useful for particular purposes. So let's unpack it. I highlighted the things to note. Under the expert determination method, the first thing you must have is an expert. You need a real human being unless you believe that's a corporate person. But in any case, the law says that it has to be a person and that person has to have appropriate knowledge and experience with not just statistics in general, but a very specific form of statistics which is statistical disclosure science generally accepted statistical and scientific principles and methods for de identifying data. And that individual or company must apply those generally accepted principles to a data set and conduct analytics on it. That is usually in my experience a very rigorous process. And at the end of their analysis, they must determine that the risk is very small, which is a term of art in the law. That the information could be used and then pause there because that's where the HIPAA expert determination method introduces context. And most of the literature says that context is quite important. In fact, common sense would say that context is very important in determining the re identification risk. So the expert determination method has the expert look at whether the data can be used alone or in combination with other information that could be readily available by an anticipated recipient to identify someone. So if you look at those words, you see the inherent flexibility that is built in as well as the capacity for this standard to be constantly updated as more and more data becomes reasonably available in this world, which is obviously growing exponentially. The expert also has to document the methods and results of the analysis. I want to point out that we have another speaker who I believe has joined the call. He will be available for Q and A if you would like. His name is Doctor. Colin Moffett and he is joining us all the way from The UK. He is an expert in HIPAA de identification that I've had the pleasure of working with, has extensive experience in statistical and data analysis and he is exactly the kind of person that this regulation was contemplating. Someone who is deeply experienced in exactly this realm of statistics. He's also a fellow of the Royal Statistical Society, and we're grateful that he's over here at about 07:00 in the evening his time. So he'll be available if you ask technical questions that a mere lawyer cannot handle. But let me move on because I want to make sure we dig into the state laws that you're thinking lot about. Most state laws now with only two exceptions, state and by state laws, I mean state comprehensive privacy and or consumer health privacy laws have two tiers of de identification. For medical data, and I'm using the term medical data as a shorthand because each law defines the scope of the medical data that to which this applies a little differently unfortunately. But for lay purposes, just think of it as medical data, the states with two exceptions do now harmonize with the HIPAA de identification standard. So that means everything I just said about safe harbor and expert determination is recognized by those state laws if you are in the realm of medical data. But for all other data including consumer health data, smart watch data no matter how medical, would be in the second bucket. The states apply their own state specific de identification standard. And I will just emphasize that again because it is so foundational here to understand that under the state laws that we have today, we already have two standards per state and different perimeters of the bucket to which the different standards apply. So you begin to see the intense complexity of the environment that we already have under state law in The U. S. With regard to de identification. And all of this particular complexity just arose in the last eight years. I put in small print there for you to look at later an example of the de identification definition that is state specific to Connecticut. This is fairly standard language for many states as well as the state specific language from Iowa, which is language like that is also used in a number of states. You can imagine if you are a national entity, let alone an international entity, The challenge is when you try to make sure that data is de identified under many, many standards just within The United States. Which leads to now a point where I am going to be editorializing for a moment. It's subject very dear to my heart, which is trying to get these de identification standards more harmonized. The HIPAA de identification standard itself, as you can tell, I'm quite a fan of. I've been studying it a very long time and it's really deeply embedded in the entire health data ecosystem. It's essential for medical research. But when California enacted its groundbreaking privacy law, the CCPA, in 2018, it initially did not recognize HIPAA de identification. So California created its own state specific definition of DID and it applied it to all data. Well, clearly that raised concerns with the lack of harmonization with HIPAA, with the amount of disruption that was likely to occur. The California legislature listened to those concerns and in 2020 they amended the CCPA so that HIPAA de identification is recognized in California law, but only for this pot of medical data, which again is a very precise term. In California they use the term patient information. So I'm saying this just for brevity here, but big picture in California and then in most other states that enacted their privacy laws later, this is where the two tier system was born. The HIPAA DID standard applies for medical data. The California specific DID standard applies to everything else. The Association of Clinical Research Organizations testified in California in 2020, with using a sentence that is still quite relevant to the laws being considered today, which is that de identification, I'll paraphrase, is the single most effective method for protecting the confidentiality of health data while facilitating its use for research. And just to underscore that for a second, it actually again is intuitive. There is nothing more protective of data than completely de identifying it so that it cannot be re identified without enormous difficulty and low probability. But by de identifying data properly, you do enable its use for research and for valuable insights to be extracted for the benefit of all. So where does that leave us? Disparate state specific de identification standards, definitions, statutory terms already add a great deal of complexity, delays, confusion, contracting problems, which I personally have been involved with many times, and above all, costs. I think that the attorneys working in this space are the only ones who benefit from all of this complexity. I certainly don't believe that the complexity advances privacy, and I am very much in favor of harmonizing de identification in in these laws wherever possible. So that was my editorializing. I'll I'll go back to my educational role and wrap things up. Sudanomization. Of course, the first question about Sudanomization is how to pronounce it. You'll hear a lot of pronunciations. It is a European law concept that's been around for quite some time. It's been appearing in US state privacy laws for a few years and it is included in the bill that is in front of you today. Sometimes people describe pseudonymized data as DID light. That may be a useful shorthand, but it's really a little bit more precise than that. Pseudonymized data has had direct and indirect identifiers removed so that individuals cannot be identified. However, what's different is that the those identifiers were removed but not destroyed and the linkage to the identifiers, that crosswalk still exists and it is being kept separately and securely somewhere. For that reason, European law and then The US laws that have been following do not consider pseudonymized data to be de identified. It is still subject to privacy laws. It's still within the scope of the various laws and within the scope of your bill and within the scope of the GDPR. However, because it has privacy protections packed in, it is given favorable treatment under the various laws. It is seen as quite valuable as both a privacy and a security measure. Some states for example grant favorable treatment if pseudonymized data is taken into account when they are conducting their privacy assessments and so on. The GDPR also has some advantages where pseudonymized data is in use. Some of the state laws and your bill as well require organizations that disclose pseudonymized data to exercise oversight over recipients of the data. And then finally, I just want to make you aware of an interesting provision that California put in its law in 2020 in the CCPA. This provision has not been repeated across other laws. This is something that was much discussed during the legislative session and when they were considering the changes to accommodate the HIPAA harmonization and otherwise to advance medical research. California decided to make it illegal to re identify data that had been de identified in accordance with HIPAA. So again, that's essentially that pot of de identified medical and research data to which this applies. If it has been de identified and is therefore exempt from the CCPA and then someone re identifies it, that act is illegal and the re identified data becomes subject again to applicable privacy laws. Now there are exceptions to this ban in California and I would be happy to provide the exact language of the exceptions. The bottom line is that they were carefully drafted to make sure that there are exceptions for specified medical, operational, research and public health purposes for testing and validation of the de identification itself and of course where required by law. To editorialize again for a moment, I think it would be well worth your consideration to take a look at adding a ban on the re identification of de identified data to your legislation if you are interested. I would be very happy to provide technical assistance on language and exceptions should you desire that. With that, I will say thank you again for the opportunity to testify today. I will be happy to take questions and I believe although I am not certain that we have Doctor. Moffett on the line to answer technical questions as well.

[Dr. Colin Moffett]: Yeah I am here.

[Unidentified Committee Member A]: Wonderful.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Thank you.

[Unidentified Committee Member B]: Questions?

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Know that was

[Unidentified Committee Member D]: Very a

[Herb Olson (Member)]: much. This is very, very interesting. So, I I get your point about the need for harmonization of a standard. Was that suggestion having to do with just health data or data beyond the realm of health data? And then I had a question.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: That is an extremely insightful question. I love that question. And my answer is essentially the more standardization, the better by my lights from a public policy perspective. I think there are some challenges operationally in fully and precisely applying the HIPAA standard to all data. Know, there are realms of data that I don't know much about like telecom data where perhaps the HIPAA standard, particularly the safe harbor, might not work very well. But, at a minimum, it need in my view, needs to apply to, medical data. And and sadly, two of the states do not even apply it to medical data, and I can tell you that's causing a lot of problems. But I have exciting news that I learned just this morning, which is in your own bill, I was delighted frankly to see that you've this draft seems to thread the needle in a way that doesn't exist in any other state law and is frankly in my view quite elegant. So you recognize the HIPAA DID standard explicitly for medical data. That's in a different part of the bill. But here in the definition of de identification, is a very other than what's highlighted there, this is a very standard definition, very similar to Connecticut, lots of other states. But note that de identified data means it can't identify, can't be used to infer, link to, etcetera, individuals, devices, as long as the controller takes reasonable measures to ensure it can't be used to re identify, again, standard. But this is what you have in your draft that I haven't seen elsewhere. You say that reasonable measures includes, not not equals, which I also think is wise, but includes the de identification requirements set forth under HIPAA. That's the citation there. So and that definition in your bill applies to all data. I literally was geeking out about this and texting a fellow lawyer who cares a lot about public policy about how exciting this was. That person was excited as well. Because I think what this does is it opens up the possibility that we don't have to have this painful, awkward, hard to operationalize bright line between HIPAA data and consumer health data. You will still have that bright line for other purposes for the overall function of the statute. But at least for de identification, that line can be erased so that one process can be used to de identify all data. Does that make sense to partially

[Herb Olson (Member)]: answer my next question, which is and thank you for pointing this out. That that's what I was I was looking to see how this applied to health data, and you're saying that basically a team does that. But it looks like this also has a broader discussion about de identification.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Yes.

[Herb Olson (Member)]: And that might be different maybe from how you treat health data. Am I reading that correctly?

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: I think that's right. Absent Romanette IAI, this language is virtually identical to what I have seen in most of the other state privacy laws. So while it does create a two tier process, which in general I don't love because of the complexity that it introduces, what I am very pleased to see in your bill here is that for consumer data, including consumer health data that is outside HIPAA, one could choose to apply the HIPAA de identification standard to that data. And what I think is also quite elegant is that they're not required to. So if I have telecommunications data and I just don't find any way that the HIPAA de identification standard makes sense to me, but I think I can adequately de identify it based on other metrics, then I can go ahead and follow the rest of the statutory requirements. But I have the option, particularly if I'm a consumer health data in one of these areas where the HIPAA non HIPAA line is very challenging to implement. I have the option of just de identifying all of my data according to either the HIPAA safe harbor or expert determination method and then having some certainty about how to proceed to comply with the laws.

[Herb Olson (Member)]: That's terrific. Thanks.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Thank you. And if legislative staff who wrote this are hearing this, then my hat is off to them for solving this problem so elegantly. I used to be ledge staff myself long ago and I think this is a very clever way to tackle a difficult problem.

[Unidentified Committee Member B]: Questions?

[Unidentified Committee Member C]: Great. Anne, thank you very much.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: You are most welcome. Will be happy to follow-up if you more questions. And thank you for all you're doing on this legislation. I know complicated, and I can tell that an awful lot of work has gone into the bill.

[Edye Graning (Vice Chair)]: And before you go, I think that what you just said is really important. And I want to highlight that like we're spending the time to dive deep and learn and understand. And what we're being told is it's too complicated or you're making it harder when we're trying to make it easier for businesses to work and write, but it's new language. They hopefully, they're only just not taking the time to understand what the new language means, right? Like just the generous perspective on this. And so every time we hear that this makes better sense than what people have done in the past, it's helpful for us. And it's helpful for us to be able to explain that going forward. And so not everyone has the time to deep dive and understand this. And so we just so much appreciate that you're willing to take the time to help us understand.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Well, it's my pleasure. And my roam is really the de identification aspects of your bill and of these laws. I'm not an expert in some of the other thorny areas, but I can tell that you folks are working hard on the details. That's much appreciated. I could go on, but I should let you guys move on to your other speakers. Doctor. Moffett, did you want to add anything?

[Dr. Colin Moffett]: Hello from England. No, not, explicitly. I think you covered it nicely. Yeah, happy to have been here in case there are any questions, but I don't think there are.

[Unidentified Committee Member C]: Doctor, thank you for taking the time to jump on and listen in. We appreciate it.

[Dr. Colin Moffett]: You're very welcome.

[Unidentified Committee Member C]: And thank you as well.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: You're most welcome. And I can just add that I've seen Doctor. And his team at work. And again, if you hear that urban legend of de identification doesn't mean anything, would invite you to be a fly on the wall when they are spending weeks conducting statistical analyses over and over and over on data sets to determine that the risk of re identification is sufficiently low to satisfy all of the members of the team. And they are vigorously debating as academics are want to do. You know, hopefully we can put that fallacy to bed, at least for you folks at this point. De identification is a very powerful tool, and it should be done well, and it should be operationalized in a legislative structure that enables people to extract valuable insights out of data while protecting privacy. I think we're probably all agreed on that.

[Unidentified Committee Member C]: Great. Thank you.

[Ann Waldo (Senior Fellow, Future of Privacy Forum; Privacy Attorney)]: Most welcome. Reach out anytime. Take care.

[Unidentified Committee Member B]: You too. Julie?

[Unidentified Committee Member C]: Good afternoon.

[Susan Moll (Public Assets Institute)]: Scott, what is flying for you today? It's unusual, but just get in to share it. What's the always the worst feeling when you're

[Unidentified Committee Member B]: in front of a group?

[Unidentified Committee Member A]: Okay. I'm off my audio. Good.

[Susan Moll (Public Assets Institute)]: Sorry that I can't do two things at once. Otherwise, I would introduce myself.

[Unidentified Committee Member B]: Okay. You have a name attached.

[Susan Moll (Public Assets Institute)]: Yes. I'm Julie Law. She's better than from the last few times. Okay, so while I'm waiting for that, my name is Susan Moll. I'm the Economic Security Policy and Outreach Director at Public Assets Institute. Thank you for having me today. I'm going to give you a breadth from de identification and try to talk more about our evolving public perspective on this bill and the importance of data security and data privacy. Public Assets, for those of you who don't know us, is a nonpartisan nonprofit organization that's focused on improving the well-being of all Vermonters and advancing racial, social, and economic justice. And we do that work to inform and ultimately influence those areas through research, fiscal analysis, public engagement. And we use every day administrative and survey data in analysis and form our conclusions. So I really appreciate the essential role that data plays in government and business to understand what programs are operating, who they are, and surveying problem based services. So in my role, I really think about how policy and state investments can make sure that everyone in Vermont can make ends meet through all of life's stages. And so this is where I leave on one slide. So when I think about what different types of policies do we need to ensure that everybody has economic security in Vermont, to think about flexible cash assistance so that people can spend on their particular needs, public goods that meet people's needs, wealth building programs that create personal stability and opportunity and an equitable economy for paid and unpaid workers, employers, and public. And this consumer data privacy bill falls squarely into a necessary foundational policy for guaranteeing an equitable economy, along with strong livable wage standards and a variety of consumer protections that prevent the public from being applauded. But one of the pillars I actually work on most often is the flexible cash assistance. And this really brought me, this work brought to the forefront for me in the last year the importance of data privacy and security. So over the last few years, I've coordinated the Vermont Anti Property Tax Credit Coalition. We have worked on expanding the value of refundable tax credits for Vermonters so that families with low incomes get cash back when they file their taxes. And we've also worked on increasing access to their credits. And one of the ways that we've done that in 2023 is the Vermont lawmakers passed a bill so that the Vermont Earned Income Tax Credit and Child Tax Credit were available to all Vermonters with social security numbers and to those with an ITIN. And this is an individual taxpayer identification number. This is a number that the IRS assigns to people living in The US who aren't eligible for a social security number. And it's essential because the IRS requires everyone in The United States to pay taxes regardless of how or why they are here, how they are getting their income. But last year, the IRS, they broke decades of practice of keeping tax information confidential. They entered into a memorandum of understanding with the Department of Homeland Security to share tax filer information, including addresses and other identifiers in batch records. They requested 7,000,000 records from the IRS. This is now embroiled in the court decision, but so far, 47,000 records have been shared. We've seen the same thing with Medicaid records. Vermont, along with 21 other states, has pushed back suing the federal government this summer when federal officials shared sensitive Medicaid information with the Department of Homeland Security. But now this is continuing to be embroiled in court because the information is being shared. It's not clear how this data is being shared, and so it continues to be an ongoing stuff. Finally, we've seen the Feds coming to Vermont for more and more data. They've asked for data outside the usual channels about SNAP or through Spirits for bot recipients, about those receiving childcare financial assistance. And there's just not a lot of transparency at the state or federal level about what data is shared, why, with whom, who has access to it, and what the process looked like to make that data sharing decision. So as someone who works on improving the economic security of everyone in our communities, this is deeply problematic. We know this data is being used to people from our communities and leaving other people if they're traumatized and fearful. But secondarily, if people aren't accessing needed services, whether that is public services or private, because they're afraid of their data being shared, they're losing out on resources to help their families needs. And we're seeing that in practice. Last year, a poll by the New York Times and KFF saw that nearly a third of adult immigrants reported skipping or putting off health care in 2025, which was an increase from two years previously. We're seeing this in other programs as well. So I shared these examples with you today to highlight that since the start of 2025, we're seeing data being used to the detriment of those in our state. The bill you're considering is about consumer data privacy and protections, but this larger conversation is all connected. Just as we need a systemic approach to protecting public data, we need a systemic approach to protecting private data. People are really overwhelmed, and they don't know how protect themselves or where to protect themselves as the pace of changes in data technology really have outstripped most of our ability to keep up and understand the technology. We think it's so nice to hear from experts who have this knowledge, but most of us don't. I have talked with reminders hesitant to share information with their medical providers. They're unsure of what disclosure could be shared with other providers or services, how personal information might make them a target against them, information about a disability, whether or not they're on the autism spectrum, their gender identity. Personally, I hesitated when I saw a doctor who had a sign saying, this meeting is being transcribed on the wall. No one told me about it verbally. No one asked me to opt in. I still don't know what happened to that reporting or whether it's covered by HIPAA, and it certainly changed how I interacted with my doctor. So understanding the fast world of data sharing can't just be left to the individual. It's so important that we have a systemic solution and systemic protections. There's a lot of uncertainty, mistrust, and overwhelm right now. And sort of the top line that was recently said to me that keeps sticking to me is, if you aren't paying for the service, assume you are the product. And I just don't think that's the wisdom that we want to have to live by going forward. So as I looked through the bill and have looked at the work that you're all doing, just calls for a policy solution that creates transparency for consumer protection so that we know what data is being collected and what our personal data rights are so people can understand what data can be collected and shared. And so in particular, some cornerstones of the bill that really stood out to me as important are limiting data collection to what's reasonably necessary, limiting and providing transparency on the sale of personal data, preventing the sale of sensitive data, and monitoring the disparate impact on consumers. And at the end of the day, I really believe this will create confidence in the products we use, the health care providers, businesses that we patronize, because right now we're all feeling the impacts of the uncertainty, and consumers don't always know who they're trust. So passage of a strong consumer data privacy protections really could be for the benefit of the consumer, for the benefit of community as a whole, as we work towards creating that. Thanks for the work you're doing.

[Herb Olson (Member)]: Thank you.

[Edye Graning (Vice Chair)]: That's my input statement. I appreciate how you made it very clear how data privacy impacts us in our life every day. So that was really helpful. Thank you.

[Susan Moll (Public Assets Institute)]: Thanks.

[Unidentified Committee Member C]: Good afternoon.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Good afternoon, everyone. How are you? Good. I am Kimberly Lancaster, and here shortly, Bill Lancaster will be joining as CTO of my company. I'd like to introduce myself. I'm Kimberly Lancaster. I am a small business owner. I own a privacy consulting and compliance consulting company. Even though I may be out here in Washington State, this is a very important law to me because I work with small business every every single day. They are my primary customers. They feel the impact of not having a privacy law. And I have followed the work that your organization and that you guys have all done to this point to really start to bring this forward. We've seen a lot of privacy laws come across in the last few years. And some are very heavy, like California, and some are very light, like some of the other states that have just passed their laws. And what I want to talk to you about today is more around what it means to a small business owner. And when we talk about that, you know, we've heard quite a bit already about what it means to the individual. And we know as ourselves, as individuals, that privacy is something that we want to have, you know? Today I got three breach notices. Yay. How fun was that? But I think one of the things that I want to bring up is for a small business owner, this is one of the subjects that they don't put in their forefront. They're really thinking about how do I get business? How do I grow my company? How do I serve my customers? And it's one of the ones that I have serious conversations with them around. Because when we look at some of the things that impact us, small businesses are the most disproportionately hit when there's a breach. Most of the times, they don't even know that their data is gone or that their data has been taken. But 46% of breaches targeting businesses with less than a thousand companies or a thousand employees, sorry. They face huge, disappropriate funding issues at that point. Data breaches to a small business cost three to four times more than an annual cybersecurity budget or a privacy budget. And preparing after that happens is really a tough thing to do. One of the things that I want to talk to you a little bit about is really how not hard it is to implement privacy into a program for a small business. Takes a matter of a couple hours, someone to talk them through it, someone to help them understand the complexities if they have state or US you know, if they have customers across The US, you know, great. Let's help them grow. Let's help them meet those laws. But I think one of the key factors here is really around taking a few minutes to do preemptive work benefits all. It benefits the small business owner because they're not having to go and get higher and higher cybersecurity funding and costs. I mean, I pay my own cybersecurity insurance, and it keeps going up every year. One of the factors here is when we talk about privacy, privacy, security, compliance are all one bundle to a small business owner. So we try to come in and help them understand how do you do this effectively? Well, understanding the laws that you apply apply to you is the first thing. Are you selling across The United States? Are you selling locally? Are you just a small mom and pop shop that has an ice cream store down the street? And the only people you gotta worry about is the ones that come into your shop. Well, are you mailing information out to people that sign up for notices when you're gonna have specials? Do you have a website? Do you have cookies on your website? We've heard a little bit about the cookies and the things that have gone on that are needed around that. And relating this back to something that's gonna be very understandable for the small business owner. Because the more that they can explain, I'm asking you to share your email address with me and your name with me so that I can share what great things are coming down the road for our business. I'm gonna do what I need to to protect your data. Builds a level of trust with your customers that resonates farther than anything else I've ever seen in small business. You can have great service. But if you protect who they are as an individual, you're going to earn their trust. And you're going to have their guidance and their willingness to be part of this. There is a fundamental layer here that we come back to the human factor. And relating to individuals and customers as humans and relating to business owners as humans, how would you want your information protected? Anne talked a little bit about HIPAA data. I work with a lot of different doctors' offices and dentists and eye doctors and things like that. And they say, well, I'm HIPAA compliant. Okay. Great. But what are you doing to protect that data? You've got a variety of things that you can do. There's there's small steps you can take on the cybersecurity side. Training your employees is an easy one. Don't write down credit card numbers on a piece of paper. Teach them what it means to have privacy as a mindset. You'll actually find that your employees want to learn more. I have employees calling me from small businesses because I open up my doors and I say, anybody in your company can call me if they've got a question, if they've got a concern. How do we do it? Making sure your privacy policy is on the website is up to date. Making sure you're very transparent about how you're using the data. Making sure that the vendors that you bring in that may have access to that personal data of your customers are also vetted properly. Very small steps, doesn't take much out of a day for a small business owner, which their day is very long. They have a lot to do. And so we try to make things very easy. And this law will actually help move this forward. It'll give them some guidance. It'll give them a place to go and say, what does this mean to me, and how do I enact it? Why is it important? I have a lot of conversations also with chambers of commerce around this is only gonna slow business down. I'm like, no. No. No. No. This is how you build trust in your community. And I've been able to have those conversations at both levels. And we've been very good in moving things forward, at least in my communities here. I would love to see if everyone move this forward because my next step is getting Washington to do it. So I'd like to pause there and ask if anyone has any questions and then just a little bit more about some of the ways to do this.

[Unidentified Committee Member C]: Questions?

[Unidentified Committee Member B]: Monique?

[Monique Priestley (Clerk)]: Thanks, Kim. I guess, so let's see. I'm going to try to form this into a question. So as far I'm thinking I've been thinking a lot about the types of things that businesses already need to invest in as business owner. So I was thinking like trying to think of analog types of versions of things. When I've had small businesses and a nonprofit in the past, for instance, I had a physical location. And so I knew that the things I'd have to invest in were general liability and insurance and cameras. So if somebody tripped down the stairs and broke a leg, I could cover myself. And then we have we already have I think there's been a little bit of confusion out in the public sphere and around the building about the fact that we already have data breach laws. People, businesses are already liable and at risk, like you said, for those data breach laws. And that can be, I've heard, on average, 160 per record in The United States. So if you have a nonprofit that has 20,000 records and they're actually or a small business. They're actually technically exempt because they don't have the unless they're doing sensitive data under this, they wouldn't hit the 35,000 threshold. But that doesn't so that would potentially exempt them from the privacy law. But it doesn't exempt them from, if they get a breach, those potential fines, that could easily put them out of business. And, you know, thinking about the number of times where I've been on nonprofit boards or done small business planning classes and stuff like that, or social media marketing, which I wish I hadn't done in the past, helping businesses install Facebook and pixels and metapixels. There are certain things that businesses need to spend money on, but also a business might spend, I don't know, even what the current rate is. I used to do small website development. And, you know, right after COVID, it was anywhere from, like, 15 to 50,000. But it, like, jumped since before COVID. And, like, that is an expense that a business knows it needs to do when it, like, starts up. It knows it needs to, like, pay somebody to manage those. It probably pays somebody or needs to figure out how to manage social media. Needs to manage this insurance. Needs to manage, hopefully, its data breach policies. But there's all these costs. And some of these things, like having social media profiles and or websites, are actually increasing the risks and creating new liabilities for businesses if they're not careful with their website. So I guess all of that to say, if you could kind of reiterate how this falls into responsible business practice to be already thinking about these things. And already people are liable and at risk if they're not protecting their data from things like existing data breach laws.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Yeah. Happy to. I think one of the big factors is and you and you hit it. Most small business use Facebook or other social media as their primary way to reach people. That's fine. That works. But understand what that company that you're using is doing with what you're posting on there. Read their private look at their privacy settings and make sure that you have things set. Reading their privacy policy is like reading, you know, Microsoft's or Google's or some of the others. We all need to use these additional tools to promote our business. But the factor is, you opened a business because you wanted to serve the public in a certain way. When you think about your business plan and when you think about how you want to grow your business, it is really important to keep privacy, security, cybersecurity involved. Because, like I said, if you look at some of the businesses that have been hit, they're gonna go in, you know, and I I believe you've got a couple people on the on the panel that are cybersecurity related. But most of them come in through a small business to get to the vendor. They wanna go for the big boy. They wanna go for Coca Cola. They wanna go for, you know, Microsoft. They wanna find a way in the back door. It is the business owner's responsibility to protect the people that they're serving. I work for a national nonprofit as their privacy manager as well. And one of the things that we have to be very cautious of is because we do have sensitive data. And one of the things that we constantly are doing is looking at what vendors we're using, how we're using them, what data they have access to, what laws are changing. Because yes, as you mentioned, things are going up and down in the nonprofit world, but breach laws are there. A lot of small business don't realize that they may be subject to a breach law. And that's one of the first things. The first conversation I have with a small business owner is, you aware of this in your state? Do you understand that this impacts you as a company? Same with the nonprofit because breach laws apply there as well. I think one of the keys that I want to bring back to this group, and to answer your question, is there is a lot of misunderstanding on the small business part that this is a huge time consumption thing for them to do. And it's really not. It is building the trust of your customers. And I want to keep reemphasizing that because it is so important for a small business owner to build their customer base. If you continuously have situations or don't even know that you have a situation, is the other aspect, then it's very difficult. And giving those small business owners a very solid path to follow with support, with reason, with understanding of why it's important to them is important. And it's a conversation that I highly recommend across the board.

[Jonathan Cooper (Member)]: Thanks so much, Emily. I think the last comments that you made was really sort of where I was interested in going, and that had to do with what you see as an appropriate sort of level. How much time should businesses be spending on this? And based on what you're seeing in this legislation, are you seeing something that's great to understanding compliance and what sort of burden you're seeing on how the legislation will place upon conscientious businesses or something that's simply at the scale of what they should be or are doing right now?

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: I don't believe a lot of them are doing anything.

[Unidentified Committee Member C]: They know that they've got to have

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: you know, some sort of media presence. They know they need to have some sort of security camera to keep their business from being broken into. Okay. Well, this is just an additional little piece of that. The time spent is really dependent on if there are state laws that are involved or if there is not a state law involved. And I think the key here is it's easier when there's a state law involved versus when it's not. Because you can pivot off of that and say, if I'm selling to somebody in California, I know that I've already got three quarters of what I need based on my state law. I may need to think about one other thing. It's the understanding that takes a little bit of time. And that's an hour conversation. That's sitting down and saying, how do I want my customers to feel when they come to me? And how do I want them to be treated when it comes to what information they share with me? And that's very important.

[Herb Olson (Member)]: Thanks a lot. It's really good to get a perspective from the small business side of things. I'm curious. Yeah. You sound you have small business can encompass a bunch in terms of size, I think. And I'm wondering whether some of your small businesses under this act would be considered a controller or whether or not it's a matter of they would be contracting with the controller. And that has to do with there's a threshold in the statute in terms of workability. And I thought I was wondering whether you what you thought about that threshold.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: So there can be. Okay? In various states, there are thresholds set for a small business to determine if they're actually a controller. If they're taking in the data, say I've got a let's use the ice cream shop. And I want people to sign up for newsletters to know when we're gonna have Sunday Sundays on the net, you know, and specials. I then become a data controller because I'm asking them to share their data with me. The threshold depends on how the law is written. And for a lot of small business, you know, they may have 5,100, up to a thousand beyond customers. And with that, one of the key factors is really understanding, making the law very clear in where they sit in that threshold. And I believe when I read through the updates, everything looks very clean and crisp from your guys' perspective in that aspect. There are a few states that it's very murky. So you go a little higher, you always go to the strongest. You know, if I'm going in to set up a program and they say, well, I want to sell t shirts across The United States. I have this great idea for a t shirt. I want to be able to sell it across The United States or out of the country. Then I look at the most stringent law and we see how it's going to apply to them. And then we decide at what level do we meet that? Do we meet it at the top? Do we meet it right below it or just below that? But we get as close to the most stringent, so they're protected.

[Herb Olson (Member)]: Just follow-up. There's a threshold in the statute of 35,000 consumers. Not sure if I understand all the implications around that, but any thoughts on that?

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: I think that's fine. You know, I would love to see everybody have to apply to it. But when you think about over the lifetime of a business, they may get to that. You know, if they're successful, they may get to 35,000 in a year, five years, or or ten years. But them taking the preemptive upfront and doing it upfront versus after the fact is always a good suggestion as well.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Thank you.

[Susan Moll (Public Assets Institute)]: You're welcome. Go ahead, Michael.

[Unidentified Committee Member D]: Yeah. Speaking about the 35,000, sometimes, unfortunately, chair's not here. Smaller stores, they partner with chains, right? Which then they get access to data leases, which could be over 35,000. So they become controllers as well?

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: They do become controllers in that aspect. It would depend on the if they are a franchise or if they're a straight subsidiary. It would depend a little bit on how the structure of the contract is set up on the business. This is why, for me, one of the first things I do is I look at their contracts with their customers if they have them. I also look at the contracts for their vendors. Because if they're pulling in data from somewhere else to enhance the information they've got to help provide that service, then we need to take that into consideration. So it really is you know, my statement here is, is be prescriptive, provide guidance, and make sure you have somebody that you can point them to to ask questions. You know, not everybody has access to a privacy consulting company. That's why I offer a lot of my services for free.

[Edye Graning (Vice Chair)]: Thank you for being here

[Unidentified Committee Member A]: in your testimony. So I want to go back to your previous comment you made about if you are, you know, you're advising. So in your your role and you're advising a business and they are looking at selling T shirts across the country, and then you would say, Okay, let's see what the most stringent policy is. So I'm interested to hear a couple parts of the question. What would you say is the most stringent right now? What would you see as the one that you would be then trying to mold for? And then the current draft of this bill, where would Vermont sit in that?

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Does that make sense? Yes. Completely. So your most stringent right now is is, of course, California. They are way out there, but they're going after big tech as well. So that that's a thing. Vermont is in that right below. You're fitting just right below it. I think you've got a great perspective on how to apply that law in the draft that I've read. And part of that is, is that you are taking into consideration the growth of the company, their reach, and their ability to meet the laws. When I go in and consult with somebody, we always look at future growth. Where do you want to go? How do you wanna get there? What's your what's your five, ten year plan? And that's what we build for. We may take smaller steps upfront, privacy notice, cokey banner, opt out, making sure that your cybersecurity is set up right, that you have, you know, two factor on logging into your stuff. Those kinds of things to build the framework and then moving up. Vermont's law is one that I really like and that I'm going to start pushing, like I said, Washington to start going after. We've got a health law that's fantastic, but we need another one. And part of why I am so thrilled to be here today is because I really like the way you guys have defined things. You've made it very easy for a smaller business, a medium sized and a large to go do stuff. And you've tried to be very clear and crisp on the requirements. So I appreciate that as a consultant, as a small business owner.

[Edye Graning (Vice Chair)]: Other questions?

[Monique Priestley (Clerk)]: Emily, I'm just curious what you think. So I was noticing a trend online of just following all of the data privacy and AI lawyers at this point on LinkedIn, I feel like, Where somebody had shared the case where so Blackbaud in their breach several years ago, which have talked to nonprofits in Vermont who were affected by that breach. And the the the post was about the fact that the insurance claim cybersecurity insurance claim for Blackbaud got denied because, basically, the court said that, you know, at this moment in time, when that court case was going through, Blackbaud should have had strong enough data protection methods in place, and they might have avoided that. And so then the discussion was really going forward of the people commenting where it was essentially saying that even if states don't start to actually have laws that get businesses to try to start doing data protection and classification and strong governance, that if they think that they're just automatically covered by insurance, that they're safe because they have a cyber insurance policy, even though maybe they don't. But say they do, and they've thought about that, but then they don't do anything to protect their data. I'm just wondering your thoughts about like, is there, do you think, a potential risk for as the future goes on that insurance companies could start to deny cybersecurity, like paying the fines for data breaches because the business did nothing to whether it's nonprofit or for profit, did not go about the right steps, whether or not they have to

[Susan Moll (Public Assets Institute)]: they

[Monique Priestley (Clerk)]: have a data privacy law they have to follow or not. They still have data breach laws and that those claims could be denied because they haven't gone through the steps. And then potentially, this law could trigger them to be like, I need to take this seriously. I'm going to do a privacy policy. I'm going to map out my stuff. I'm gonna minimize my data. I'm not gonna keep twenty years worth of records that increases my potential for fines. I'm gonna have cybersecurity insurance. Just that kind of thinking, I guess. Curious about. Yeah.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Yeah. You know, and you bring up a great point, Monique. I think one of the things, and this is one of the items that came across my desk the other day, is that and let me read this to you guys. Per incident claim, cost rose 30% in one year. What that means is that the average for a small business incidence rise rose from $205,000 to $264,000 in 2025, with direct remediation costs averaging around 79,000 and crisis services averaging a 152,000. Now, we look at a small business or a nonprofit.

[Herb Olson (Member)]: It froze. Sounds like my wife, but I can't reach out.

[Edye Graning (Vice Chair)]: Kim, can you hear us? You're frozen. Let's give it, like, twenty more seconds.

[Unidentified Committee Member A]: I'm back. Sorry. I dropped

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: that great big note on you, and then Zoom goes, boom. So thank you, Zoom. Appreciate you. I think the key here is taking a couple hours to do things prevents losses down the road. Now is it gonna completely prevent? No. We know that. But cybersecurity insurance is becoming very, very stringent. I have one customer who that is a software company. I just did our cybersecurity insurance and it jumped 40% simply because we're in AWS. Now AWS is pretty secure, but it still jumped 40%. That was a heck of a bite. And I don't know many businesses that can really absorb that kind of bite unless they are doing things in the other way. So the key is preemptive. Do the work upfront. Keep your costs low. Talk to your insurance company and understand what they're looking for. And make sure that you have very clear definitions of what they will cover and not cover, because that is very important. Most cybersecurity insurance companies will tell you right up front, if you don't do X, Y, and Z, and ABC, we're not going to cover your claim. And you have to prove it. So it's one of those that we go to the doctor when we're sick. We go to the dentist twice a year to get our teeth cleaned. This is something we do as a small business owner or as a business owner. This is pre efforts to protect ourselves.

[Edye Graning (Vice Chair)]: Other questions? Okay, thank you very much.

[Kimberly Lancaster (Privacy/Compliance Consultant, WA)]: Thank you, and I appreciate your time.

[Edye Graning (Vice Chair)]: Committee, we are going to take a short break. Let's cut twenty five after.

[Bobby Leonard (AgeWell; testifying for Vermont Aging Network/AAAs)]: Yeah, I can see.

[Edye Graning (Vice Chair)]: Come back at 03:25, and we will have our last testimony of the day about that.