Vermont Legislature SmartTranscripts:

[Rep. Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Wednesday, 04/29/2026 at 09:02 in the morning. So we're back again continuing our discussions on s 71. So we have Ryan Saul Kosta with us. Oh, thank you for stopping in and going to chat with us about data privacy.

[Michael Lewis (witness, Front Porch Forum CEO)]: I

[Rep. Michael Marcotte (Chair)]: hope you state your name and your affiliation.

[Saul Khossef (witness, nonprofit tech founder)]: Awesome. Yeah, my name is Saul Khossef. I think I'm here today to do my previous work in the data privacy space, an education technology startup founded in California in 2014 that processed the data for a million students around the world. And it's been filed in various regulations, the Family Educational Rights and Privacy Privacy Act, California's CCPA policy, as well as the European Union's GDPR regulations. I grew up in Vermont up in Weill County, secured science degree at Norwich. We're going to California in 2014. I was there until well, was there in 2021, sold my startup, and I took my way back to Florida, Vermont, and officially moved back here in A year ago exactly, I'm enjoying this wonderful winter, first winter back that we've all been getting. In Vermont, I lead a nonprofit organization called SHOP that creates a mobile application called the app. And the app is effectively a tool that brings together volunteer opportunities, community events, specifically in the state of Vermont, and places it on a map interface. So I think maybe what's notable about what we're doing at STOP is that data minimization has been a tenant of our work from the beginning. And surprisingly, even though our functionality is location based, we actually collect no location information. We don't have the usual zip code. We'd love to have their zip code, but we don't have any functionality within our application that would utilize that type of data so you don't go ahead and collect it for them to gate to provide value to the users. So taking a look at the build, if you've got specific questions. But overall, coming in from the perspective of a leader of small businesses throughout the last decade that's had to comply with various privacy requirements, finding something that I think is both well balanced in terms of the protections that it issues to the consumers and the regulations that it does place on small businesses are achievable, and they are things that can be accomplished even with a small team. And of course, the investments that are made by the organization, both to ensure that this data is protected simply because it's protected, but also due to the reduction in liability that that organization faces in the inevitable event of a breach. I also found throughout the course of my work that compliance with various privacy laws was a way for even a small business to establish credibility with customers, both inside the state and outside of it. I would show up to meetings with multibillion dollar textbook publishers, and we'd already have compliance with, say, FERPA. And they took us seriously, because we took ourselves seriously and the data that we were stewarding seriously as well. So I think the bill, while there are challenges to it in terms of the weight that it places on businesses, I do think the added value of the credibility that it can develop and the overall protection that it offers to consumers is worth the investment that it takes. And there are tools out there to assist businesses in that process as well.

[Rep. Michael Marcotte (Chair)]: Thanks

[Rep. Herb Olson (Member)]: very much for your testimony. So I didn't quite catch. I I don't need to necessarily, you know, exactly what sort of business function you provide to your clients, but I assume you have clients, you know, more type services you provide. What types of businesses, who are your clients typically?

[Saul Khossef (witness, nonprofit tech founder)]: For my start up, they were, my initial start up, which was in the for profit space, they were textbook publishers, online learning companies, entities that wanted to add hands on learning experiences to educational materials related to computer programming, web development, data science, stuff like that. So we're managing data not only for private data for the users, but then also their educational data and their grades and support fall under additional regulations. For my recent startup, we are a nonprofit, and so we don't charge anybody anything at this point. But the clients that we engage with are typically other nonprofits, and then our technologies direct to consumer as well to an end user.

[Rep. Herb Olson (Member)]: So I'm making an assumption, but would you consider yourselves to be a controller And under heard you said that you're okay with that in terms of the obligations that you would have. About your I mean, can say in the no charge, but in terms of I would still call them clients again. Do those clients have any obligations either as a controller or a process or a connection with your activities or relationship?

[Saul Khossef (witness, nonprofit tech founder)]: They do not because we are stealing all the data ourselves.

[Rep. Herb Olson (Member)]: Right. So even though I assume they're providing some information to you. Yes. And then you provide a service to them. Yeah. But you would consider them to be a control peer. Where they could.

[Saul Khossef (witness, nonprofit tech founder)]: When you have with school relationships, for example, we partner on management of volunteer hours, for example. But those ultimately fall under FERPA regulations as well. Okay, thank you. Thanks,

[Rep. Herb Olson (Member)]: Rob.

[Rep. Jonathan Cooper (Member)]: Subject to any sort of activity in the private collection? Find some cause or No. So I'm just curious about that. Yeah. I think that might have been the only question. I'm actually I'm not sure. What is it that you have, Gels?

[Saul Khossef (witness, nonprofit tech founder)]: My current app is basically a way of disrupting the community bulletin board and bringing together volunteer opportunities and community building events throughout the state, but we put it all on a map. So it's very easy for you to find what's happening around you versus scrolling through forums or Reddit or various nonprofit websites and social media. It's really trying to connect organizers with the volunteers out there who all want to help, but can't find those volunteer opportunities very easily.

[Rep. Jonathan Cooper (Member)]: Okay, so it's like a community organizing app? Yeah, community technology.

[Michael Lewis (witness, Front Porch Forum CEO)]: Okay. So

[Rep. Jonathan Cooper (Member)]: it's not like there's a social event here. It's more of a we're getting together to protest here, correct?

[Saul Khossef (witness, nonprofit tech founder)]: We're gonna engage in any political activities, anything hyper parties, no paid activities. But it would be more of a cleanup trails throughout year.

[Rep. Jonathan Cooper (Member)]: How multiple will Google? This?

[Saul Khossef (witness, nonprofit tech founder)]: Currently, entirely focused on the state of Vermont, but also recently acquired a very powerful volunteer that will be released at our on the ground summit in July to prepare this discovery tool, the B app, which is a way to bring in new volunteers into your orbit, which now is really talking to software that lets you manage your volunteer pool once you have it ready. We're actually partnering with an individual based here in Montpellier who supported the Montpellier flood recovery in 2013 and then playing field flood recovery in 2013. So he's looking at using our technology specifically in disaster readiness recovery response situations, really trying to take what's accessible tooling but also demonstrate it throughout these critical use cases as well. How do you find it? Joinb. App.

[Rep. Jonathan Cooper (Member)]: Thank you. Okay. I actually recalled question, so they're happy to get us, if you could, very truthfully, by clients related expenditures as a part of the cost of doing business, is that something that you see going up the passage of business, going that up, doesn't matter what you mean, and I'd to give your thoughts on how it relates specifically to the building,

[Saul Khossef (witness, nonprofit tech founder)]: and also no problem just to fix clients' businesses. Absolutely. I think there will be probably marginal costs that are associated with it. I think one of the great things about the age in which we live in is that there are tools out there that can really reduce a lot of those costs and take a lot of the burden of, say, building your own privacy pop ups and data management or data retention software and can reduce that burden by utilizing tools that already exist. I think one of the ways that this could, especially setting aside reduction in future liability costs and giving increasing credibility, that

[Rep. Michael Marcotte (Chair)]: could

[Saul Khossef (witness, nonprofit tech founder)]: translate into increased revenue for that organization. I think one of the ways that even maybe the state can support in reducing those costs is through the deployment of educational resources. There are tools out there, but being able to use those tools and being aware of those tools is a separate matter. And so even if there are associated costs with that implementation, there are ways that that can

[Rep. Jonathan Cooper (Member)]: be worked to be reduced.

[Michael Lewis (witness, Front Porch Forum CEO)]: The only information or location information together is events. Correct. Now have either you and your app or any of the clients, anybody posted on, asked you for any post event summary or assessment of who may have come from where or any of, you

[Saul Khossef (witness, nonprofit tech founder)]: know, digging into any of that of information? Not yet. I think once we have our volunteer management system up and running, we'll have more reporting like that. A lot of what we do is we push out to existing platforms. So you might have a SignUpGenius tool that you're using, and we're just a way of highlighting that that event exists. Direct data requests yet.

[Rep. Monique Priestley (Clerk)]: Hey, Sol. Sorry I'm late. I was wondering, so I know you attended the educational privacy hearing that we did, and after you were telling me, oh, good to know. I was just starting to get into thinking about advertising, and this makes me rethink what might do. And so I was just curious since then and just in general, how are you thinking about advertising and do

[Susan McClure (witness, Vermont Arts Council Executive Director)]: you

[Rep. Monique Priestley (Clerk)]: feel Yeah, I guess that.

[Saul Khossef (witness, nonprofit tech founder)]: We do utilize search based ads, social ads, various placement ads. I would say I've taken the learnings from that, and I brought them back to the team. We launched our online advertising presence in March, so we're still in a data collection phase and building out the ROI dashboards to determine what that looks like. But tools like the Google Performance Max, I think it was, the data that's being collected by those tools is inefficient from the ad spend perspective, just because the data that even is present is such low quality, or it's being utilized by Google in a very inefficient manner.

[Rep. Jonathan Cooper (Member)]: How many users do you have?

[Saul Khossef (witness, nonprofit tech founder)]: We have about 1,500 users so far. We launched in June. Very, very early stage, but growing very rapidly.

[Rep. Monique Priestley (Clerk)]: So I'm just thinking about as grow, how are you thinking about regulation that is affecting this, potential privacy regulation and things like that, as far as impacting your business? Do you feel like it is a way that you can help justify costs and be able to tell your customers that you're compliant and thinking about them, putting them first versus do you feel like it is going to hamper you as you continue to grow? Like right now, you would be exempt, but ideally, you won't be soon. And so just thinking about how you are budgeting for that and also maybe getting involved in legislation or thinking about building that into your business of how you're complying with state laws.

[Saul Khossef (witness, nonprofit tech founder)]: Absolutely. Yeah. One of the things I like about this bill is it lends credence to the core development ethos that we have at SHOP, which is data minimization. Don't collect, you don't use. So we're actually just as a result of the beliefs behind the founding of the organization, already have in place a lot of the or don't have in place a lot of things that would enable us to meet the requirements under the bill. So I think that this spreads the spirit of our work, and for us in particular, would have just helped guide the specific development as opposed to place restrictions on us at a later point.

[Rep. Jonathan Cooper (Member)]: So

[Unidentified Committee Member]: with your experience running businesses in other states as well, and I'm interested in, when you look at this bill as drafted, and how it applies to your business, are there key pieces that you see that you would need to comply, or a growing business needs to comply with, that you're not already doing for another state?

[Michael Lewis (witness, Front Porch Forum CEO)]: Good question.

[Saul Khossef (witness, nonprofit tech founder)]: Thinking more specifically with my last organization, we ran into California passed its privacy law while we were transacting. And the element that we weren't doing at the time was data retention policies. So that was really the piece that we had to go back and implement was Like setting policies and following them. Okay. Yep, exactly, giving the users the ability to request data deletion and data retention policies. We're already in compliance with, say, cookies and privacy disclosures.

[Unidentified Committee Member]: And is there in moving, if you were to have that same business in Vermont with this bill, is there anything you would need to do, weren't doing in California? Or that wasn't required by the California bill?

[Saul Khossef (witness, nonprofit tech founder)]: I did a comparison yesterday, I'll do a comparison for me. But the biggest thing came down to the private right to action and the differences between Vermont law and the California laws. Technically, in California, there was a private right to action. It's my understanding that, in many cases, we're signing privacy policy agreements. We're logging into websites already and that are limiting that action. So I do think that the attorney general model is acceptable. But that was the key difference that I noted. Michael?

[Rep. Jonathan Cooper (Member)]: So when you create an account with your app, it says put a bio. If you're collecting, could, I mean, you're collecting the information at that point, somebody could put sensitive data into that bio, which then you would be subject to instead of Monique had mentioned you won't qualify, but you would.

[Saul Khossef (witness, nonprofit tech founder)]: Yep. Yeah, mean, I guess it depends on the definition of or how the bio is used. It's not requesting a specific piece of information in terms of an address or social security number, but presumably, yes, it could be in there.

[Rep. Jonathan Cooper (Member)]: Right, because then part of sensitive data reveals racial, ethnic origin, national origin, citizenship, religious or philosophical beliefs.

[Saul Khossef (witness, nonprofit tech founder)]: Intention is more like salt shot, like you're both in the community. But yes, open ended could be used.

[Rep. Jonathan Cooper (Member)]: Well, you think about it. You would certainly reveal to customers, depending on the organization.

[Saul Khossef (witness, nonprofit tech founder)]: Could be inferences.

[Rep. Edye Graning (Vice Chair)]: Sorry, is it a public bio? It is public bio. So they are choosing to make data public if they post something in their files?

[Rep. Jonathan Cooper (Member)]: Correct. Yes. It's still maintaining it, so be considered sensitive data.

[Unidentified Committee Member]: That becomes publicly available information. Right.

[Rep. Edye Graning (Vice Chair)]: So it becomes public when somebody chooses to share it in a public way. It's not the business sharing it for them.

[Saul Khossef (witness, nonprofit tech founder)]: And it is optional as well. Yeah. Okay.

[Rep. Herb Olson (Member)]: Questions?

[Rep. Michael Marcotte (Chair)]: Oh, do you carry cyber insurance, cybersecurity insurance? We do. Is there we don't know. Haven't really just thought this came to me, but if businesses are purchasing cybersecurity insurance, I'm just wondering if they're rated depending on the strength of their security and what they're doing. Are they following state laws? And the stronger the state laws, do they get a better rating? You haven't really thought about that, I guess.

[Saul Khossef (witness, nonprofit tech founder)]: Yeah, I can't speak to the exact price because our insurance is kind of lumped on other models, but for other policies. But I do know that the questionnaires that they provide from the underwriters are quite comprehensive and speak to a number of the items listed in the bill, like what is your data retention policy. So presumably that would be used in premium torps as well.

[Rep. Michael Marcotte (Chair)]: I would think so. If there's strong data minimization that they follow, then I would think their rates would be lower because the exposure is less.

[Michael Lewis (witness, Front Porch Forum CEO)]: So

[Rep. Monique Priestley (Clerk)]: I'm just wondering, as a Vermonter, your personal thoughts about regardless of being a business owner and or maybe being a business owner and playing a part in Vermont economy and also relationships to your neighbors and that kind of stuff, just curious your personal views about privacy for yourself and outside of your business and what you're seeing going on in this country?

[Saul Khossef (witness, nonprofit tech founder)]: Yeah. Well, despite me being I started writing code when I was eight and still techy all the way through, I am actually very against technology in a number of ways. And I think the use of data is probably one of the key reasons that it's left such a sour taste in my mouth. And personally, I would love to have as little note about me as possible at every point, and more than anything, feel like I was in control of that information, which I think we're all kind of just our heads are spinning every time we sign up for a new website.

[Rep. Michael Marcotte (Chair)]: Any other questions, Ms. Paul? Thank you very much.

[Saul Khossef (witness, nonprofit tech founder)]: Thank you.

[Rep. Michael Marcotte (Chair)]: Michael.

[Rep. Herb Olson (Member)]: Morning. Morning.

[Rep. Michael Marcotte (Chair)]: Thank you for joining us.

[Michael Lewis (witness, Front Porch Forum CEO)]: You're welcome, and I appreciate the invitation. Good morning, everybody. I submitted a written testimony, I'm gonna share that now. My name is Michael Lewis. My wife, Valerie, and I settled into the South

[Saul Khossef (witness, nonprofit tech founder)]: End Of Burlington in the

[Michael Lewis (witness, Front Porch Forum CEO)]: 1990s to raise our family, we've been there ever since. I'm here as the co founder and CEO of Front Porch Forum, offer testimony about S-seventy one. While Front Porch Forum is nonpartisan, as a Vermont public benefit corporation, our social mission is baked right into our legal charter, That mission is to help neighbors connect and build more resilient communities across our whole state. And while our business is nonpartisan, we are pro local economy, we are pro rule of law, we're pro democracy. So I feel obligated to accept the invitation to testify today. Thank you, Mr. Chair, to all the representatives for focusing on this critical issue and allowing me this chance to comment. For the spoiler alert here, I am strongly in favor of reining in the great harms to Vermonters that are perpetrated by Big Tech. A strong version of this bill will not harm the business that I represent, not at all. In fact, it will help protect us and slow down the real damages done in our state right now by the Big Tech billionaires. So by way of background, my wife and I started Front Porch Forum as a small family owned business twenty years ago, this summer. We had four kids under the age of six that moment, and I'm not sure we were thinking very clearly, see if I could get time to start a business, but it was a labor of love bringing it to life was pretty much been my life's work. We had struggles too, of course, and like many Vermont small business owners, I worked eighty to one hundred hour work weeks for years. As a business group, we hired Vermonters to flesh out our team. During tight times, we took out a line of credit against our house to make sure we'd always make payroll. So, a story not unfamiliar to a lot of small businesses in the state. Fast forward to today, twenty years later, and we have 31 employees. We serve every town and neighborhood in Vermont with their own online forum, community calendar and business directory. And of all those two fifty digital spaces, they're all networked together, so Vermonters can tune in to their own community and they can branch out to adjacent areas as well. Amongst the launch 270,000 existing households, Front Court Forum has 250,000 active member accounts. This is truly a stunning level of participation. We get attention from all over the country, all over the world really, from people who wanna know what's going on. In a survey, independent survey done a while ago, 97% of members reported that FPF is valuable to their tenants. Also, I'll note that 18,000 Vermont small businesses and nonprofits have joined their local forums to better connect their communities. To ensure our terrific team of 31 employees has built a thriving small business that serves critical civic and economic infrastructure across Vermont, and we've done so by respecting our users' privacy, not by violating. So the damage brought by big tech is so varied and vast, it's hard to describe and harder to comprehend for me, I'll certainly say. But if you look at many of today's big calamities in our country, in our world, big tech can be found accelerating the harm while siphoning billions of dollars out of local economies. I list some examples, the loneliest epidemic, societal divisiveness, erosion of our democracy, canning journalism, looming mental health troubles, acts of public violence, small business closings, it's all well documented. Leveraging their vast fortunes, Big Tech has hired some of the brightest minds in human psychology and related fields to discover what captures our attention as humans the best, the fastest, most reliably. And then they operationalize that with what they learn there to keep us staring at our screens as long as possible every single day of our finite butts. I worry about my own kids, worry about myself as I feel myself drawn over and over. They're well aware of the great harms this is causing to people, again documented in various court cases, and the harms to businesses, institutions, very democracy, but they still want more. A new book I was interested to read came out a couple months ago compares this big tech business model to fracking for natural gas or petroleum. The author calls it human fracking. Big tech injects toxic stuff into our minds at high pressure to extract value and then leaves behind a terrible mess for someone else to deal with. So what would be Vermont's response to this moment? A reasonable response to petroleum fracking done irresponsibly is to pass strong regulation to pivot the worst practices in order to protect people. The same goes with human fracking that's undertaken by Big Tech. They claim the sky will fall if people push back through their elected government to put some basic protections in place to give it the most egregious harmful practices. I think that's heartwashing. I urge this committee to pass the strongest set of measures to protect Vermonters and Vermont businesses from the harmful practices of data brokers and big tech. I recognize that big tech is spending unprecedented sums of money to make folks think that up is down and no is yes, But the choice seems clear from where I sit. Either we side with big tech billionaires who wanna siphon even more money out of Vermont, arms be damned, or we side with everyday Vermonters, small businesses, communities, kids. So please move ahead, the strongest possible version of this bill.

[Rep. Edye Graning (Vice Chair)]: Question? Edye? So thank you so much for being here. Full disclosure, I have three different accounts as an individual, as a school board member, as a legislator. And I use your product, and I find it to be a really great way to engage with my community and for them to engage with me. And so I appreciate that. What I want to ask about, and I know that you don't collect a lot of data on the people who use your product. And I believe you sell ads. I don't know that you sell the data that you collect.

[Unidentified Committee Member]: I don't know if that's part of

[Michael Lewis (witness, Front Porch Forum CEO)]: the business model? Absolutely do not collect much data. We ask people their name and where they live when they sign up and their email address, and that stays private, and we do not share that. Our business model is, yes, we sell ads to our business.

[Rep. Edye Graning (Vice Chair)]: So I'm thinking about the businesses that do sell the data, and that is part of their model, or that have been collecting a lot of data over time, whether they meant to or not, whether that was their intention or not. And I'm trying, as a business owner, if you had to change based on new legislation, I'm curious how much time that would take, what kind of changes. How would that work for you? I know you don't physically have to do it, but you've had to adjust to a lot of different things over time. And so I'm just hoping you can put yourself in that mindset and talk to us about what kind of disruption that could create for businesses and things that we could do to mitigate for that.

[Michael Lewis (witness, Front Porch Forum CEO)]: Yeah, that's an interesting question. It's a hypothetical for me, as you said, but we work very hard to run a really tight ship in our business and things come along and point out areas that we thought we were healthy and really strong in, and like, Oh, I guess we could do a little better in that area. So I would probably view it through that lens. Like, I didn't didn't realize we needed that kind of insurance or that kind of improved HR practice. And it's different things have come down the pike. We've had to, COVID certainly changed the way we did business in ways we weren't ready for. So if you're well organized and have steady revenue and have good staff, you'd be able to respond to these changes.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Thank you.

[Rep. Jonathan Cooper (Member)]: Michael. When you first started off twenty years ago, were you collecting information differently then, or has it always been the same?

[Michael Lewis (witness, Front Porch Forum CEO)]: It's a basic philosophy of ours. We don't want it to collect. We're, as I mentioned, a mission driven business now from a public benefit corporation. And our mission is to help people actually get together in person. We hope people will spend five or ten minutes a day on front porch for them and then put the phone down and go outside and talk to their neighbors and get organized and do something. And that happens every day all across the state. So we don't want or need to collect information and just kind of antithetical to what we're about.

[Rep. Monique Priestley (Clerk)]: Thanks, Michael. I was wondering if you could speak a little bit about, you know, we're hearing that by affecting targeted advertising through big guys and that kind of stuff, it will affect the targeted advertising ability of small businesses and things like that using sensitive data. And I'm curious, like your thoughts on one, ability to market to people without using their sensitive data and if you find it effective. And then also your thoughts on, I feel like Front Porch Forum relatedly to media is some of this advertising ecosystem is actually hurting journalism and the media industry. And I feel like you're similarly in line with wanting to have open information and have a thriving information ecosystem? I'm just

[Saul Khossef (witness, nonprofit tech founder)]: curious. Well,

[Michael Lewis (witness, Front Porch Forum CEO)]: advertising through big tech options, whether it's Google or Facebook or many others, we tried some of that early on, early days, and found it was a terrible waste of money for us. It's not effective at all, and you can't tell what's going on. Since then, there have been a number of investigative reporting pieces and lawsuits showing that it's rife with fraud for big tech. They say you're getting something and you're not, you're getting something else, something less. So don't haven't for years spent any money on big tech advertising for a decade. When small businesses come to us to inquire about our advertising options, we don't spend time talking about other competing options, whether it's a Vermont media outlet or whether it's big tech or other services. In fact, our sales reps often encourage them to have a broad based approach. We have thousands of Vermont businesses that have purchased advertising from Frontcourt Forum, and the typical response is, Wow, this worked better than I thought. And it's because it's a trust based system. People tend to have a degree of trust in their neighbors and our platform is kind neat. You just see it, it's just right there, just not hidden stuff that you can't get to. If you buy ads, you you can't really see them. If you buy ads in seven days from Frontcourt Forum, you can just see it. It's right there. We had someone on the other side talking about a lot of scam advertisements. I was just wondering, do you have some sort of a vetting process to make sure that people are advertising on your forum or not trying to scam people? Yes, we do. Yeah, take that very seriously. Front porch forum has two levels that businesses communicate with promoters. One is they can join as a member and post occasionally, and we call that a posting, and they create a member account, a business member account, they post. The other side of the coin, they can purchase advertising. The advertising purchases go through sales reps, there's a conversation. Human to human, I bet. We have very, very few

[Saul Khossef (witness, nonprofit tech founder)]: who could

[Michael Lewis (witness, Front Porch Forum CEO)]: purchase ads who end up with any scammy behavior. We have to be vigilant on the other side, though, of a rogue contractor who created an account, get a sweet old lady from wherever to down $30,000 on a roof job in advance, and it disappears. So we're all over that. We're very attentive to that kind of abuse. So I'm proud of our track record, he's done very well. Once every few years, one will slip through and we'll jump right on it and be in touch with law enforcement and do whatever we can to make it right.

[Rep. Jonathan Cooper (Member)]: On that topic, there's just truths and hugs. Okay. 31 members, staff. Is that what everybody's work or do you have a few folks who are really focused on it? Just what's the ratio? We

[Michael Lewis (witness, Front Porch Forum CEO)]: have five teams within our staff and our biggest team by far, which is not quite half the staff, our community team that focuses on content moderation and member support and viewing every member account that's created to look for patterns.

[Rep. Herb Olson (Member)]: My thought was,

[Rep. Jonathan Cooper (Member)]: are we positing with the bill changes or legislation that would sort of imply that a successful organization can get more successfully with this sort of a balance of where they're allocating their resources. I was hearing if half of your staff has some relationship with that work that's already a very healthy number that would be able to take on greater standards to build concepts. And I'm just wondering, do you feel,

[Rep. Michael Marcotte (Chair)]: can't think of who's doing

[Rep. Jonathan Cooper (Member)]: what you're doing in Iowa or something like that, but I'm just wondering if your sense of other organizations, other businesses, is that sort of the kind of

[Rep. Herb Olson (Member)]: thing that has one or two

[Rep. Jonathan Cooper (Member)]: people at a similar size?

[Rep. Herb Olson (Member)]: I'm sort of trying to compare

[Michael Lewis (witness, Front Porch Forum CEO)]: the capacity. So at this point, front porch form is unique. Was an English teacher years ago, the word unique out of me is like, don't say unique unless you're actually the only one, but we're the only entity out there. Years ago, when we started from Fortune one, I kept a spreadsheet of every similar competing or even competing geographically by other services I could learn about around the country, around the world, and it grew to hundreds of rows in that spreadsheet and they're all gone down. They all got crushed by big tech. So people have other big tech options that then lead to other problems, basically amplifying division, instead of helping neighbors get together helps neighbors fight. So we're very unusual. There's a big interest in what we're doing, and we're approached many times a year, probably a couple times a month from entities around the country, around the world, Can you help us do what you're doing in Vermont and in other communities? But then they start talking about AI and they start talking about how can we skimp the actual hands on care that I think the sport takes. You wouldn't decide to create a school without teachers. You wouldn't decide to create a newspaper without journalists, I feel like our online community managers are the heart and soul of the work we do. They get in touch with the neighbors, the members, the small businesses, nonprofits, and they keep the culture of each local forum as on target as we can have it.

[Rep. Herb Olson (Member)]: So I'm going to echo Representative Bennington's comments earlier. Front Perth Forum is terrific in our small town. We have a bunch of small towns. And it really helps in terms of being able to get in touch and have a conversation, especially across among TAMs, because some of these issues aren't just the TAM, but we found we can really use it to our benefit and get a whole community involved in particular. Just that's terrific. So, my specific question though is under draft 2.3, would you consider yourself to be a controller and have those obligations or because of the nature of your business, that would be approval?

[Michael Lewis (witness, Front Porch Forum CEO)]: So this is where I might not be super valuable. I'm not a lawyer or a legislator, so hardworking. I did read through that and I probably need some coaching, but would we be considered a controller? I don't know. Do

[Rep. Jonathan Cooper (Member)]: you think so?

[Rep. Michael Marcotte (Chair)]: Very good.

[Unidentified Committee Member]: Yeah. Okay. Just have an email address.

[Rep. Monique Priestley (Clerk)]: Yeah. Generally, the answer is yes.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Yeah. Thanks.

[Rep. Monique Priestley (Clerk)]: Michael, just as a broader, similar to the question I saw, far as being a Vermonter, being an American, being a member of society that is I know in particular, I've gotten from the FrontPorch Farm teams, like Cory Doctoral articles of like, read this thing and the ancientification stuff that he writes about. Just wondering about your personal thoughts about contributing or not to this data ecosystem, which at this point is generally increasingly full of slop that is then being fed into AI and then is also consequently making decisions on people's lives and the importance of whether or not you think privacy is important and our role as legislators in this process.

[Michael Lewis (witness, Front Porch Forum CEO)]: Is that the big softball here?

[Saul Khossef (witness, nonprofit tech founder)]: Yeah. So

[Michael Lewis (witness, Front Porch Forum CEO)]: I think as a phrase, data privacy is such a snoozer. When I try to talk to friends and family and colleagues, they almost immediately look like, Can they go somewhere

[Susan McClure (witness, Vermont Arts Council Executive Director)]: else? And

[Michael Lewis (witness, Front Porch Forum CEO)]: it's so crucial. I mean, really underpins so much what's going on in the world. And yeah, it's no exaggeration, but I wrote in my test written remarks. I think that this issue is at the core of so many of our societal problems right now. Big tech has gotten so huge, so powerful, so incredibly wealthy, and no more complex to demonstrate it at the beginning again. They're doing great harm. And they got a free pass. Congress, years ago, Everything was all in contact. I'm a big believer that we need regulation to serve the worst abuses of humanity. And they don't have it. And they're incredibly powerful and wealthy. We need regulation in the types of states. I'm glad to see some states leading and Vermont working hard to join that group. Yeah, so I worry a lot about family and my kids, the future they're inheriting. I will just add, we've taken several measures to move away from big tech. So we used to use Google Analytics study traffic no longer being plausible, which is a great third party option that doesn't do all this fine. We used to use Google Chrome as our web browser, absolutely not anymore. That's just a vacuum cleaner for Google to suck up everything you do. We used Brave, works just the same with privacy baked in. I used to use Google search, no, not anymore. I used DuckDuckGo for Brave search. The list goes on. Personally, switched from Gmail to Proton Mail. I mentioned before, we used to use Facebook ads and Google ads a little bit. You'd do that anymore. You need to hire somebody to advertise in front of Gross Forum, Facebook or from Op Media. So that's one small business example, but that hasn't harmed us at all, it's helped So

[Rep. Jonathan Cooper (Member)]: when you advertise, you only advertise, I don't know how it works, like I own a store in Berry City, I pay for advertising for only Berry City, correct?

[Michael Lewis (witness, Front Porch Forum CEO)]: There are different options for your store in Barrie City, put my sales hat on. You can join for free and participate in the Barrie City forum and you can post occasionally. If you want to post a little bit more frequently in Barrie City, pay $10 to $20 a month and up your membership. If you want to buy ads and reach all of Washington County, you can talk to our sales rep and buy an advertising campaign. That advertising, that's what makes our payroll. That's our bigger source of reference.

[Rep. Jonathan Cooper (Member)]: So as a, I mean, you're collecting my location by giving the address, right? Because you have to put me in a form.

[Michael Lewis (witness, Front Porch Forum CEO)]: When people sign up, say what's your name, email address,

[Rep. Jonathan Cooper (Member)]: and your home address or business address. And if I want to, let's say I want to opt out of receiving advertisements.

[Michael Lewis (witness, Front Porch Forum CEO)]: Well, that's like getting seven days and saying, you just cut out all the ads out of the newspaper before you give it to me? So when people get their forum in the Barrie City Forum, everybody gets the same thing. So everybody sees three ads in there. So you can't opt out of seeing ads.

[Unidentified Committee Member]: The accents are not targeted to the individual, but just generalized.

[Michael Lewis (witness, Front Porch Forum CEO)]: Thank you. Yeah. Geography and dates to your location. That's pretty widespread. I mean, we're talking about town. That's

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Yeah. Our region.

[Rep. Michael Marcotte (Chair)]: You carry cybersecurity insurance? Sweet.

[Michael Lewis (witness, Front Porch Forum CEO)]: Hard to get years ago, but not more common.

[Rep. Michael Marcotte (Chair)]: Beautiful. You get a questionnaire on how your system works from the insurer?

[Michael Lewis (witness, Front Porch Forum CEO)]: You just have to fill it out, now I have someone, a colleague who has to fill it out. Yeah.

[Rep. Michael Marcotte (Chair)]: Jonathan?

[Rep. Jonathan Cooper (Member)]: On that topic, have the premiums relatively stable growing at a pace of inflation?

[Michael Lewis (witness, Front Porch Forum CEO)]: Yeah, relatively stable. Okay. I think, yeah, I've not heard of anything, I

[Rep. Jonathan Cooper (Member)]: don't know that's so remarkable, not like health insurance.

[Rep. Michael Marcotte (Chair)]: Rates, sure, could differ depending on how secure your system is and how you do things.

[Michael Lewis (witness, Front Porch Forum CEO)]: We have to constantly invest in security just for operations.

[Rep. Michael Marcotte (Chair)]: Other questions for Michael? Thank you very much.

[Michael Lewis (witness, Front Porch Forum CEO)]: Thank you all for working with you.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: I'm Susan McClure. I'm the executive director of the Vermont Arts Council. Thank you all for having me here today. Nice to see you all again next to this committee. Also want to You can speak. Nobody has committee favorites. As I've shared with you before, the council is the state's arts agency. So our work is really about ensuring that Vermonters have access to the arts in their lives, their communities, and their education. Because we know that not only do the arts and creativity bring us together, they also drive our economies and build our communities. So I wanted to start by just thanking this committee for digging into this really important issue to Vermonters, to businesses and consumers. I'm speaking today on behalf of the creative sector and the Vermont Creative Network, which is our statewide coalition of organizations, businesses, and individuals working to advance Vermont's creative sector. And that's all of the nonprofits and businesses that have creativity really at their core. So the reality here in Vermont is that Vermont's creative sector and nonprofits and businesses are operating in a very different world than we were even a few years ago. When I had my first paid job in the administrative office of a Summerstack Theater in 2002, people were buying their season tickets over the phone. We sent out our annual appeal letters through mail merge. It maybe was like WordPerfect even. And we had one of those credit card machines that did the routing of the credit cards, and then we processed them all by hand at the end of the day. I sound like my glasses are in this bag, and I am one hundred and five. But it wasn't really that long ago, to my point. It wasn't actually that long ago. Things are really different. Today's creative sector organizations interact with their consumers and patrons in a totally different way. And while the world has changed around them, the reality is that not every organization has been able to move at the speed of the internet with their practices. That being said, I know they want to. We will not find a single creative sector business or nonprofit who wakes up in the morning and says, I don't care about our patrons or their information and we're lazy with their data. They just don't do that. But what they do need is guidance and help about and doing what is right. And really, that's what I see this bill doing for our sector. I don't particularly wanna sound alarmist, but things are rough out there in our digital landscape. Just yesterday, was an op ed in the New York Times by Vanderbilt professor Brett Goldstein, in which he said that, quote, No amount of digital vigilance is going to be enough to change the near term reality that individual people and small organizations are at a cybersecurity disadvantage. Large companies and enterprises will develop and implement more sophisticated AI defenses to counter the threat of the hour, but the general public draws the short straw for now. There's only so much people can do on their own. There are examples across the country of arts organizations experiencing phishing scams and data breaches, often involving the sharing of sensitive or financial data. And so the question for our sector right now is unfortunately not, how do we stop this? The question is really, how can we best be prepared when this inevitably happens? So that's where it is really important for governments to step in and help us with basic common sense regulations. And that is what this version of s 71 does. Just a few specific things I wanna note about the bill. The forty five day window to remove consumers from your database seems totally reasonable. There's a lot of flexibility in there. Frankly, you should be able to respond to the consumer in forty five days. The requirement to have a data policy data privacy policy is also totally reasonable, and it's there to protect nonprofit and for profit businesses. There are many good templates you can use to create this policy. It's good practice for organizations. And the size and the scope of the business that this applies to will impact many Vermont businesses and nonprofits. But when I read that, to me, that's even more reason why these companies and organizations should be prepared and protected with these real data privacy issues that they're facing. The other thing to think about with this is that many arts and culture organizations have contracts with much larger data management systems from Salesforce to Eventbrite to Testatura. Those are names that might not mean anything to you, but in the arts administration world, that's there everywhere. And given the strict data privacy policies in other states, including California's laws, these national companies are already operating in this regulatory. I wanted to wrap up with just a personal story. I was previously the executive director of the Lake Champlain Maritime Museum, and they used a Blackbaud product for their donor management system. So in July 2020, a time that you remember as being particularly tough for all of us, we were notified by Blackbaud that a hacker had reached the company's network in May 2020 and that personal information of all of our donors in the database may have been compromised, including bank account information. I'll say that July 2020 was already a stressful time to be running a nonprofit. Let me tell you that having to pick up the phone and call our donors and thank them for their trust in us and explain that we were not opening for the season that year, we did not know what was gonna happen. Oh, and by the way, your bank account information has probably been stolen by someone and is out there we don't know what's going to happen to it. And there's nothing we can do. That was not a fun conversation. And the company did send them a monitoring service and all that stuff, but really it was so out of our hands. I would not wish that conversation on any business or nonprofit when dealing with your consumers. In that data breach, Blackbaud paid the SEC $3,000,000 in settlement for making misleading disclosures about the attack. They also paid California $6,750,000 for failing to implement reasonable data security that led to the breach. But they didn't pay the nonprofits whose donors lost trust in them, and that's what happens. Nonprofits are at risk of paying fines. They're at risk of having money stolen from them. But one of the biggest issues is they're at risk of losing credibility by the donors who put their faith in their ability to responsibly manage their money and their information. So we need to be protected as a sector. We need guidance on how to do it, and that's what this version of S-seventy one does. The Arts Council and the Creative Network are very happy to be partners with us, to spread the word, to support how this is done. That is going to be a piece of this that we will need. It's technical assistance around how this should happen. People want to do the right thing. They need a little help knowing how to do that. And just on a personal note, think as someone who exists in the world, legislations like this rewrite makes me proud to be a Vermonter. I want to live in a state where our elected officials protect consumers, where we protect businesses, and where we kind of exemplify that spirit of Vermonters looking out for each other in the regulations that we pass. So I'm happy to answer questions and just thank you all for your work on

[Unidentified Committee Member]: this. Thanks,

[Rep. Monique Priestley (Clerk)]: Susan. I was wondering if you could expand a little bit on talking to nonprofit privacy consultants about the donor piece and about the breach piece. Then just connecting that to the data minimization piece and what we're talking about, and even de identified data. Basically, I'm trying to get the stories that I've heard were instances of nonprofits holding and even I had. Not just the quantitative data on I did use STEM programs, which I did with kids, and I would collect anything from their name and their address and their parents' emergency contact info. But then for certain grants, I needed to collect demographic information. And then also I needed to collect things like this kid has an allergy to peanuts, so don't have peanut butter sandwiches at lunch. So there's that type of stuff. And then also on the donor side, you might have to collect, this person just lost their aunt, and now they're going to get an inheritance. Their potential, you might want to reach out to them next month in order to get a donation. And or any number of other sensitive things, which if we imagine those things I've been actually on the child care data privacy webinar the other day with the state talking about things like maybe kids are at home with alcoholic parents or something. Any number of these qualitative points that are in there that we may not need, that then if that information also gets breached, we are setting up that kid with alcoholic parents to have that tracked for their entire lives. That might then lead to insurance decisions where it's like they have alcoholism that runs in their family or that donor that then has the aunt that died, that then that family can be targeted by a phishing scam because they're particularly vulnerable and or that person's identity could be stolen. Just thinking about, do you think there's opportunities and or what are the risks of collecting that higher, that sensitive information that we don't even actually cover in this, really, that is qualitative, that puts people at risks in ways that they don't even necessarily think about what happens by just putting in notes about people.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: I think that there's two issues that I see there. One is the data about youth particularly, and that's actually something that came up during COVID because there were new questions that we had to ask about vaccination and all these things that just museums and arts organizations have never asked that before, that was all new. I think the takeaway from that is there are certain things you need to have information about for security. But the takeaway from that and the arts and corporate organizations I've worked with and worked at and seen is that they just aren't thinking about that. Everything you just said is not on their radar. So I think there's a real education component to this to make sure that we're nonprofits and workforce for the matter know what the risks are in that. I don't think people really consider it that their data would be reaching you would not have any of that information. It's just not what a small nonprofit's laid out. The other donor side, I think, just to be clear, don't want us to talk about to raise fundraise. You're supposed to write down every single part of every single conversation that you've with a donor, just for a much larger organization, Indies Week. And their donor database says like, mean, it was like, we went out to lunch at this place, we talked about this, we were supposed to write all these details. And that's kind of how the business of fundraising is done. But that's another area where people just aren't thinking about this as being a risk. So I think in terms There's a lot of education around that in terms of that data minimization piece. And I think there's Our approach would not be to tell people what they should be collecting, but to give them the information and tools that they need in order to make the decisions that are right for their organization so that they can do that safely.

[Unidentified Committee Member]: I was going ask further about the technical assistance. You said that you all are prepared, so you guys have the capacity and the ability to get all the information out.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Yeah, I will say it's not like I'm cautious to commit to something without funding, obviously. Fits in line with the things that we already do around support for nonprofit organizations. You're also gonna hear from Common Good. I think we're gonna talk about that. Also do Actually, I should have looked at, but this is on We have a partnership that we're funding along with USDA Rural Development for artists. Vermont artists have access to a program called Access for Artists. That's business training for artists. It's all free. It's all online. And this is making me wonder if they do a course about that. And if not, we can ask them to, and they should be able to do that. So that would be something you can partner with others on. Again, I would not pretend to be an extreme expert in any of this situation, but it's something we definitely want to make sure organizations have the resources they need to make the right decisions.

[Rep. Edye Graning (Vice Chair)]: So thank you. Appreciate you sharing your experience and also understanding that you have been on both sides of this, on businesses that are doing a mindful assessment of what data they're holding onto and understanding what the risks are in others that have not. And how do you see that transition,

[Unidentified Committee Member]: timeline?

[Rep. Edye Graning (Vice Chair)]: I understand supports, right? We talked about how But supports are again, we want to protect Vermonters and Vermont businesses. So we don't want to overburden businesses asking them to do something that they are unaware of how to do it, don't have the proper support. And so I'm curious if you, having been on both sides, can think about what that timeline looks like. And again, putting you on the spot, you're not That's okay. To do this. But there will be friction points. There will be issues that come up. I'm hoping that we can partner with businesses, again, that have been on both sides of this, to understand how do we make that the smoothest transition possible.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: To be totally honest, I think it's just not on people's radar in the way that it should be. If I were crafting an education campaign around this, that would be the first step, right, is awareness. So there would be an awareness piece of why this matters and what the risks are. It only took one phone call to a donor for me to be terrified of this for the rest of my life, right? But you don't want that to be people's experience. So I think there's some awareness raising around it that needs to happen. And then a lot of the data privacy policy tools that I've looked at and started going through, they're really helpful. And they're really helpful to guide you through that process. And again, to me, comes back to, I mean, it really only speaks for arts organizations, arts businesses. They want to do the right thing. They just have no idea about what that is. So if there's a person to go to support specifics, whatever that is, to be able to answer those questions I mean, even yesterday, I was reading through the mill, I was going back and forth with my team. I'm like, Okay, well, how many records do we have? And we have three different management systems. We have a grant because we do grant meetings. We have a grant database. We have an email list. We have a donor database. There's the same people on all of those lists. Do they count as one record? Are they three records? So there's so many questions that immediately came up about it. There are a lot of I think there needs to be a translation process of whatever is in the book. It is very detailed and there's lot of definitions. So being able to translate that into found something that is translatable will be an important step in this too. Too. I think that's one of the often I mean, that feels like an overall challenge. There's really great legislation that gets passed and then there's a gap in the middle of who is telling the public about that. That's one that The externality tries to fill that gap. We've tried to do a lot of explanations of implementation. Capital Grid does a lot of that. There's organizations trying to fill that gap, but it would be great to have a partner in doing that to help us roll that out to the public. That was a very not specific answer.

[Rep. Edye Graning (Vice Chair)]: No, no, I think that is. And we count on the attorney general to make rules that are understandable, that businesses know. And then we, in the past, have also gotten feedback that there isn't always trust that the regulator is going to be able to share that information out in a way that feels like a partnership. So, I guess I don't really have the question, but I just feel like that needs

[Unidentified Committee Member]: to be part of the conversation as well.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Yeah. Yeah, that's something we've all heard about the ticketing bill a lot, but that is something we've talked about with that as well. There are major changes to how businesses are supposed to be doing their work or how consumers are supposed to be interacting with businesses, there also needs to be a step there where there is a communication education effort too. Issue with it Can't stop talking about ticketing. But the issue of ticketing is so pressing to the businesses that they are really motivated to fix it. So if they have said, We want to participate in an education campaign or at the venues, I think organizations that have experienced a data breach will be very motivated to say, We want to do the right thing. There's also a huge group of people that it's just not on their radar. They will need to have the It's not on the radar in ways that it kind of has to be because, I mean, I don't want to end with the internet as dark and full of terrorists, but it kind of is. There's a lot of things happening that are really outside of anything I was trained for in working at an art center, for sure.

[Unidentified Committee Member]: Are you finding that there are arts organizations in Vermont that do have this on their radar and that are able to meet these challenges as they stand now?

[Susan McClure (witness, Vermont Arts Council Executive Director)]: I think some of the larger organizations are definitely thinking about this, and a lot of them, because they either have cybersecurity insurance or their insurance companies brought it up with them, like several That happened with us, the Maritime Zoo actually, our insurance company was like, Hey, there's something called cybersecurity insurance. They're like, What is that? But then we learned and knew about it. It turns out it doesn't actually cover a lot of the things we think it's gonna cover, which is also problematic. And I would say some of the organizations that have, as I mentioned, the kind of natural companies that they're working through, that happens a lot for donor database software or ticketing software. I think the Blackbaud data breach I talked about was a real wake up call for their industry. It didn't fix the whole problem, but it was a wake up call. A lot of their platforms have Not to put our trust completely in those platforms, we have responsible for that too, but they are operating in more strict regulatory setups in other states already. So they're just kind of already doing here too.

[Rep. Monique Priestley (Clerk)]: Susan, I'm curious, in the past, we've had the Small Business Technical Exchange, I think it's changed names several times, the RDC's having that $5,000 up to $5,000 grants for companies that are using Vermont's consultants and vendors to offer web design services, social media training, legal advice, any number of business things. I'm curious if you think there might be an opportunity for this type of thing to be added to the ways that we think about funding grants for these small businesses and nonprofits to be able to access the same type of if we're going to give money for a business to go on social media or to go on a website, but then not give them the same opportunity to make sure they're being responsible about that use of that website that they're paying to create. Seems like there is room there.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: I know that was a different program. Should say I used to be the chair of the Addison County Economic Development Corporation when that program was happening. Whatever it's called, RevSub. You would know, right? That program was great because it really incentivized And we've talked about this a lot at the Arts Council now, too. How do we incentivize Vermont businesses to know what other Vermont businesses they can be working with? A lot of times our creative businesses, draft colliners are in that. There is an opportunity there. I think that is I can't speak for the RDC. I feel like that is in their daily way, kind of this technical assistance piece, they would have to be funding this. I mean, that's one of the challenges to all of this. Everything we ever talk about, there would have to be funding to make it work effectively. There was funding. That's why that program worked effectively. For our specific grant making, we do unrestricted operating grants to arts nonprofits, which is a program we've grown a lot over the years. We don't require, and it's unrestricted operating supports. We think they know best what to spend it on. So it would be challenging for us as an organization to have a specific grant program that's like, This is for data privacy enforcement. It is, however, something we would communicate as part of all of our communications around how do you run an arts nonprofit effectively? And we answer a lot of technical questions. Our staff do not allow right now, too. So there's an opportunity for us to be more well versed. To be actually talking to the new commissioner of I can have a tell a bit about this, about the important role of just kind of that a few of our organizations play as being this connector.

[Saul Khossef (witness, nonprofit tech founder)]: I think I've said this in

[Susan McClure (witness, Vermont Arts Council Executive Director)]: this committee before. When I started at ACEDC, I was really impressed by the overwhelming amount of supports that Vermont has for businesses. But then there's a big missing piece between how do those businesses know that those are available? And this feels like it's kind of the same. I'm sure you've all talked about that in here before. This feels like one of the same issues. That this is a huge challenge. Businesses need to be prepared for it. But then how do we connect the dots? And often that's what organizations like ours. This is not I mean, that service is not really even part of artificial definition of what we do, but it's a role we end up playing of kind of being that connector between resources, organizations, and technical support.

[Rep. Michael Marcotte (Chair)]: Questions for Susan? We look at the bill. I think there's two areas that there may be some concern. There's data minimization and targeted advertising. As you've looked at the language in the interview, do you think that there's issues for some of your smaller members to be able to comply with the language?

[Susan McClure (witness, Vermont Arts Council Executive Director)]: The targeted advertising, I think it's something that is often what larger organizations are doing. Definitely something they do. Definitely, we all live in a world of Google Ads and Google Words and Google Google. So it's definitely something people are doing that they would need some guidance on how to do, guidance on what is thought. Again, think it comes back to like, my take on this is there's very little that you're saying, Absolutely, you cannot do this. But what you're saying is you have to be aware of what you're doing. And so that fits into that too, like an education piece around that. It would be challenging. I mean, again, I want to answer that. Would want to hear more from them about, from the arts organizations, about the specifics around this. The ones that I've talked to, again, I think people just aren't This is not on their radar. So I if you told them, Hey, this is what's happening. When you buy this ad, you have no control over where it goes or what website it shows up on. I think they'd be horrified. A lot of this We have very small budgets. Our field is not making money, and they're nonprofits. And even the for profits, our for profit arts organizations and music venues, they're not selling lucrative business. Every dollar that they spend, they wanna make sure it's getting them exactly what they need to happen, which is more people buying tickets, more people getting their services, more donations. Better experience for everyone. I think people just don't know about that. Would never have considered that if I bought an ad, a Facebook ad or Google ad or whatever, that it would end up on some website that I didn't know about. They don't fit that in the terms of service, or maybe they do and they're 75 pages long. So again, I think this comes back to an education piece that they don't want that to happen. There are some things that are kind of required now in terms of how people get information. It feels required in terms of how people get information that I But again, it comes back to this education piece of like, there's a sense among even smaller arts organizations that they have to participate in that way. They have to buy the ads. They have to buy If you want your website to show up, have to make a certain amount of money for ad based. They just don't know the other side of it. So that would be the consumer education piece. That's the first part that I didn't answer.

[Rep. Michael Marcotte (Chair)]: Data minimization.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: Data minimization, right. I think that's a new term for many, many arts organizations. I'm not going put a number on it, I would

[Saul Khossef (witness, nonprofit tech founder)]: say almost all of them.

[Susan McClure (witness, Vermont Arts Council Executive Director)]: We have often been taught, again, this goes back to development and fundraising. You've been taught to collect more data and never really to stop and ask, why are we collecting this data? So that also comes back to education. And I think if people really understand the risks of that, it's like a risk reward, right? You have to weigh those things. In the moment we're in, in kind of the Wild West of the internet right now, the risks far outweigh the rewards, but we just don't think about it like that. Because if you think about it like that every day, I don't know how any of us could ever sleep or go through our day because it's terrifying, the information that's out there available to people. So again, I think it comes back to our desire to support on some sort of education campaigning or work that would happen around this.

[Rep. Michael Marcotte (Chair)]: The question for Susan? Susan, thank you.

[Unidentified Committee Member]: Thanks, everyone. See you soon.

[Emma Paradise (witness, Common Good Vermont)]: Good committee. It's such a great conversation. For the record, Emma Paradise with Common Good Vermont. And

[Rep. Jonathan Cooper (Member)]: as

[Emma Paradise (witness, Common Good Vermont)]: a reminder, Common Good Vermont is a statewide program of United Way of Northwest Vermont dedicated to uniting, strengthening, advocating for Vermont's nonprofit sector. So really appreciate the opportunity to weigh in on F-seventy one, We really appreciate the intent and what the team does. We know all too well in this moment that strong data privacy practices are especially critical for nonprofits. We're facing not only heightened security risks that we're all facing, but also increase public scrutiny and more politically motivated government overreach that prevent their own data related concerns as well. So for mission driven organizations whose credibility is foundational to their impact. Protecting personal data is not just a legal or technical responsibility for them. It's really an ethical imperative that's essential to maintaining their safety, trust, and the rights of those that they engage with. So we get that. And there are 6,400 nonprofits that serve our state, and they're diverse in size, service area, mission, but together they represent a sector that employs one and five Vermont workers. They're an economic driver for the state, and they make state

[Saul Khossef (witness, nonprofit tech founder)]: a

[Emma Paradise (witness, Common Good Vermont)]: better place to live work and play. Most of these organizations are really small. 70% have budgets under 100,000, so really small teams, really vain operations. There are also much larger ones who deliver vital services at a larger scale to us communities. But what all of these organizations really have in common is that they are operating under significant resource and capacity constraints. And so when I talk to nonprofits about data privacy, I'm often a mixed person, that was a really mixed reaction. On the one hand, forget it. Organizations really care about data privacy and protecting the information of their donors or clients, the partners they work with. And they know that responsible data stewardship is not only critical to maintaining that trust that's essential to achieving their missions, but also something that they intrinsically value on a personal level. After all, nonprofits are led by fellow Vermonters who want their data to be handled with that same care that they treat others. But the support for privacy protection is often followed by some questions and concerns. What would these changes mean for my organization? Will the systems that I have in place be sufficient? What specific categories of data do we hold? Do I have room in my budget to consult an expert and make necessary updates or invest in new technology? Do my staff have the capacity to undertake a new project or add new steps to their workflow? How does this change how we work or collaborate with partners? These concerns don't come from a place of knowledge and empathy, but rather really reflective of a sector that's all too familiar with being projected to new requirements without the resources to effectively adopt them. Nonprofits rely on data to carry out their missions for the common good. They're not selling data for the most part, products or services for profit. The data they collect and process helps them to serve clients. It also helps them deliver programmatic and fundraising messages to those who will benefit the most from those messages, and it also helps them make important decisions and assess their impact. And while the vast majority have strong data security measures in place, often utilizing third party services, as you've heard others talk about, they also operate in an imperfect environment. So many work collaboratively with other organizations or government entities in ways that require the sharing of data, so really needing clarity around what does this mean for those relationships and whose responsibility it is to intercept data. Some hold client information that doesn't fit squarely into one data category or is a malformation of multiple types of data. And some may inadvertently wind up holding sensitive information while helping clients access services or benefit programs, helping them apply for SNAP, for example. So these are just a few examples of some of the different experiences nonprofits may encounter, but they do speak to why we need not only clarity, but also acknowledging that policies designed to protect consumers may also in some ways make it harder for nonprofits to support them as well. That may look like staff hesitating to provide certain types of assistance or document information that helps them serve clients, spending more time managing data that they could spend on mission work, or have to divert resources from programming to cover legal or compliance counsel. And in some cases, this might also be confusing and frustrating for clients, except for betterment trade offs. So as the State Nonprofit Association, Common Good does have sort of a necessary preference to prevent nonprofits from this legislation, but especially in a moment when organizations are facing decreasing resources, increased need, and uncertainty at the federal level, that's something that does pose another chance that they have to navigate, something else on their place that they need to figure out. Beyond logistical concerns, there is an additional step associated with that, consulting services, new technology, legal support. Since most nonprofits, especially of those with that scale, are only practicing responsible data stewardship, minimizing this does to some extent minimize a real life benefit to the consumer. But that said, in lieu of an exemption and the interest of strengthening data privacy, effective implementation of this legislation means offering the support, the clarity, and resources nonprofits need to successfully expand the gap. And so to this end, we recommend a few things. So first, investing in technical assistance. As Susan mentioned, and as we've talked about this section, nonprofits really don't have access to technical assistance services like small businesses, municipalities, or other comparable entities do. And so an appropriation or grant program, actually through Common Good Vermont, could support public compliance training, the development of resources, as well as access to what have on technical assistance to address what can be really unique circumstances. There's a lot of different ways that organizations handle data and some are very complex, so having that one on one support, I think, will be really helpful, especially those situations. Nonprofits need to understand what's expected of them and how to push that. Building on that, education outreach to potentially impact the gentlification by the Attorney General in coordination with stakeholders should really be explicitly included in this bill. And this could include language guidance, public messaging, information sessions, and a hotline or penal address that could answer clients' questions. I also want to suggest a third party registry. As we've talked about, a lot of organizations rely on third party services to manage their data and keep it secure. And so to help them identify which companies are meeting those data standards that comply with this legislation, having a list or a registry of vetted companies would be really helpful, I think, not just for nonprofits, but anyone who is utilizing those third party services. And it would also reward businesses for taking that extra step and making good practices. I also want to call out, I think we've talked about some of the clarity around targeted advocacy, but I think also some of the data categories could be more clearly defined, or maybe it's an adjustment of applicability thresholds, but particularly for sensitive data or health data. For example, consumer health data reads to include information that would include something like a food allergy, which is something that we collect regularly on an event registration, making sure that we have something available for people to eat. And so would one piece of that information require a really small organization to respond to the app covered under this bill? Small question. And I think another question we had around, well, obviously not interchangeable terms with listing pronouns on a record potentially be interpreted as if you're in a non binary status of an individual. I think just sort of clarifying what is intent meant by those terms just organizations know what would for sure happen. And then finally, the delayed effective date is something we would push for. I think 01/01/2028 would allow for enough time for education and outreach, as well as to give an adequate one right for organizations. So I'm posing nonprofits are exempted or not, I think there is a strong desire in the nonprofit community to do what is right by their clients and their supporters to mitigate risk to their organization and to enhance status security measures. It's really not buy in that stands in the way. It is time, resources, and expertise. So if we're amongst serious about protecting consumer data, it needs to create supportive conditions, and this means making space to collaboratively navigate policy nuances as they play out in real time without fear of penalty. It means providing guidance and opportunities to ask questions, and it also means reducing financial barriers. And CommonGoods here as a partner and a resource, and we look forward to working with you to achieve this shared goal.

[Unidentified Committee Member]: Yeah. Thanks, Herb. So a bill, as I see it, examines any organization on 35,000 per month, talked about a lot of the concerns about some of your really small organizations. Are they more than 35,000?

[Emma Paradise (witness, Common Good Vermont)]: To that point, the clarification around sensitive data, holding one piece of sensitive data would trigger applicability, so if you have a food allergy associated with an individual in your records, that would technically qualify to make the bill applicable to you. That's my read.

[Unidentified Committee Member]: Michael, Yeah. I'm

[Rep. Jonathan Cooper (Member)]: gonna research your emails for finding an email for someone Yes. Which would put you into a category as a controller for that as well.

[Emma Paradise (witness, Common Good Vermont)]: I don't deny that we would be a controller.

[Unidentified Committee Member]: Yeah. No. No. I know.

[Saul Khossef (witness, nonprofit tech founder)]: I'm I'm just pointing

[Rep. Jonathan Cooper (Member)]: out that the overreaching of the the potential of causing a problem, having the sensitive data as a as a thing that pushes you over. Sorry.

[Emma Paradise (witness, Common Good Vermont)]: I think it would depend on the content of the email in that situation. Email would be personal data as opposed to sensitive, right?

[Michael Lewis (witness, Front Porch Forum CEO)]: Right, but if you, yeah, it's

[Rep. Jonathan Cooper (Member)]: you spend a lot of time in the Senate working on the exemptions. Is that correct?

[Emma Paradise (witness, Common Good Vermont)]: Assume. We did support these exemptions. I think we also recognize that the current environment does present high interest, and we want to also support organizations and companies compliance and protecting folks and their people.

[Rep. Edye Graning (Vice Chair)]: I just have a statement. I appreciate you looking through the bill and coming up with specific areas that aren't clear, that some clarity would provide businesses the information that they need to both support their customers and to make sure that they are safe. So I really just want

[Unidentified Committee Member]: to say how much I appreciate it.

[Rep. Monique Priestley (Clerk)]: Yeah. Also, you for recognizing both sides of this and the risks to nonprofits at the same time. Part And of this is trying to also raise awareness of risks they're already at. Thank you for emailing again too about questions about the previous testimony. I am curious, on a related note, the AG said that since 2022, 147 Vermont nonprofits have had security breaches that they reported. So it could be even more. And I'm curious, do you feel like there's support and or is that a conversation that Common Good is having with nonprofits, like Susan's, that are suffering these breaches? How is maybe current webinars or guidance or one pagers or something? Is that kind of stuff happening under existing laws that are already affecting them?

[Emma Paradise (witness, Common Good Vermont)]: Yeah. It is definitely something we are excited. We have a webinar coming up in June. Data Security Expert, also just added member benefit that supports 10% off cybersecurity. Cool. Supports our members and allows some great consulting for a expert.

[Michael Lewis (witness, Front Porch Forum CEO)]: I was trying to quickly scan. Have you filed your Do you

[Rep. Herb Olson (Member)]: have written testimony that you've offered on the website?

[Emma Paradise (witness, Common Good Vermont)]: I have, yeah.

[Rep. Herb Olson (Member)]: Oh, you, I didn't see it there. Yeah, so you will. Thank you, thank you.

[Rep. Monique Priestley (Clerk)]: I'm just curious, so as far as businesses, and I think I testified earlier, having a nonprofit, there were certain things that I was trying to, as I started up, what do I need to come up with in order initial funding, what do I need to come up with, and what are

[Saul Khossef (witness, nonprofit tech founder)]: the ongoing costs I have

[Rep. Monique Priestley (Clerk)]: to build into the budget? So things like general liability insurance and cameras so that I can protect security and also prevent people falling and then suing me or things like that. A part of that is you need to have a website. You need to spend money on a website. You need to pay somebody to maintain your website. You might need to pay somebody to maintain your social media. And I guess I'm wondering, businesses already need to do are already building in budgets for insurance. They're already building in budgets for websites. They're already building in money for marketing. And so I'm just curious, if a nonprofit or a business is spending say they have a $20,000 marketing budget, I'm curious if by having that website, by having those ads, they are increasing their risk. And I'm curious your thoughts on wouldn't it make sense to reallocate some of that money to better protect themselves as they're putting themselves out there, I guess?

[Emma Paradise (witness, Common Good Vermont)]: I think I guess that. I think a lot of nonprofit websites, if you look at them, lot of them are quite outdated, think. Websites is definitely an undertaking that I think larger organizations are often in a position to do, and I certainly recommend it help that any new developments that are doing this, cybersecurity building and protections are part of that and should be prioritized. I also think a lot of, local website hosts, are well versed in helping organizations, knowing what they need to do as they're designing their website, which is great, but I think that it's also not common that a lot of organizations have a $20,000 recommendation necessarily. I know we've put in a grant this year to upgrade ours and are doing so is really contingent on receiving that funding. So it's not something that we necessarily prioritize.

[Unidentified Committee Member]: So

[Rep. Monique Priestley (Clerk)]: I think this is nonprofit ecosystem as a whole, and thinking about so many of our nonprofits are the ones that are doing the coordinated entry for social benefits and welfare and things like housing or access to state services and nonprofits serving the immigrant population and assisting, especially in today's world, with everything that's fun. Things like LGBTQ support services and things like gender affirming care support services or support groups or the medical abortion access or people of color and trying to promote professional color type of networking opportunities. And nonprofits, largely as any small business, is told they need to have Google Tag Manager. They need to have Facebook Pixels. In that, any visitor to their websites is then collecting information about those people that are accessing those websites and feeding it to Google and Meta. And so they're collecting that information, feeding it into their profile. And so then, far as us thinking about what is going on as far as government surveillance, the Department of HHS put out ICE, put out an RFI a couple months ago, basically saying they wanted big tech to teach them whether or not using advertising technology, like Google, Facebook, would better help them track people. So let's say somebody trying to go to an LGBTQ site to look up gender affirming care and or somebody trying to access abortion crossing state lines and then all of their website traffic being used to track them to find out where they are or they want. Nonprofits are inadvertently, I think, a lot of ways because they don't realize connection that they are making to that ecosystem or feeding into that, that could harm the very people that they are trying to serve. I'm curious about your thoughts there.

[Emma Paradise (witness, Common Good Vermont)]: I don't know that I have any specific or concrete knowledge to draw on in that area, but my understanding would be that those organizations understand and appreciate the sensitivity of the information that they may be potentially exposing their clients to. And I also think that a lot of those same organizations are the ones that are facing major funding cuts right now and are in a particularly challenging position to adopt and invest in new technology and expertise that would help them to put together those protections in place. And so I think that one way that would really support the implication of this bill would be turning organizations that have people in all of

[Unidentified Committee Member]: our populations that they served. Thank you for all of your points and suggestions. I think something that's coming up for me is that the nonprofit mean, nonprofit's clearly just an iOS designation. It covers a lot of different organizations, including everything from arts organizations to social service organizations. And even within, I think it's been brought up a

[Saul Khossef (witness, nonprofit tech founder)]: number of times, I've also run a nonprofit

[Unidentified Committee Member]: and did adversely work and had to become a whole other expert administrative landscape. I think that's also some of what happened in the community, particularly on top of our great information. So it's really starting a new initiative, or thinking about something, it costs a lot. But I was looking at just thinking about the exception process for nonprofits and small businesses in general. And I think a lot of it tends to focus on getting your state paperwork done, getting your IRS paperwork done, getting your EINs and all of that. It's very hard focused and does not necessarily pick up on some of these softer things. Not that it's really soft

[Saul Khossef (witness, nonprofit tech founder)]: per se,

[Unidentified Committee Member]: these things like data security, cybersecurity, even within somebody that's an expert in their particular area of interest, administering the thing is totally different.

[Emma Paradise (witness, Common Good Vermont)]: When someone comes to those, you passionate about this mission, or do you actually want to run a business? Because there are both sides of that. I'm sorry, I don't know.

[Unidentified Committee Member]: No, no, I think that's part of it. So as I'm looking on your website and it's starting a nonprofit organization, it seems to be very focused on getting yourself listed, but not these other things that you have to think about. Everything from you might need new computers or some pencils. How many months did I make to staple starting a business? Those sort of things. So I think part of the problem is that, and this is of writ large, that we don't necessarily give nonprofit business owners, standard business owners, a real sense of all of the things, all of the real costs of what it is to start our businesses and organizations. And particularly with nonprofits, that's usually being done out of a deep passion, deep mission that can get disconnected from the practicality of what we're doing. So I agree with your point, all of that to say. I agree with the point that I think a deep well of technical assistance is going to be needed for people to understand how the landscape is shifting very quickly under our feet in terms of the responsibilities that you have as a business owner.

[Emma Paradise (witness, Common Good Vermont)]: Really agree with that, Tom. I appreciate that. I think there's trade offs. You want to do good. You want to contribute. You want suit your mission, there are responsibilities that come with that. And I think it's trade offs. What is the infrastructure in TUX Vermont that we can support that?

[Rep. Michael Marcotte (Chair)]: Thank you.

[Emma Paradise (witness, Common Good Vermont)]: Yeah, appreciate it.

[Rep. Michael Marcotte (Chair)]: I think it's time for a short break. So why don't we take a ten minute break back here at ten of eleven, so we can continue on. We do have to hear from Representative Kimball for the amendment to S-three 27. I've asked him to come in at 11:45. To go over that. Straub will roll that as well. So ten minute break back at 10:00. I'll go off live.