Vermont Legislature SmartTranscripts:

[Unidentified Committee Member]: Good

[Michael Marcotte (Chair)]: morning, everyone. This is the Lighthouse Committee on Commerce and Economic Development. It is Wednesday, 04/29/2026, at 10:55 in the morning. We'll be back from a short break, And we're going to continue on with our witnesses. So, Louise. Good morning.

[Elise Walnut, AgilityLab Consulting]: Good morning. Thank you for having me.

[Michael Marcotte (Chair)]: Thank you for joining us.

[Elise Walnut, AgilityLab Consulting]: I have a deck prepared, so bear with me while I get that set up. Okay. Can you all see my screen?

[Michael Marcotte (Chair)]: Yes. Yep.

[Unidentified Committee Member]: Okay. Going to put it in presenter mode. Okay.

[Elise Walnut, AgilityLab Consulting]: Thank you so much again for having me. My name is Elise Walnut. I run AgilityLab Consulting. So I'm a privacy consultant working with some of the nation's largest nonprofits, universities and foundations across the country. And I help them build the privacy readiness that protects their mission, supports their growth and strengthens donor trust. So on background for me, I spent sixteen years prior consulting working in house at nonprofits, largely larger sized nonprofits such as The Nature Conservancy, Amnesty International, and World Food Program, as well as some of the digital agencies that support these nonprofits. The reason I'm here today is to talk to you about the fact that when you're moving forward with this bill, you're rightly legislating not just Vermont nonprofits, but also the national nonprofits that engage your constituents. All of these groups collect, hold and share a tremendous amount of constituent data. It's already been referred to a couple of times, but that includes things like donor financial histories, health conditions, immigration status, reproductive rights questions, and family circumstances. And I find that often much of this flows to vendors and platforms in ways that the organization is not always aware of because they've never been pushed to fully audit it or understand it. So your bill in its current form protects nonprofits, but more importantly, the constituents who trust them. So I am just to make sure we're all speaking the same language here. I I prepped this deck just to give you an overview of some of the things that nonprofits will tell you that they're up against, which are all true, but create a bit of a perpetual loop in terms of how they respond to the squeeze when it comes to revenue and their mission impact. So national nonprofits, for the most part, if they're raising $50,000,000 annually, which is thousands of nonprofits across the country, spend between 5,000,000 to 25,000,000 per year across digital advertising, digital platforms, list vendors, and data brokers. And a large part of that is because of the things that they're up against here. So what we've seen is that since the 2017 tax law change, the proportion of donors in The US has fundamentally shifted. Revenue is up, but the donor count continues to decline. That's largely because the incentive to itemize changed in 2017. So the push for nonprofits to diversify and find more donors is real. Coupled with the federal funding crisis, which we saw last year, we saw one in three nonprofits see federal funding disruption as a result of that, with many of these groups losing 42% of their funding based on that loss of US governmental funding. We also see that private grant makers are challenged in terms of making grants because of the anti DEI mandate. So again, nonprofits are squeezed and they're seeking to diversify. They're challenged in terms of innovation, especially when it comes to charity watchdogs who are looking at the ways that they spend money. And that keeps them pretty reliant on their current vendor pool and affordable technology that's largely private equity backed or made for the private sector. So all of this creates a narrative that what they need is more data, more data to inform how they are going to find people and get in front of them. But the paradox to that is that we've seen year over year increases in this spending, and we continue to see donor acquisition and retention decline. So it's a circular loop. It's what you'll hear a lot of in terms of the narrative on what's impacting nonprofits. But

[Unidentified Committee Member or Staff]: there is

[Elise Walnut, AgilityLab Consulting]: a way forward, and a lot of that is rightly named in your bill. We break a lot of that loop when it comes to disciplined first party data practices, better data hygiene that creates better segmentation of who you're reaching out to and why, and really earning donor trust, which is what they will tell you is their currency, because it is. That's what they have. So my argument to this is that privacy law actually helps establish the business case for many of these nonprofits to invest in the governance and technology that equips them to compete. So I put together this slide just so you I'm sure you're already seeing a lot of this resistance. But to name where it's coming from, first and foremost, there is a web of vendors and ad tech, basically brokers, that benefit from the idea that nonprofits are inherently altruistic. They are themselves, but there are a web of people who profit from that. So that looks like the wealth screening vendors that they engage with, data brokers, ad platforms, advertising agencies, and PE backed fundraising tech. They all have a direct stake in keeping nonprofits in the data market. You'll see from large nonprofits themselves that fundraising practitioners in particular are trying to hit margins that were built for a different era. A lot of the C suite expectations have not shifted correctly in terms of recognizing the demands of user privacy. So you'll see resistance to anything that perpetuates the idea that they can't use their current tech or their current advertising platforms. And you'll hear from others, I believe it's later today, about the reasons that this advertising doesn't work anyways. So that is a pressure that is named in terms of resistance. And then last, small nonprofits who often lack their own in house counsel or technical staff, what I find is that they actually have no idea of their risk exposure. And once they understand that, they are rightly appreciative of having guidance that protects them. I know the person, a couple of people before me named the Blackbaud Challenge a few years ago. That was definitely an eye opener for many organizations, but it shouldn't take something like that that's a major breach of constituent data to open their eyes. So what nonprofits need is not an exemption. So I really appreciate the way that your bill lays things out right now. This is a slide that gives you just a glimpse of some of the private equity and nonprofit tech. You can see there's many, many logos represented here. It doesn't even include the full agency list. So there is just a stack of dependency on keeping nonprofits in that, again, perpetual loop of feeding the data pipeline. So some of the scenarios that I see putting constituents at risk come up pretty frequently here. The first is sensitive data collected without minimization training. So if you'll humor me for a moment, I wrote up a scenario that exemplifies this, which is that a contact report reads, donor's sister is a domestic violence survivor, Screened ultra high net worth. Probably good for a $1,000,000 or more gift. Source seems emotionally fragile following her cancer diagnosis, so use your judgment. Reports like this sit on shared drives that are accessible to vendors, to staff, to volunteers. And while that's a composite example, a lot of the processes that nonprofits go through to understand who they should reach out to and why is collected in these report samples. For altruistic reasons, again, no one has poor intent, but their data flows are not mapped in a way that they can get back to that. The second piece here is because of some of those unmapped data flows and a lack of purpose limitation, what we'll find is that constituents are legally exposed. I believe Monique named the Facebook case that came up several years ago, 2022, where Nebraska constituent and her mother were caught trying to trade state lines to seek abortion care. And that was because of the Facebook messages that they were exchanging in the subpoena there. So nonprofits, again, hold a lot of that sensitive data, and if they don't have the right training to understand where it's going and with whom they're sharing it, a lot of those outside actors are subject to those subpoenas in ways they don't understand. And then the last thing that comes up quite frequently is that consent by co op fine print is something that is part of everyday life in the search for more donors. In particular, I think what's worth paying attention to is the digital co ops. These are places where, if you're not familiar, coops will take data and exchange across nonprofits. And if a person clicks on an email sent from one organization to another group's list, they're considered as owned by that second group, and the email is sent directly to that nonprofit. So that consent, what they'll say is that it's named in the privacy policy, and that makes it eligible for it to become a part of the other nonprofits database. But it puts everyone in that situation at risk. So I just have two more, three more slides, I think. But two of the things that I wanted to name that I think are going really well in the current bill are the data level exemptions only. And that's primarily because of the fact that you're regulating national nonprofits as well. They need accountability based on what they're actually doing with data and entity level exemptions just simply let organizations off the hook. And then the removal of barriers for consent forward advertising practices, I think, also come through really well in the current version, where you're not prohibiting first party or contextual advertising, the things that are legitimate means for reach, but you're putting regulation around targeted advertising that opens constituents and nonprofits themselves up to risk. I have two slides. I'm not going to spend too long on them for the sake of time, but two of the myths here. The first is that nonprofits can't afford to comply. And what I'll tell you is that national nonprofits are already complying in several other states. So they're already spending in the areas listed here. Any added costs would be incremental. Largely, their data brokers are paying for the costs to register for things like the Delete Act in California and so on and so forth. A lot of that cost is not being passed through. For smaller nonprofits who would be forced to comply for the first time, it's between, I would say, dollars 21,000 to $43,000 But when you compare that to the fact that it reduces their risk of breach exposure, which at $160 per record times 50,000 records equals $8,000,000 in potential liability is quite affordable. So I think some of these things are preventative, and they have many overarching uses. Governance translates across privacy, across AI, which is increasingly important, and across security. And then the last piece here is just for your purposes, what nonprofits actually gain through this. So outside of constituent protections, there are a lot of business benefits to this in terms of discernment on resourcing, understanding which data fields they actually need and which prospects are rising to the fore in terms of propensity to give is very useful for them. They carry less technical debt when they're auditing what's on their websites and removing third party data sharing access that doesn't help anyone. And they actually have an easier time with vendor and funder negotiations when they have their paperwork in order in terms of DPAs, privacy policies, and vendor intake. And then last, I'll share this as an appendix. These are some of the recommendations that I have for ways that I think you can support nonprofits in this, primarily to address some of the smaller nonprofit concerns in terms of scaled timelines, reasonable safe harbor, and so on. So I'll stop there for questions.

[Michael Marcotte (Chair)]: Questions for Elise?

[Monique Priestley (Clerk)]: Elise? Thanks Elise. It's just a good reminder about the fact that we're regulating national nonprofits as well as state. Somehow I had like that has slipped my mind as well. Thinking about just focused on local. I was wondering, so I know in the past, a couple of years ago when we were doing this bill, we were, we had not put in the nonprofit exemption, part of it was hearing about the different types of nonprofits that exist that one might not think about, whether it's like religious or whether it's sports or whether it's specific affiliate type of groups or things like that. And you mentioned some of them are like data brokers. Was just curious, if this is a basic response, I'm wondering about some of the nonprofits that Karius specifically, we're thinking about sensitive data, a heightened risk of harm as a national nonprofit that we might not even be thinking about when we're trying to think about having safer regulations, I guess, on them.

[Elise Walnut, AgilityLab Consulting]: Yeah, so sorry, just to make sure I understand the question, what types of organizations might be carrying that data?

[Monique Priestley (Clerk)]: Yeah, like if we exempt nonprofits across the board nationally, what are some of the like scarier nonprofits potentially that we're not thinking about that we are allowing to dysfunction with people's most sensitive information?

[Elise Walnut, AgilityLab Consulting]: Yeah, so in terms of scary nonprofits, I mean, I think that could look a lot of different ways. But what I'll say first is that any nonprofit is likely to be holding sensitive information, and that's based on the nature of the things that people tell them. So that contact report example I read is not an anomaly. Again, it's a composite example, but each of those things are based on things that people think about when they're well scoring or they're trying to determine a criteria for whether to engage a person at this moment or that moment. So I think in terms of nonprofits that might be left hanging and without recourse, if there was a breach or a constituent risk, it's all of them. But for the groups that might be larger and engaging in these markets, I think big groups like reproductive rights groups, immigration rights groups, they actually appreciate the support and the backing that the business case gives them to get better data governance and to be able to stand for what their mission says that they do. So runs contrary to some of those objectives when we're saying that, you know, we're doing all of these things in the name of fundraising, but we're okay with participating in some of these other data exchanges without any regulation. Does that answer the question, Monique?

[Unidentified Committee Member]: Yeah, thank you. Okay. Hi, Lisa. I was wondering if we

[Rep. Charlie Kimbell]: could go back to, I think it's your third slide of the nonprofit Doom Loop. There was one element in there that I just wanted to hear more about.

[Unidentified Committee Member]: And it was that third component of innovation barriers.

[Michael Marcotte (Chair)]: And

[Unidentified Committee Member]: what is making innovation and staff spending difficult?

[Elise Walnut, AgilityLab Consulting]: So, I mean, are many things. Nonprofits are up against a lot, so I'll rightly name that. But when we have things like Charity Navigator, which are watchdogs that look at the number of cents on the dollar that actually goes to the mission, what becomes difficult for nonprofits, and there's actually a lot of literature about this, is the fact that they can't hire competitively or spend on technical tooling in the ways that they might if they didn't have some of that reporting that simply lumps it in as overhead spending or things of that nature, because donors read that as, oh, hey, only $0.80 of my dollar went to the actual mission, but you need the people in the seats to be able to honor the mission. So some of that staffing that doesn't happen and some of the technical investment that doesn't happen keeps nonprofits in a place where they're generally behind in terms of ability to innovate. So data governance and all of these things that we're talking about that are good for business and for compliance get shoved to next year's budget or the year after that, so on and so forth.

[Unidentified Committee Member]: And so the comment you made about like the, I thought you mentioned like existing pool of vendors, the point being that, well, this is the entity that we've always worked with, that we can afford, and they may not be compelling us to elevate the level of service. So it's, we're gonna tell each other the same thing that let's just stick with these you were working for. Okay. I was trying to see if I understood that correctly, that there's something unhealthy in the operational mechanism and that we're seeing it both at a small scale and national. Is that sort of?

[Elise Walnut, AgilityLab Consulting]: Yeah. And the other thing too is that nonprofit tech is kind of a misnomer. Nonprofit tech is either a reduced version of something that belonged in the private sector or it's largely private equity backed. So there's always a reason that it's operating in such a way. So that in and of itself is a challenge in

[Unidentified Committee Member]: terms of And then if you could make this a little more clear for me, slide a couple later about the private equity and nonprofit technology. Yep. And I mean, this is very simply, please just what's wrong with that? Can you just make that clear to me?

[Elise Walnut, AgilityLab Consulting]: So private equity in and of itself, I mean, we can debate the merits. I think that's a whole another conversation. But I think what it creates is in the the data privacy legislation conversation in particular, I think a lot of people hear nonprofit and assume that the only players in nonprofit have that altruistic intent. And so my point here is that it's all a web of the people who are informing the ways that nonprofits think and that there are for profit vendors who are very much dependent on that as well. So the private equity shift here is it resembles the fact that when people are pushing back against some of these bills, they might not be doing it because they're acting on the nonprofit's behalf. They're acting on behalf of stakeholders.

[Unidentified Committee Member]: Thank you.

[Herb Olson (Member)]: Herb? Yeah, thanks very much. That last slide, appendix

[Unidentified Committee Member]: kind

[Herb Olson (Member)]: of thing, implementation support. The first two kind of caught my eye. And I'm wondering if you could talk maybe a little bit more about what scaled timelines would look like and, you know, a safe harbor kind of issue.

[Elise Walnut, AgilityLab Consulting]: Yeah. So scaled timelines. My thought here was that I think what's always of a debate across the states is what number of constituents, know, nonprofit or for profit entity needs to be holding to be eligible to comply. So I think for smaller nonprofits who need longer runway to hire in house counsel or to get some of their paperwork in order, It's difficult, I think, for them when they have the same date that's also hoisted upon, you know, the the other entities operating in the state. I think we saw this during the GDPR rollout is that a lot of groups chose not to engage in that market anymore because compliance was too hard or nonprofits got nervous and decided that they were going to it was creating an environment of fear. So these first two pieces, the scaled timelines and then reasonable safe harbor for good faith efforts are meant to kind of address that and to create some partnership with nonprofits who are trying to comply but need some extra resources and time to be able to.

[Herb Olson (Member)]: So when you say, though, scale, is that just a matter of a delayed effective date or how does that work?

[Elise Walnut, AgilityLab Consulting]: That's what I was suggesting, is that perhaps for the groups that are, you know, again, the national nonprofits are already doing a lot of this, so compliance for them looks like turning on their cookie banner in Vermont, frankly. And a few other things. I'm definitely simplifying that. But for groups that need to do this from scratch, I think giving them some extra room would be useful.

[Herb Olson (Member)]: So on the second one, the safe harbor, do you imagine,

[Unidentified Committee Member or Staff]: how would you imagine that being defined or who would define that?

[Elise Walnut, AgilityLab Consulting]: So I think I don't know. I know you mentioned earlier that the attorney general is usually the one who set some of this, but I think if if you have any ability to inform that, I think defining State Harbor as evidence of their their goodwill efforts to get some of this into place in terms of that could look like some of the data mapping that they've already engaged in. A lot of groups have websites and technical debt that they've inherited based on many generations of nonprofit staffing that has turned. So when you look under the hood at some of that, it's it's hard for them to even untangle what they need to do to have their arms around some of that data exchange. So some of that is, you know, maybe it could look like signing on for tooling to audit those pieces. Some of those contracting pieces could be useful.

[Herb Olson (Member)]: Just follow-up. For you. So do you know of other states that have adopted

[Michael Marcotte (Chair)]: safe harbor definition in their statutes?

[Elise Walnut, AgilityLab Consulting]: I actually, I don't know that I have an example to draw from. Can certainly take that back though.

[Michael Marcotte (Chair)]: Okay, thanks. Sure. So

[Unidentified Committee Member]: I'm interested in how this draft law compares to what So when you think about national nonprofits operating in multiple states, if this law were to go through, what are things that a national nonprofit may have to do that they're not already doing to comply with other states?

[Elise Walnut, AgilityLab Consulting]: So that one, again, it looks a lot like So typically, what they're set up for on the the technical side is and this was kind of my point with this slide, is that they already have things like consent management systems. But like any large group, what they'll wait for is the mandate to comply in a certain state, and then they grant user rights based on that. So it doesn't look like a large expense to them. It might translate to what looks like a loss in, attributable traffic. But again, that's that's more the result of attribution and where different data points are flowing, because the cookie banner turns off some of those tracking technologies. So all that to say, a lot of these groups, again, don't have a lot that they will need to do to change. So it's a positive win for constituents and nonprofits, again, need to be pushed to think about the ways that they diversify their revenue and do more of that first party data collection rather than relying on algorithmic learning and cookie based tracking. Does that help answer that one?

[Unidentified Committee Member]: Sort of. Are they doing this work for any others based on the laws of any other state?

[Elise Walnut, AgilityLab Consulting]: Oh, yes. Yes. Oregon.

[Unidentified Committee Member]: What be the difference in Vermont if this will go through? Sorry, go ahead.

[Elise Walnut, AgilityLab Consulting]: Oregon, Colorado, I'm trying to think of a few others, some provisions in Minnesota and Connecticut, I believe. And there are seven states in total that don't exempt nonprofits. So the obligations, I think, will just change in terms of, you know, if you like, Oregon has a right to know third parties provision where they have to name each group that they share data with by name instead of category. So some of these are technical complexities that might influence these pieces. But the point is that their consent management tools already extend across The US in terms of coverage. So they just need to change the geography of the the technical pieces so that, you know, their cookie banners and some of those tracking capabilities are are switched on for Vermont. So these costs are reflective of what a smaller nonprofit who isn't complying at all at this point and is specifically only has Vermont based consumers would have to to bear.

[Unidentified Committee Member]: Okay. Thank you.

[Michael Marcotte (Chair)]: Sure. Questions? Okay, great. Thanks, Elise.

[Elise Walnut, AgilityLab Consulting]: Thank you. Really appreciate the time.

[Michael Marcotte (Chair)]: Good morning.

[Melanie Ensign, Founder of Discernible]: Hi. Good morning. Thank you so much for having me.

[Michael Marcotte (Chair)]: Thank you for joining us. Go ahead. State your name and and your affiliation and go on with your testimony.

[Melanie Ensign, Founder of Discernible]: Perfect. So good morning, everyone. My name is Melanie Ensign, and I am a small business owner. I am the founder of discernible, which is a cybersecurity and privacy communications firm. I have a master's degree in corporate public relations from Boston University, and I spent fifteen years working in PR for some of the largest technology companies in the world. I'm here today in support of S71, and I want to be useful to you in a very specific way because I'm not a lawyer or a political expert, but I know exactly how the companies lobbying against this bill have been talking to you because I've been in the rooms where those strategies get developed. And I wanna name some of those tactics today plainly and by name so that you can recognize them for what they are. The first one is harm denial. When a company tells you that there's no evidence that their data practices cause harm, what they often mean is that they haven't measured it or that they've structured their operations in order to avoid measuring it. Obviously the absence of evidence and evidence of absence are not the same thing. And this industry has spent decades building complexity instead of accountability and then hiding behind it. S71 starts to address this by requiring data protection assessments for high risk processing, including targeted advertising, sensitive data and profiling that affects people's housing, credit, employment and healthcare. Those assessments create a paper trail for these companies, and that really matters. The second tactic is consumer blame. You've probably heard some version of the argument that people choose to share their data, that they agree to terms of service or that they have all the tools that they need to protect themselves. Those tools being very long lists of toggles in an app that are buried after a screen and screen and screen. And I want you to know that this framing is both deliberate and well practiced and your bill actually names this specifically. S71's definition of consent explicitly includes agreement obtained through dark patterns, or I'm sorry, explicitly excludes agreement obtained through dark patterns and acceptance of broad terms of service that bundled privacy language with unrelated content. And that's not an accident. The people behind this bill, the people drafting it, including some of you, knew exactly what they were doing. The consumer blame argument is a rhetorical device. It's not really a description of reality. And in my opinion, this bill appropriately rejects that distortion. Distortion because when a child's school requires a platform account, consent is not voluntary, or when an employer uses behavioral tracking software, opting out is not a realistic option for those folks. And so blaming the consumer describes a world that doesn't actually really exist for most people. The third tactic that I see a lot is manufactured complexity. So privacy and data infrastructure can be technically complex, but that complexity is often a choice. Companies knowingly take on technical debt and accumulate data that they don't need in pursuit of other ambitions. The complexity isn't incidental either. It's what happens when you prioritize growth and data collection over responsible design, and then use the resulting mess as a reason for why you shouldn't be held accountable. When a lobbyist or tech executive says that this legislation is too broad or that the definitions don't work or that compliance would be impossibly burdensome, they're often exploiting that perceived complexity in order to delay accountability rather than helping to improve the law in good faith. Your bill is specific. The definition of sensitive data that it covers includes social security numbers, financial account credentials, immigration status, pregnancy status, gender identity, sexual orientation, biometric data, precise geolocation, neural data, and keystrokes. These aren't vague concepts. They are categories of information that when collected and sold or shared behind our backs, put people at real risk. And your bill says that you can't sell that kind of data. That is a clear line and it's one that I think should stay. You'll also hear that this bill would hurt small businesses. And I wanna name that for what it is. Big tech and data brokers use small businesses like mine as a human shield while simultaneously misleading us about how indispensable their platforms are. Data brokers in particular have no direct relationship with consumers at all. They collect, package and sell personal information about people who have never heard of them and never knowingly agreed to these practices. Small businesses are not partners in this data economy. We are in large part data collection points that generate value for platforms and brokers. And the small business argument falls apart the moment we apply it anywhere else. A small medical clinic isn't exempt from HIPAA or sanitation standards because compliance is burdensome. A community bank isn't exempt from anti fraud regulations simply because they're not a large institution. The risk to consumers isn't based on the size of the business handling their sensitive information. The risk travels with the data wherever it goes, regardless of who has it. The fourth tactic is delay by design. You've probably already heard calls for more studies, another working group, a pilot program, or even more stakeholder input. Sometimes those are legitimate requests, but more often than not, they're just stalling. This industry has had decades to self regulate and every year of delay is a year of continued extraction at the expense of consumers. This bill has already made significant concessions over its history, including setting up enforcement through the attorney general rather than a private right of action, which means that individual consumers in Vermont who are harmed by violations can't sue. The state bears the entire enforcement burden with a single team of two attorneys and one investigator appropriated with a mere, excuse me, dollars 650,000. The industry has already gotten a great deal. There is nothing left that you need to give them. And the last tactic that I wanna mention today is science manipulation. And I want to take a moment on this one because it has a longer history than most people realize. The individual regarded as the father of modern public relations is a gentleman named Edward Bernays. He was one of Sigmund Freud's nephews and he used his uncle's insights on psychology to advise corporate clients on how to move public opinion. One of his most famous campaigns was convincing women to smoke cigarettes publicly in 1929, framing tobacco as a symbol of liberation. The tobacco industry later hired other PR firms to run that same playbook, manufacturing doubt about the cancer link for decades and funding research designed to create controversy. When industry presents you with research about the economic value of data sharing or the impracticality of data minimization, please ask who funded it and ask what research they're not showing you. It's been well reported for years now that the largest tech companies are hiding a lot of internal research that contradicts what even their own lobbyists are telling you. S71 does something straightforward and just by saying that consumers in Vermont have the right to know what data is being collected about them. They have the right to correct it, delete it, and opt out of having it sold or used to target them. It says that the most sensitive categories of personal information, the kind that can get someone fired, deported, denied housing, or physically harmed, can't be sold, period. Far from radical propositions, these are baseline conditions for any business, regardless of size or industry, to operate honestly, ethically, and with respect to human dignity. I've spent my career helping security and privacy experts communicate more clearly with the public. And the reason that this work is necessary is because the default in this industry is obfuscation and deflection. The kind of protections consumers deserve don't happen on their own. They have to be required. I know this bill isn't perfect. No bill is obviously, but I've been inside the machine that's lobbying against it. And I'm telling you, they're not worried about compliance costs. They're worried about accountability. And I will stop there for questions.

[Unidentified Committee Member]: Melanie, thank you. I appreciate your breaking down the tactics really clearly. And I know that when we talk about these kinds of things, even a kernel of truth forces people to shift the way they think about it, whether all of the information is true or not. And so I just want to focus on a couple of things we heard today and ask you for some feedback on that. Because what we heard is for nonprofits, there's a little bit of It's not clear for them if they're collecting sheherhehim information. Is that reaching Does that put them in the sensitive data for gender identity and food allergies for kids? We don't want to make it more complex than it is, and we still want to make sure that data is protected. And I'm wondering if you have thoughts on the language in the bill on those two things. And then I have another question.

[Melanie Ensign, Founder of Discernible]: Yeah, so I think, and this is coming from my experience working with the technical teams who actually build these systems, both in terms of collection, but then also for compliance. So a lot of it depends on how the data is collected and how it gets stored. Like in the moment that they are collecting, for example, pronouns or information about food allergies for children, like you mentioned, if that is being collected at the same time as other types of sensitive information, it's all going into the same table on the backend from an engineering perspective. If there are different instances, if this information is being collected at different points in time, or it's being stored somewhere else, It does become more complex because now you've got the data that is decentralized in all of these different systems. If I had a magic wand, I would want companies to just design their systems better, so this would be easier. But adding an additional data field within the bill, at least from my perspective, and I'm not a policymaker, I don't write laws for a living. But I feel like it's really about the intent of like, can this data identify something about a person? Because we didn't used to think that certain types of data was all that sensitive, right? I mean, our federal government still uses our social security number as like the key identifier in everything that we do, even though all of our numbers have been breached like so many times. So we didn't know the damage that could be done with individual types of data. And my concern is that the precision of its pronouns, or it's this number or this number or this number means that when data that doesn't fall into that category is used to do the same harm, we don't have that same level of accountability.

[Michael Marcotte (Chair)]: Does that

[Melanie Ensign, Founder of Discernible]: make any sense?

[Unidentified Committee Member]: It does, yeah. And I'm thinking about it from two positions, right? As the consumer, if you're not going to hold the data on me and every time I go to one of your events, I have to tell you that this is my issue, that these are my pronouns, these are my food allergies. It's a little bit annoying, but it's not a lot annoying, versus hanging on to that data ongoing. And that's going be a business decision for those businesses.

[Melanie Ensign, Founder of Discernible]: Yeah, well, you think about, for example, even for e commerce, a lot of sites will give you the option of like, do you wanna save my data for next time? Maybe yes or no. Because I'm looking at it as from a communications scholar perspective, I'm looking at what's the expectation of that consumer, right? If the consumer is choosing, then I don't want you to store this, and I'm happy to just remind you every time. That is my expectation, Right? And and that is a choice that I that I can make. So there there isn't complete, like I hate to say precedence in a room full of people who know what that word means. But, you know, it's not a completely unsolvable problem. I think where consumers feel the most violated is when they find out that their data was used in a way that they didn't expect or that they didn't know. And if somebody wants that information to be stored, they should be able to make that choice if the company has the technical ability to do it, but then the business is obligated to protect that.

[Unidentified Committee Member]: Okay, so then now I have two other questions, but I'll be really short with them. The other question, the next question is around the social media cases that were recently, the lawsuits that were recently settled and the amount were lost, settled and lost. A lot of data from those companies came out that show what truly has been happening inside. I'm curious, is there public access to that yet in a way that makes sense for lawmakers to be able to use going forward? And you may or may not have the answer to that, but I'm curious if you do.

[Melanie Ensign, Founder of Discernible]: I don't know of access that hasn't previously been reported. In fact, a lot of the cases that have come out recently with Meta in particular came after my time working at that company. But a lot of the things that they discussed and the practices that are in that research are things that I saw while I was there. But I'm not privy to knowing the accessibility of things that haven't been publicly reported.

[Unidentified Committee Member]: I was just curious if there's like a database or something that makes it easier for lawmakers to access.

[Melanie Ensign, Founder of Discernible]: Maybe, maybe. Am I allowed to take action items from

[Unidentified Committee Member or Staff]: this meeting? Yeah. Absolutely.

[Melanie Ensign, Founder of Discernible]: I I I will look.

[Unidentified Committee Member or Staff]: We we

[Unidentified Committee Member]: take as much help

[Unidentified Committee Member]: as we can get. And

[Unidentified Committee Member]: then my last question is, you do a lot of this work for for profit businesses. Do you have nonprofit support that you provide at a lower cost for, you know, those small nonprofits or anything like that?

[Melanie Ensign, Founder of Discernible]: I I do. I mean, my I I'm really focused on security and privacy. So my my clients are actually the security and privacy teams inside of these organizations. And so I I do work with a number of nonprofits, and I have various arrangements whether it's a, you know, kind of like in kind pro bono kind of thing or at a reduced rate. Yeah.

[Unidentified Committee Member]: Thank you.

[Michael Marcotte (Chair)]: One lot of things we've heard, I was thinking of nonprofits, but let's just see the pro profit companies.

[Unidentified Committee Member]: We have a lot of discussion here about controllers versus processors. And I know that a lot of companies that are controllers, that are aggregated to collecting this data are using third party companies to store their data. I was wondering if you could talk about issues that you run into because I think the natural tendency is, well, I've hired this company. I'm paying them a subscription fee to manage my data. Data privacy isn't my problem. It's their problem.

[Melanie Ensign, Founder of Discernible]: So they're still accountable for the fact that they collected it in the first place. And there is a lot, at least in cybersecurity, I think there's more maturing to do on the privacy side. But on the actual security side, there is a pretty robust and mature industry already for vendor risk assessment. And so when they are choosing those vendors, at least the large companies. With small companies, and I can even speak for myself as a small company, I'm not issuing RFPs and comparing 10 different cloud vendors. That's just not realistic for a small business. But I did look at what was available to me and chose based on the control that I had around security and privacy. But ultimately, the buck stops with me in terms of what I collected about my customers, what I collected about my clients. Like I'm a small company and even I have a data retention policy and I will go through and I delete data manually if I have to in some of these systems. And for me, even though it's manual, I feel like this is like eating my own dog food. So I kind of, I don't wanna say I enjoy doing it because it's tedious, it feels good knowing that I'm not paying to store that, it can't be stolen from me. And I can tell my clients that, you know, in all honesty, your data has been taken care of per our agreements. Right? I feel like as a small business owner, I have a lot of pride in the fact that I do actually, you know, walk the walk.

[Monique Priestley (Clerk)]: Yeah. Thanks, Melanie. Sorry. Were readjusting witnesses. I have to go back to what my question was. Shoot, shoot, shoot. Okay. Thanks. So we're basing the current draft, like the skeleton of the, like the framework of the current draft of this amendment is based off of Connecticut 2020, three. And in there, it has the tiers of 35,000, the applicability of 35,000, or if you have sensitive data and if you're selling, data. And so as far as sensitive data being a trigger for businesses, I'm just wondering, in your mind, is it likely that if a, say, a Vermont business is doing any type of business, like a New Englander or nationally, that they probably also are going to trigger the sensitive data and have to comply with Connecticut anyways, in the very least of even thinking about them triggering something else. So it's it's I'm just wondering about the likelihood of, like, a Vermont business triggering that and not just having Vermont be the first thing they have to comply with.

[Melanie Ensign, Founder of Discernible]: Yeah. Well, you came to the right place as a nonresident expert in Vermont businesses. At least from my perspective, where I think the most likely area that that may be triggering would be for either, like, those small local nonprofits that are serving very specific communities. And on the commercial side, potentially for your smaller brick and mortar retail businesses where maybe they don't have interstate commerce, where things are pretty local. To be honest, I think a lot about those types of business because I would be one of those businesses in in my home state. And it's it's man it's something new probably for a lot of them, but at that scale, is manageable. And one of the things that I found is that there are tools, for small businesses. And quite frankly, a lot of the free stuff that we're used to using because we're small and we're looking at economies, they just overload us with so much more crap and data than we actually need. And if we could be more precise and if we were more educated on what do I actually need and how should I be storing it? In the same way that as consumers, we learned that saying yes to all of the cookies and trackers on websites were not great for us personally. I remember having to learn how to clear my cookie cache so that I could do other things on the internet. So I do think that there's a bit of education and awareness perhaps with those types of small businesses, but when you're on that scale, it's manageable because you're not dealing with millions and millions of customer data records. Nice.

[Michael Marcotte (Chair)]: Any questions for Melanie? Melanie, thank you for joining us this morning.

[Melanie Ensign, Founder of Discernible]: Yep, you're very welcome. And I look into the accessibility of those social media reports.

[Michael Marcotte (Chair)]: Great, thank you.

[Melanie Ensign, Founder of Discernible]: All right, Thank you. Take care.

[Michael Marcotte (Chair)]: You too. So we have one more witness on this, but what we'll do is switch gears for a second, and representative Kimball is with us to go over the amendment to s three twenty seven, which is up for action tomorrow, and then we'll come back to mayoral after. Charlie, if you want to join us. Sure. Mister chair. Thank you for coming in.

[Rep. Charlie Kimbell]: I'm Charlie Campbell representing Woodstock, Reading Of Plymouth on h or s three twenty seven. So you sent to us the s three twenty seven with some magicians to the original bill. You can send it sent over to you. So we did make some amendments to it or proposing some amendments, which we'll be reporting on the floor.

[Michael Marcotte (Chair)]: So

[Rep. Charlie Kimbell]: so we did not do a strike call. We just did instances of amendment so that you could track it more clearly. Won't take much time. They're not that significant. The first is looking at the VEDU program, the unemployment growth incentive program. And we agreed that we should remove the sunset because it's proven to be a worthwhile economic development tool so that we should be continuing on with VEDIT. It's got a long history. But we also are mindful of the tax credits and tax expenditures and try to make sure we know what is really being promised there and looking at the relative use of the amount that's been authorized. So we looked at two different levers in trying to figure out how to consider what to do with the budget program, either looking at the sunset, and that's always a good way that the Ways and Means Committee likes to review programs for two years or five years or whatever. We said, let's remove the sunset, but give us another tool and toolbox just to look at the amount of the initial applications that can be approved. And there hasn't been recent demand that exceeds the $5,000,000 which we're suggesting, but giving Pepsi the ability to go up to $10,000,000 in those initial approvals or final approvals, I'm sorry, so that they can get that from a joint fiscal committee. So as I look through the report, Veggie does a great report, Pepsi does a great report, delivering what the history of the program is in terms of its annual awards and also whether it's the regular veggie program or green veggie or the low area income veggie program. So it's a great report and that was issued I believe last September 2025. And according to that, there are very few years in the recent past where they've exceeded that $5,000,000 in final applications. So that's why we made that recommendation to go from the 15 and initial applications down to 10 and final applications or final approvals down to five months.

[Melanie Ensign, Founder of Discernible]: Sorry, can you repeat that one more time? I think I have that back.

[Rep. Charlie Kimbell]: So initial approvals for a veggie application would go from 15 down to ten nine and the final approval would go from 10 down five.

[Michael Marcotte (Chair)]: Thank you. Charlie, you give us where they are, where they have been in the last few years?

[Rep. Charlie Kimbell]: I'm pulling this out of their annual report. So first, before the actual amounts that have been paid out in incentives, think last year was 2,200,000 and so the actual amount, the expense to the state and credits is significantly the amount of the initial cap, because businesses, they have to earn their credits. And so in many cases, business finds that circumstances change. They don't have the kind of employment growth that they thought they would, so the initial approvals don't actually then pan out as they were. So the program caps the applications in 2024, final approvals was 1,800,000, 2020 $3,700 and 21,000, 2022 is 5,400,000, so it's a little over that 5,000,000 cap that you could easily ask JFC for. 2021 is a bit of an anomaly at 9,000,000, and then 2020 three point 2,000,000, 2019 8,200,000, and before that going 2018 you'd have to go all the way back to 2012 to where it was over $5,000,000

[Michael Marcotte (Chair)]: So there's still, even though we lowered the thresholds, there's still the ability when we're out of session, if something comes up before the Fiscal Committee, with recommendation from the governor, to approve higher CAC. Yes.

[Unidentified Committee Member]: I think it's been that way, but what is the timetable for that? I mean, you know, gather the drop of hats, it might be a

[Rep. Charlie Kimbell]: few months, I just want to see.

[Michael Marcotte (Chair)]: We're a

[Rep. Charlie Kimbell]: joint fiscal I'm on joint fiscal committee and last year we met, I think, probably four or five times. And if there is something that needs to be decided on, Joint Fiscal Committee can call that meeting. It's fairly nimble.

[Herb Olson (Member)]: So, again, can you so you reduced the tax

[Michael Marcotte (Chair)]: initial in. What was the rationale for that again?

[Rep. Charlie Kimbell]: I'm looking at our tax expenditures as something that Waste and Means Committee is always looking at you know, in terms of limiting the exposure. So when looking at particular programs, either you use the sunset to review the credits that you put out there or you review the limit that you can extend those paths to. So in this case, instead of trying to revisit this every two years, say, well, let's look at the limit. And if there's no need to change the limit, then the program just continues on, no questions asked. But if there's a need for additional monies, then Joint Fiscal Committee weighs in or the legislature weighs in during a session and can increase the amount needed.

[Herb Olson (Member)]: Right, but the cap is being reduced.

[Michael Marcotte (Chair)]: Yes. So what was the rationale for reducing the caps?

[Rep. Charlie Kimbell]: For again, managing the tax expenditures in the state.

[Herb Olson (Member)]: And did you focus on

[Unidentified Committee Member or Staff]: this program? Did you focus on all programs tax expenditures? I'm just wondering why you focused on this one, and

[Rep. Charlie Kimbell]: what was the rationale for breaking it down? So We get a tax expenditure report from the Joint Fiscal Office once every two years. We had one in twenty twenty five. We go through all of those tax expenditures. Whenever we have a program come up for a sunset, we then review, should we just extend the sunset another year or should we look at the actual program or adjust So the in this case, as you came up because its sunset was coming up, so we looked at this program, we didn't make a whole list of changes that we want to make, but this is the one that came up and looked like there's enough room so it doesn't really impact the program itself by lowering that. I get that right up front.

[Michael Marcotte (Chair)]: Was there any other action now other than spend it?

[Rep. Charlie Kimbell]: No, it's still validating the worth of the program by eliminating the sunset and then trying to keep what you manage in the purview of the Ways and Means Committee and also of the Drunken State Committee. Thanks. Yep.

[Michael Marcotte (Chair)]: I think this brings more maturity to the program, too. Know that it's going to continue on. We don't have to worry about a sunset every few years. We've heard for several years that that's been a problem. So I think it's better for Betsy, better for the business community, that they know that this program will stay in existence, and we may have to adjust the patch from time to time.

[Unidentified Committee Member]: Yeah, I agree. I think it's a meaningful it's a meaningful and perfect. So

[Rep. Charlie Kimbell]: that was our first instance of amendment. Let me strike out a second. Not really sure what that was.

[Michael Marcotte (Chair)]: That was, I think it was the piece that chained, you've added for your third. Thank

[Rep. Charlie Kimbell]: you. Yes. And that's really about what had been brought to us, the rural industry development grant programs, and remove it from section law and actually put it into underlying statute and then changing the percentages. So you had actually done things with us and then Yeah. Already done it. So our alleged counsel suggested we put it into into a statute and state of exception law. Right. There's really no subsequent changes for what we did.

[Michael Marcotte (Chair)]: It's clear, I think, too, with what the intent was, that we'll allow that 50%, not the 50% of the grant, but 50% of the actual expenditure that has to be in order to draw down funding.

[Rep. Charlie Kimbell]: Fourth, yeah, it was just clarification to section 13A by sort of saying the purpose of this act, to say the purpose of section B of this act, so make sure it's clarifying as to what we're amending in that. And the fifth is what you had passed on to us about rounding. So we had a lot of discussion about whether it's applied to electronic transactions, whether it applied to agencies at the state as well. So we put in there a person engaged in a transaction may round. We didn't say shall round because we don't want to force people to have to do rounding if they're still going to operate cash. So it's a change from a shall to a may, they can still deliver exact change.

[Michael Marcotte (Chair)]: Then when there's four pennies, they still may round, but they don't have to round, then what do they do?

[Rep. Charlie Kimbell]: There's still pennies.

[Michael Marcotte (Chair)]: Well, there will be for a time, but eventually, just like Canada, there's no more pennies. There's no more pennies. So when we get to that point, are they still a may?

[Rep. Charlie Kimbell]: I have to figure that out. I mean, that are those senseless.

[Unidentified Committee Member]: That was a joke, mister Turner. We are being recorded.

[Unidentified Committee Member]: Have With a c.

[Herb Olson (Member)]: Yes. Yes. That's with c.

[Rep. Charlie Kimbell]: We have so many jokes and puns on this particular issue. We appreciate

[Michael Marcotte (Chair)]: that. And on your way out, we'll give you a penny for your thoughts.

[Rep. Charlie Kimbell]: Thank you so much for that. These are my thoughts and my thoughts alone on this. So, and that's really the only change to that section,

[Unidentified Committee Member]: I believe. Can you just talk about number two, I'm sorry, line 17 on page three?

[Rep. Charlie Kimbell]: Yep, a person rounds a cash transaction on the section. Any cash refund of the amount paid shall be issued to the purchaser in the exact amount initially paid for

[Michael Marcotte (Chair)]: the goods or services.

[Unidentified Committee Member]: Just curious why that was necessary to add. It took me a few readings to understand what it's doing. It's about a refund, it's making sure that people can get their money refunded as cash, right? The exact amount as cash.

[Rep. Charlie Kimbell]: I have to get back to you. That was a suggestion on budget council.

[Michael Marcotte (Chair)]: Okay. Yep.

[Unidentified Committee Member]: I can

[Michael Marcotte (Chair)]: or was it it Rick that made that or was it Cameron? Yes.

[Unidentified Committee Member or Staff]: I'll just have his. Yeah.

[Unidentified Committee Member]: Thank you. Both of them

[Unidentified Committee Member or Staff]: have to. So

[Rep. Charlie Kimbell]: next, under notice requirements on page four, you had required the Department of Liquor and Lottery to provide written notifications to all retailers. We received input that instead of requiring to permit the firm lottery that some of the associations are better suited and better able to provide those to their establishments. So if the liquor and lottery department come up with the right template of the model of that information to be distributed out to retailers, then they could do that more effectively than the Department of Liquor and Monitoring. So there was something also about in there saying free, these notices shall be provided free. So we had a large discussion about what does free mean, is it free of charge at no expense, who bears the cost, that kind of stuff. So if it is they develop a model notice, push it on their website and inform the associations and the associations can distribute it more effectively.

[Michael Marcotte (Chair)]: That is exactly what we were thinking of. Excellent.

[Rep. Charlie Kimbell]: And then to make sure that they're posting that model notices to somewhere prominently in their location, We had a number of discussions about that. And the secretary of agriculture is still involved, obviously, because they do weights and measures to make sure that there's still faith in the system. So is it an actual town? Is it an ounce? What is it bigger? Seventh Amendment, we struck out the last sentence and checked that particular part because it wasn't necessary, and I think it still had to do with rounding 14 a. Tried to prepare this, Mr. Chair on the way, before I came in. I'll have to get back to you in specific, but it was a little confusing that that last sentence was in there in that particular section, so Legis Council recommended taking it out. In the eighth section, we did eighth instance of amendment. This is about the C PACE program, and we just wanted to be clear that section shall not be construed to affect a taxpayer's liability or the municipal's responsibility. So we weren't incurring or making it's making the municipality responsible for paying the loan under the cj spring or the assessment.

[Michael Marcotte (Chair)]: Any questions for Kirk White? One

[Unidentified Committee Member]: of the concerns I have about this whole pay round. So what I'm afraid of is if how can we make it so it's not at a per transaction level? Because if I happen to be a Greek shopkeeper and I come in and it comes up $13.72, then I'm deciding I'm not gonna round. Now if it's $13.74, I'm gonna round because I get an extra penny.

[Rep. Charlie Kimbell]: Well, there's in this instance, he's saying, if you do round, then you have to follow these exact guidelines.

[Unidentified Committee Member]: Right, but how do we know, how can we protect against a per transaction situation? Like I said, I'm worried, someone comes in at 08:00, their number comes up 1372, I say we're knocking around, then at 08:30, another person comes in, buys more stuff. Yeah.

[Rep. Charlie Kimbell]: You either have policies of rounding or you don't. You're being inconsistent. Agreed. I don't know if this is within a greater context of the proposal, if that's not possible. So I don't know. But we were just trying to put it that you don't have to round. So again, I'll have to refer to the next council on that. The seventh instance of amendment we talked about earlier, striking at the last section, subsection A, to see pace in that last sentence is finished out. From your folks getting into the permanent entry into such an agreement may occur only after 01/01/2027. That would be the sentence that was strictly based on where this is, that citation, 14 a subsection

[Michael Marcotte (Chair)]: nine.

[Rep. Charlie Kimbell]: That might be the next counsel as well.

[Michael Marcotte (Chair)]: Maybe that's because we changed it become effective on passage possible. Yes, actually that is right, yes. Right, yeah. Happy.

[Unidentified Committee Member]: Surprising how, we got very detailed and into the weeds on this nickel rounding business too. It's surprising how So I think maybe this is what Edye Flex put in the fifth instance of amendment, where at number two, it says, If a person rounds a cash transaction, under this section, any cash refund of the amount shall be paid, shall be issued to the purchaser in exact amount initially paid, except they may not have pennies when they did have pennies. You know what I mean? Like-

[Rep. Charlie Kimbell]: Right. But if a person rounded a cash transaction under the section

[Unidentified Committee Member]: And then comes back four days later And then cash refund. And they get a cash refund. But it's at I'm just I mean

[Rep. Charlie Kimbell]: It seems it's still rounded. Think that actually specifies it that if you're rounding, then what you get back is the actual amount of the amount.

[Unidentified Committee Member]: But what if you weren't rounding?

[Michael Marcotte (Chair)]: It depends on the round if you round it.

[Unidentified Committee Member]: Person rounds a cash transaction. Okay. Yeah. Thank you.

[Herb Olson (Member)]: Yeah. So

[Michael Marcotte (Chair)]: if you round it and you come back for a refund, you're rounding it.

[Unidentified Committee Member]: You're still rounding it. Okay. Thank you. Alright. That makes sense.

[Michael Marcotte (Chair)]: Personal rounds. You tell it was so much fun.

[Rep. Charlie Kimbell]: Yeah, I mean, we heard that the Boston Fed has released its pennies again. So they're definitely in circulation, but

[Michael Marcotte (Chair)]: It would be in for years. We've already heard some of the larger retailers now are grounding, but they're only rounding down. They're not rounding up. They're afraid to round up because there's no guidance. Hence, we put this in.

[Unidentified Committee Member]: Yeah, yeah.

[Michael Marcotte (Chair)]: Okay. Any other questions for Reverend Kimmel? Great. We will Ledge Council at some point between tomorrow, between today and tomorrow at one. Okay, that's great, thank you so much. Thanks, Charlie. It's fun. Have a good lunch. Doesn't work for lunch. Not true, true. Yeah. For

[Melanie Ensign, Founder of Discernible]: the record, my name is Merrill Hartman. I'm a senior at the University of Vermont, studying political science and I'm a current legislative intern in this 2020 succession. I would like to thank the Chair, Marcotte, and Committee Chair, Priestley, or sorry, Clerk for the opportunity to testify today on S-seventy one. And my testimony focused specifically on the provisions regarding the sharing and sale of sensitive consumer data with an emphasis on precise geolocation data captured through a specific technology known as automatic license plate readers. And today I'm going to explain the technology, the dangers to consumer privacy, and the sharing practices in the ways in which that is still addresses those concerns.

[Merrill Hartman (Legislative Intern, UVM Senior)]: So to start off, understanding the technology as it stands, automatic license plate readers are high speed camera systems that are mounted on patrol cars or fixed to stationary objects, such as utility poles. They use algorithms to convert images of license plates into machine readable text and data, tagging each entry with license plate number, date, and time, and precise GPS location. While this technology helps law enforcement, notably identifying stolen vehicles from responding to ambulance alerts through a hit list system alerts its expansion into the private sector, creates a massive and unregulated SWAT movement data. Some of the dangers that I noted in my private research were the primary concerns regarding ALPR data is not individual scan, but rather the aggregation of data over time. The combination of data from multiple sources allows for detailed tracking of individuals' movements. This creates an intimate profile of drivers' lives and potentially reveals the privatized habits of individuals through the collection of movements in their private lives. Additionally, profiling, which is included on this bill of automatic processing used to reveal the behavior of an individual based on their driving, in addition to their economic situation or associations based on their movements and costs. Visits to healthcare providers, immigration clinics, religious institutions, or union meetings. So why is this important to this bill? It's because of the privatized use and security risks. Though this is used by law enforcement, the importance in pertains to this bill is the use by private security firms, working management companies, toll road operators, and homeowners associations presenting significant risks due to the disproportionate security that private entities may not maintain with their security measures on their websites, proportional to the sensitivity of the geo data that this bill addresses. Additionally, the limited regulation on private companies that are not subject to the current ALPR laws surrounding the collection, storage, retention, and transfer of the sensitive data as law enforcement agencies are subject to. It denotes a lack of transparency around it without a statutory framework to regulate the sharing and transfer process of this sensitive personal information remaining opaque, especially when these controllers contract out with ALPR companies that have opt in nationwide data systems. So in absence of 71, the sensitive geolocated data can be sold or shared with third party processors without explicit consumer consent if the controller, but not the individual, consent to sharing the data that they collect through these systems. And while some, such as Blocksafety, currently a nationwide company that licenses out of contracts with these cameras, claim that their cameras focus on specific hot lists, like with stolen cars or Amber Awards. They often contribute to a larger pool of collected data accessible to those two opt in nationwide, both law enforcement and privatized users. There's examples of this with sharing between private users and law enforcement, which have resulted in the pulling over people who had no idea that their vehicle was giving a hot list. And then they got pulled over and were totally scared because police are pulling you over, you have no idea why. And it's because of the malfunction of these systems that compare it to all the stuff that may produce legal action. Finally, methods of sharing and selling of ALPR data, just to detail and describe how it has expanded, companies like Vigilant Solutions and Motorola and Flock Safety maintain massive surgical databases containing billions of records of captured license plates on vehicles allowing clients to access historical vehicle movement if they choose to opt into this network. Subscription services for law enforcement agencies can buy subscriptions even if they don't use the cameras themselves to vigilant law enforcement archival reporting networks, such as that of vigilant solutions in Motorola, to allow police to access data from other law enforcement agencies. And this could be across state lines of this data collected by both those privatized entities that opt in and law enforcement. So additionally, data sharing networks, companies are encouraged have a collaborative approach where private consumers can share data with law enforcement or with each other, as I described, and lets businesses share about the vehicles within their area that they have captured the place of. So I think that S71 addresses these issues due to the labeling of precise location as sensitized it sensitive data and the limits on profiling, in addition to the limits of selling or sharing of sensitive data of private entities that are not law enforcement or state agencies, but are those that use these systems to gather license plate data, but don't have restrictions in the state currently through statutory law to regulate that retention or collection or sharing that may not be on their pages or reported to consumers or individuals who may never know that their license plate has been captured by a license plate reader and now sits for as long as those retention limits upheld by each individual company. FLOC safety is about thirty days unless you accept longer terms to data retention, but within thirty days, you don't know what's happening with that data. And as we know, they have been used in exploitative practices and have been shared with law enforcement or other agencies for legal purposes. So that's my testimony today. I think ALPR technology does offer benefits for law enforcement efficiency, and the vast data collection by private entities, other than those accepted in this bill, comes a clear danger to consumer data privacy and protection. The mass collection and the removal of consumer consensual sharing is inherently removed by the opt in and document systems that these systems do. And as 71, ensure establish arrangements transparent, compliant, and subject to the explicit rights of individuals by barring such deceptive practices of accountability as Melanie before described, which I think coincides perfectly with these kinds of systems that operate to collecting consumer data. And I urge the committee to support these provisions in this bill. Questions? Thank you your questions and information. I'm curious

[Unidentified Committee Member or Staff]: about the I don't know if you have further information on the thought list, but is that also are you going to be using the AI in various technologies and other inputs?

[Merrill Hartman (Legislative Intern, UVM Senior)]: I think that the hot lists exist within the framework of agencies, law enforcement agencies, or those that share their hot lists with other the users. And AI is merely the function of identifying and rethinking the license plates that these cameras capture and comparing them with those hot lists almost instantaneously to then direct a hit. So if that answers your question or I can do further. Okay, that's great. You.

[Michael Marcotte (Chair)]: Any questions from there? Thank you very much. Representative Kimball, you want to come back for round two?

[Rep. Charlie Kimbell]: Yes. Mr. Chair, if I may just quickly an update, and I misspoke. On the sentence.

[Michael Marcotte (Chair)]: Bringing back your 2¢.

[Rep. Charlie Kimbell]: Yeah, so I misspoke, it actually is all the same language in the May or shall, we didn't change the So it's there, the thing that we did because you enlisted person or business engaged in a cash transaction, it changed just a person because person includes a business. Very little change. Very little change. And then there's the distribution of

[Unidentified Committee Member]: the posthodes. Yeah, and the

[Rep. Charlie Kimbell]: effective date. Very little change, I'm sorry. Didn't want to. Yeah, that's very good. And then the last, you're right, the effective date. That sentence was just the effective date because it was effective on passage for C PACE, and that was so that's why I changed that last sentence up. But I just want to let you know first in the occulta and also to let you know what the actual change was. It's not a biggie deal on the pennies.

[Michael Marcotte (Chair)]: Very good. Thank you. Alright, thank you. Maybe we're on Floor 1, Looks like we're going to be there estimated at 03:30. We'll come back here. We have some more witnesses. S-seventy one will go until 04:25 I have chairs meeting, so we'll wrap it up by then. So hopefully we'll be able to hear all four. If not, then we'll reschedule sooner to back in.

[Unidentified Committee Member]: Are we going to do the

[Michael Marcotte (Chair)]: We'll reschedule probably for next week. We do need to hear that trust fund report. Again, remember, it's a requirement every year. So we go out live and have

[Unidentified Committee Member]: a