Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good afternoon, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Tuesday, 05/05/2026 at 01:36 in the afternoon. So we are here. This is our first committee meeting of the day. And we are going to continue discussions on S-seventy one, which is an act relating to consumer data privacy and online surveillance. Over the weekend, we had asked our legislative council, Rutland Sagel, to work on a document that would give us an idea of what we have in 2.3 of S-seventy one, what the Connecticut 2025 law says, what Maryland law is at the present, and also what California is. So it's giving us comparisons, those four comparisons. Rick, I'll let you walk us through that document. Thank you for producing that for us.

[Rick Siegel (Office of Legislative Counsel)]: Oh, you're very welcome. So Rick Siegel with the Office of Legislative Counsel. So and thanks for setting that up. It makes my job a little easier. As far as why I'm doing this, chair asked for a comparison document. So I also want to specifically say that this is just for data minimization. This does not compare the thresholds, the exemptions, the definitions. There's a lot of variations between these mostly laws and an S-seventy one bill. But for this chart, this document that's online, this is just the data minimization comparison between these four. The Connecticut comparison is their twenty twenty five amendments which take effect 07/01/2026. So just around the corner, they have not yet taken effect. I do want to note there are likely to be twenty twenty six Connecticut changes which are not included in this, they're not major amendments, but there are some Connecticut amendments. I believe it's going to the governor's desk, I don't know what the governor's going to do, so that's not here in this document. So if we're looking at S71 draft 2.3, we're looking at 2415EA which is the duties of controllers. I don't know If you want to look at the underlying bill, it is on page twenty thirty three, page 33 on draft 2.3. So I have this chart kind of in categories of minimization. So the first chart here is limiting collection and processing of data, which in the Connecticut and Maryland laws are also the first item of the duties of controllers. And it is kind of an overall I think it's difficult.

[Michael Marcotte (Chair)]: Yeah.

[Rick Siegel (Office of Legislative Counsel)]: You know, in speech class, they keep getting attention grabbing statement to get everyone's attention. You should have been. Opened the whole attention window.

[Unidentified Committee Member]: Now that I

[Rick Siegel (Office of Legislative Counsel)]: have your attention.

[Michael Marcotte (Chair)]: Members of the bonds.

[Rick Siegel (Office of Legislative Counsel)]: That too.

[Michael Marcotte (Chair)]: Just so everybody knows, so this document is is on our web page, so anybody can access it, as well as s seventy one two point three, and as well as the red line that's still sitting on our page today. So thank you. Yeah.

[Rick Siegel (Office of Legislative Counsel)]: So the first the top row is s 71, and you can see this language. You've seen the language how the draft 2.3 would handle kind of the overall handling of collection and processing of data. So let's read that again. A controller shall limit the collection and processing of personal data to what is reasonably necessary and proportionate to provide or maintain A, a specific product or service requested by the consumer to whom the data pertains and B, a communication that is not an advertisement by the controller to the consumer that is reasonably anticipated within the context of the relationship between the controller and the consumer. So there are some similarities between these other three states, I'll get to California in a sec. California is gonna be different on almost all of these and I'll explain why. So Connecticut, the language is similar, limit the collection of personal data, not processing just collection, limit the collection of personal data to what is reasonably necessary and proportionate in relation to the purposes for which such data are processed as disclosed to the consumer. So, looking at this, the differences, maybe there are some important differences. It's similar between Connecticut twenty twenty five and two point three. B is not similar. B is unique to draft 2.3. No other state in this list has that specific language. It may be inferred in California, but let's get to that here in a second. B, Connecticut 2025. So B is the new language that Connecticut added in 2025 that kind of explains A, to some extent. So B, controller shall unless the controller obtains the consumer's consent, not process the consumer's personal data for any material new purpose that is neither reasonably necessary to nor compatible with the purposes that were disposed by the consumer pursuant to A, taking into account one, two, three, four, five. There's five things to take into account. One, the consumer's reasonable expectation regarding such personal data at the time such personal data were collected based on the purposes that were disclosed to the consumer pursuant to A. So this is helping explain what a consumer seems to be reasonable as far as their expectations. Two, the relationship that such new purpose bears the purposes that were disclosed to the consumer pursuant to A. The impact, three, the impact that processing such personal data for such new purpose might have on the consumer. Four, the relationship between the consumer and the controller and the context in which the personal data were collected. And five, the existence of additional safeguards including, but not limited to encryption or pseudo boy, that's a different way of Pseudonymization. Pseudonymization in processing such personal data for such new purpose. So, the businesses that fall that are controllers in Connecticut must take into account those five things when processing personal data unless they get the consent to the consumer. So if they get consent to the consumer, those five things are not you don't have to take those into account. And I assume that would be done by and consent is defined in Connecticut a certain way having the consumer read what they're going to do with the data and opting into that sharing of their processing personal data. So in terms of so actually, this is a good question because I have Connecticut pulled out, and I wanna show you all how they define how they define consent. May not be in this one. I may have to come back to you

[Michael Marcotte (Chair)]: on that.

[Michael Boutin (Member)]: Spoke about a term I said two.

[Rick Siegel (Office of Legislative Counsel)]: You resisting the weekend?

[Unidentified Committee Member]: You know the date,

[Michael Boutin (Member)]: that's right.

[Michael Marcotte (Chair)]: Here it

[Rick Siegel (Office of Legislative Counsel)]: is, okay. So this is Connecticut, this is 2020, no changes in 2025, so they left it as is. So meaning that they get a consumer's consent, right? Consent means a clear affirmative act signifying a consumer's freely given specific and form an unambiguous agreement. By the way, this matches Vermont 2.3. To the consumer, consent may include a written statement, including by electronic means, or any other unambiguous affirmative action. Consent does not include A, acceptance of general or broad terms of use or a similar document that contains descriptions of personal data processing along with other unrelated information. So my answer to you, Rutland, is no. It can't just be terms of agreement. It's got to be more specific than that. B, hovering over. Do you deem pausing or closing a given piece of content? Or C, agreement obtained through the use of dark patterns?

[Unidentified Committee Member]: Can I ask you a question, Rick, on that? Yeah, we're back. So in B there, Connecticut stuff, and I think I grasped all of that. Until we get to the third line after sub subcategory a in the subdivision. Mhmm. And then it goes on taking into account, you know, one to five. Mhmm. I don't so what's the what's the structure, what's the purpose of that modifier? It's a list of modifiers it seems around the controller obtaining consent or what's it modifying? So, I

[Rick Siegel (Office of Legislative Counsel)]: think so one A is a strict limitation, right? That you cannot do this. It must be necessary and proportionate, right? So, B is saying, unless you get consent, you shall not And maybe remove that part, right? So, just say a controller shall not process the consumer's personal data for any material new purpose that is neither reasonably, and I think that's a new purpose is important there, neither reasonably necessary to nor compatible with the purposes that were disclosed in A. So one A, a company disclosed to a consumer, we're gonna use your data for this reason. Right? Yeah. Okay. As long as it's reasonably necessary and proportionate, right? Correct. Can I give an example? Sure. So, I read this from the California regulations, a flashlight app you get on your phone. It's an app that you use to it's a flashlight. The consumer would not expect that app to track them to your location. It's just a flashlight. So the app, when you download it, when you activate it, it may say we use your data for these reasons. Geolocation would not be reasonably necessary and proportionate to that use of that app. Now, b, let's say that you have the app on your device, and let's say the controller, the app publisher wants to change their terms, and now they do want your geolocation data. Would that be would b allow that? I still say no because it still fails a. Right?

[Unidentified Committee Member]: Well, I thought b said, you gotta contain obtain the consent Mhmm. For this new service. Right. So, does one through five add to that concept?

[Rick Siegel (Office of Legislative Counsel)]: I think, let's see what because California has a similar and they give examples and I stole that example from California. I think that's going to help understand the difference between A and B. That's right. It's a good question. It is a good question. This is I think it's new language that Connecticut has added and no other state except California has no regulations. So I think we should look at California too to see how they afford it. Okay. Yep. It's a very fair question. Shall we go to Maryland before California?

[Monique Priestley (Clerk)]: No, I'll do it after you just California.

[Rick Siegel (Office of Legislative Counsel)]: So Maryland, again, their one I in this case, say, from California limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains. There's kind of a variation of Connecticut and draft 2.3. Yep. But then they have, later on in their bill, a controller may not, unless the controller obtains the consumer's consent, process personal data for a purpose that is neither reasonably necessary to nor compatible with the disclosed purposes for which the personal data is processed as disclosed. So that's kind of what Connecticut has, but without the one through five, right? Maryland says, You can't do this without consent. Connecticut says, Yes, but also here's what you should take into account for this personal data processing. Okay, California in their statute is a business's collection use retention and sharing of the consumer's personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed or for another disclosed purpose that is compatible with the context in which the personal information was collected and not further processed in a manner that is incompatible with those purposes. California is different as far as how it's structured. I can't tell you exactly in practice how different these are. But importantly in California, they have regulations that really expand on this. I think it's important to look at those because this is really where the enforcement's gonna be. So I'm looking at, I can share this with Jonathan, this is the California CPPA regulations. It's 127 pages. We call it rulemaking. So this is California rules when it comes to just their Data Privacy Act. So looking at the bottom of page, I'm on page 12 of 127, 7,002 is the section number. The purposes for which the personal information was collected or processed shall be consistent with the reasonable expectations of the consumers whose personal information is collected or processed. The consumers reasonable expectations concerning the purpose for which the personal information will be collected or processed shall be based on the following. The relationship between the consumer and the business. For example, if the consumer and this is what's helpful I think in California they give you examples. If the consumer is intentionally interacting with the business on its website to purchase a good or service, the consumer likely expects that purpose for collection or processing is to provide the good or service. By contrast, the consumer of a business' mobile flashlight application would not expect the business to collect their geolocation information to provide that service. So if you look at this, sorry, this right here, right? This is the key. And if you go back to Connecticut has pieces of California's regulations in statute. So here, Connecticut actually has the relationship that such new purpose bears to the purposes that were disclosed to the consumer pursuant to a, right?

[Michael Boutin (Member)]: Can you go back to Connecticut?

[Michael Marcotte (Chair)]: Oh, sorry.

[Rick Siegel (Office of Legislative Counsel)]: The chart?

[Michael Boutin (Member)]: Yeah. Okay. So is that language the what was what? S 71 was built off?

[Rick Siegel (Office of Legislative Counsel)]: Which version S-seventy one, passed by the Senate? That is passed by

[Michael Boutin (Member)]: the Senate.

[Rick Siegel (Office of Legislative Counsel)]: So S-seventy one has passed by the Senate was based off Connecticut's original Data Privacy Act, which does not include the Yeah.

[Unidentified Committee Member]: So, Connecticut has a consent, consumer consent permission, consented and you can do these things. California does not, right?

[Rick Siegel (Office of Legislative Counsel)]: California is different. There is the baseline data minimization here that you see. It shall be reasonably necessary and proportionate. So, that's in line with these other four, three, sorry. But then they go on, they don't have prohibitions against sensitive data. That's where it's different. California does not inherently prohibit the sale of sensitive data. It gives consumers the right upfront to opt in or out of that information.

[Unidentified Committee Member]: Sensitive, but how about first, how

[Rick Siegel (Office of Legislative Counsel)]: about just generally? I think C is a pretty structural protection for consumers in California.

[Unidentified Committee Member]: Oh, so C is a consent provision?

[Rick Siegel (Office of Legislative Counsel)]: Well, C is their data minimization kind of structural foundation,

[Michael Marcotte (Chair)]: right?

[Rick Siegel (Office of Legislative Counsel)]: That a use retention sharing of consumers' personal information shall be reasonably necessary and proportionate to achieve the purposes for which it was collected.

[Unidentified Committee Member]: I'm sorry, I'm being finished. So, in California, is there either an opt in or opt out provision?

[Rick Siegel (Office of Legislative Counsel)]: It's all opt out. As far as the sensitive data, I think minor data is protected differently, but sensitive data, targeted advertising, that's all opt out. But it's so different because it's a very strict notice that they must provide consumers.

[Unidentified Committee Member]: Thanks.

[Monique Priestley (Clerk)]: Rick, can you go up to Connecticut and highlight I through V?

[Rick Siegel (Office of Legislative Counsel)]: Hit my lap? Okay.

[Monique Priestley (Clerk)]: Thank you. So I had many hours of calls this weekend with Maroney who crafted Connecticut, both the original and Connecticut 2025, as well as the compliance lawyers who provided technical assistance to get him the language of which he based these updates off of, as well as the California team to better understand the regulations piece. So what happens, both politically and policy wise, so the committee knows, is for Connecticut and their 2025 updates, Maroni's goal and intent was to try to create a new data minimization standard that would be based off of California's data minimization. The problem with that, as Rick has illustrated, is that California not only has regulations which have updated things, but also have rulemaking that just continues to create a list. And so at that moment in time in 2025, what he was trying to do is try to take those 125 regulations or whatever and then take the data minimization pieces of that and craft something that could get as close as he could to creating a brand new standard for states that would emulate the levels of protection that California offers in its state of minimization standards. The problem that happened is that he and why some people have heard me say that he broke his standard of what was intended by the people who like I said, both when talking with him and the people who were providing technical assistance is he if you look at the highlighted list, California essentially attaches I through v the one, two, three four, five to both A and B. Maroni attached it only says the subparagraph A. He attached it to A. It's supposed to be attached to both A and B. And that's essentially what the California regulations do, is attach both the collection and use under a disclosed purpose, but also if someone gives consent. So the idea being that if someone's consenting, they have this list of standards. It's not a free for all. But also, if somebody has a privacy policy where they disclose a bunch of shit, that also shouldn't be a free for all. That should also have rules under it. So that's what California continues to do all the time. A state like Connecticut that might not have the ability to keep updating their stuff, that's what he was trying to do for that moment in time. And yeah. Yeah, just want

[Unidentified Committee Member]: Can I zero in on that? Put a five point

[Michael Marcotte (Chair)]: there. I

[Unidentified Committee Member]: think what I'm hearing saying is that Connecticut, somewhere else, Megan, in the statutes and California somewhere in there has a consent both initially

[Monique Priestley (Clerk)]: Connecticut is right there. So the disclosed purposes is A, the consent one is B. And then those rules are supposed to kind of the, I'm calling them rules, but like one through five. Those are clarifiers that are supposed to attach to both A and B in this.

[Unidentified Committee Member]: That's what I meant.

[Michael Marcotte (Chair)]: Yeah. So

[Unidentified Committee Member]: you opt You can got the state of administration standing, but you can always You can still opt out both for the initial collection and for a new purpose under Connecticut and California.

[Monique Priestley (Clerk)]: Think you lost me on that one.

[Rick Siegel (Office of Legislative Counsel)]: I think I got it. Okay. I looked at his words.

[Monique Priestley (Clerk)]: Yeah. Yeah. Yeah.

[Rick Siegel (Office of Legislative Counsel)]: So I think the proposal from rep Priestley is that the highlighted section would be like a so one A, one B, one C, and you would say in the subdivision, reasonably necessary and proportionate shall take into account one through five. Yeah. Exactly. And that way you have a one A which limits the collection, one b if you have you get consent, you cannot do any new purpose processing. And then c explains how businesses can comply and ensure what is reasonably necessary and proportionate. That to me, I don't know if this is broken, but if that's, I think it makes it more clear. I'll say that without thinking too

[Michael Marcotte (Chair)]: much about it yet, but that

[Rick Siegel (Office of Legislative Counsel)]: is my first answer.

[Unidentified Committee Member]: I'm sorry. I'm just zeroing in on the consent issue.

[Michael Boutin (Member)]: Yeah.

[Unidentified Committee Member]: What I'm hearing is that consumer consent would apply to both A and B in Connecticut under the twenty sixth amendment.

[Monique Priestley (Clerk)]: The consent isn't necessarily a thing that interplays with A. It's disclosed purposes. Yeah. So it's like it's just put in the privacy policy.

[Unidentified Committee Member]: Disclosed, but the consumer can't do anything?

[Monique Priestley (Clerk)]: Not necessarily. Yeah. Not necessarily. And B, specifically, what consent

[Michael Marcotte (Chair)]: is giving. There we go. Yeah. Yeah. So

[Rick Siegel (Office of Legislative Counsel)]: it's in a new purpose? Any new purpose that the new

[Unidentified Committee Member]: purpose it can be consented Yes. But not the original question. Correct.

[Monique Priestley (Clerk)]: If I could just additionally expand on the thing that this represents. So politically, we are often told we can't new we can't veer from what other states have done. We need to copy Connecticut. Connecticut twenty twenty five illustrates veering from what other states have done to try to create something that is closer to California. And so I just want to kind of make that point, that we are told we can't innovate and come up with things that are protective of the consumers, veering away from other states of town. Connecticut is demonstrating that they did that in 2025. They are attempting to try to again, he kind of screwed up his references. But his intent was to get closer to where California is.

[Rick Siegel (Office of Legislative Counsel)]: If the committee wants, in the next draft, I can take a stab at that, and you can decide which one. I

[Michael Marcotte (Chair)]: get it. That would really help.

[Rick Siegel (Office of Legislative Counsel)]: Okay, so can I go back to California? So, again, this is California's rule making regulations they call it over there. So, one, we talked about the relationship between the consumer and the business. Two, the type, nature, and amount of personal information that the business plans to collect or process. For example, the business's mobile communication application requests access to the consumer's contact list in order to call a specific individual. The consumer who's providing their contact list likely expects that the purpose of the business's use will be to connect the consumer with the specific contact they select. Similarly, if a business collects the consumer's fingerprint in connection with setting up the security feature of unlocking the device using the fingerprint, the consumer likely expects that the business's use of the consumer's fingerprint is only for the purpose of unlocking their mobile device. So let's Connecticut, the use nature out.

[Michael Marcotte (Chair)]: I don't see that one.

[Rick Siegel (Office of Legislative Counsel)]: Yeah, I don't know if that one is in Connecticut's statute, this specific, and maybe they didn't feel for a reason, but that is unique to California so far from what I can tell. Three, the source of the personal information and the business model method for collecting or processing. For example, if the consumer is providing their personal information directly to the business while using their product or service, the consumer likely expects the business will use that information to provide that service or product. However, the consumer may not expect that the business will use that same information for a different product or service offered by the business or their subsidiary. So I think are we looking at maybe not word for word, but it's California. You can pick and choose what you want if you want to include any of it or the specificity, explosiveness, prominence, and clarity of disclosures to the consumers about the purpose for collecting or processing their personal information, such as in the notice of collect notice at collection and in the marketing materials to the consumers about the business is good or service. For example, the consumer who receives a pop up notice that the business wants to collect their phone number to verify their identity when they log in likely expects that the business will use their phone number for the purpose of verifying their identity and not for marketing. Similarly, the consumer may expect that a mobile app that markets itself as a service that finds gas prices near the consumer's location will collect and use the consumer's geolocation information for that specific purpose when they are using the service. It's just specificity, closeness, prominence. They can not maybe not work forward in Connecticut. Five, the degree to which the involvement of service providers, contractors, third parties, or other entities in the collecting or processing of personal information is apparent to the consumers. For example, the consumer likely expects an online retailer's disclosure of the consumer's name and address to a delivery service provider in order to for that service provider to deliver a product because that service provider's involvement is apparent to the consumer. By contrast, the consumer may not expect the disclosure of personal information to a service provider if the consumer is not directly interacting with the service provider or the service provider's role in the processing is not apparent to the consumer. So, I don't know about any realties, but you can see California's method is not to put in a statute, but to let the Consumer Privacy Protection Agency,

[Michael Marcotte (Chair)]: I think,

[Rick Siegel (Office of Legislative Counsel)]: develop those rules and then

[Unidentified Committee Member]: Yeah, so all these regulations, they're further clarifying and requiring me, or they're clarifying what the controller's use of personal data is. Support. It doesn't It goes

[Rick Siegel (Office of Legislative Counsel)]: talk about consent. It well, it does eventually, but not in this section. Okay. Yes. So, on this document, I have linked that section that's in the regulations that deal with this kind of foundational data minimization. Are there any questions about that? Continue. Let me also skip ahead real quick to show you all. If you go down to the middle of the PDF, I have a side by side, which is a little difficult, but I did my best to kind of show you how in the actual bills, the language and where it is in each bill. So you have S71, one A, one B, talked about that and Connecticut's also is one A, one B. Maryland's is a little bit different and then you have California's statutory no regulation like if you're just statutory. So you can follow along with that if you want instead. Okay, the second piece of data minimization is first party and targeted advertising. So I'm going in the order of s 71 draft 2.3, which doesn't always it's not important. It's not necessarily any reason for that. It's just that's the order in s 71. So subdivision seven in the duties controllers, a controller shall not process the personal data of a consumer for the purposes of targeted advertising or sell the consumer's personal data if the controller knew or willfully disregards that the consumer is a minor. So, that's specific to minors. And the other two states that have this is also specific to minors. However, draft 2.3 also has number two. A controller may process or transfer the personal data of a consumer collected to one, which is what we just talked about earlier. The shall limit what is reasonably necessary To provide first party advertising or targeted advertising to the consumer unless the personal data was sensitive data, the consumer has opted out of targeted advertising, or the controller knew or willfully disregards that the consumer is a minor. Connecticut twenty twenty five, a controller shall not process the personal data of a consumer for purposes of target advertising or sell the consumer's personal data under circumstances where controller has actual knowledge or willfully disregards the consumers at least 13 but younger than 18. Maryland, a controller may not process the personal data of a consumer for the purposes of target advertising if the controller knew or should have known that the consumer is under 18. So, the draft 2.3 again has kind of more language specific advertising that these are the three states. And California is not as clear as far as a limitation. It's all in the consent piece that consumers are allowed to opt out. It's just a different structure and it's hard to compare. So, let

[Unidentified Committee Member]: me play that back to you. So, this is all dealing basically with minors.

[Rick Siegel (Office of Legislative Counsel)]: Except number two and draft 2.3.

[Unidentified Committee Member]: Okay, yeah. Well, except 2.37 talks about minor.

[Rick Siegel (Office of Legislative Counsel)]: Subdivision two beneath number seven. Oh, okay.

[Unidentified Committee Member]: Or is it mine? So for Connecticut and Maryland, those are exceptions to the ability to consume it opt opt or out?

[Rick Siegel (Office of Legislative Counsel)]: Right. Yeah, there's no opting into for minors. Yep.

[Unidentified Committee Member]: Everything else in Connecticut and Maryland, you can't.

[Rick Siegel (Office of Legislative Counsel)]: Right. And so, Drive 2.3, you said you can't, right?

[Unidentified Committee Member]: Exactly. Okay. No, I got it. Right.

[Rick Siegel (Office of Legislative Counsel)]: Okay. And again, I did this over the weekend. California regs may have It's great. There's 127 pages, so didn't have the entire time to figure out what California can do. But again, it's going to be an opt in, opt out situation.

[Monique Priestley (Clerk)]: Just add the lack of opt out on the minor pieces that a minor generally was that a minor can't sound like yeah. Yeah. It was something he struggled with in Connecticut.

[Rick Siegel (Office of Legislative Counsel)]: Data security, these are mostly the same in all four. Drive 2.3, control which shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the data issue, including disposing of personal data in accordance with a retention schedule that requires deletion of personal data when the data is required to be deleted by law or is no longer necessary for the purpose for which the data was collected or processed. Connecticut establish, implement, and control which shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data issue. Maryland, establish, implement, maintain. It is word for word Connecticut. I'm looking at the two. California, a business that collects a consumer's personal information to implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction use modification or disclosure. So draft 2.3 includes, including this text appears to be

[Michael Marcotte (Chair)]: This one.

[Rick Siegel (Office of Legislative Counsel)]: This here is not word for word that I could find in the other two. Three. Okay, processing and selling sensitive data. Two different things. Processing sensitive data is one thing, collecting it is one thing, selling it is a separate thing, but they are combined in some of these states. I put them in the same chart. So draft 2.3 shall not collect or process sensitive data concerning a consumer except when the processing is strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the sensitive data pertains. And then there's a just ban on the sale of sensitive data in draft 2.3. Connecticut shall not process sensitive data concerning consumer unless it is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent or if it's a child without processing in accordance with COVA. H is a opt in. So the consumer can opt in to the sale of sensitive data. Maryland, a controller may not accept where the collection or processing is directly necessary to provide or maintain a specific product or service requested by the consumer to whom it pertains, collect, process or share sensitive data concerning a consumer. And Maryland also has a ban on the sale of sensitive data. California is, I put it here because I think it's important, but again, it's different. A consumer shall have to write at any time to direct a business that collects sensitive personal information by the consumer to limit its use of that information to which is necessary to perform the services or provide the goods reasonably expected by an average consumer. Business keeping down a business that uses or discloses a consumer sensitive personal information for purposes other than those specified shall provide notice to consumers that it may be used, disclosed to a service provider or contractor for additional purposes and that consumers have the right to limit the use or disclosure. So it's not a ban, it is a opt in, opt out excuse me, opt out in California, which again their model is totally different. So the consumer is

[Michael Marcotte (Chair)]: going to get

[Rick Siegel (Office of Legislative Counsel)]: a kind of initial request as to how their information should be handled, and the consumer makes those decisions based on that initial opt out. Yeah,

[Unidentified Committee Member]: just replaying. So, Connecticut has an opt in for sensitive data. California allows an opt out, permits an opt out. And 2.3 in Maryland, say, just can't. Oh, you can't sell

[Rick Siegel (Office of Legislative Counsel)]: or Can't sell. Processing is allowed in both, but they're actually pretty similar that they must it's be strictly necessary to provide or maintain a specific product or service.

[Unidentified Committee Member]: Yeah, but yeah, okay. It's just not to be a sign of your consent. It's

[Rick Siegel (Office of Legislative Counsel)]: up just, to the controller to make that determination. Is this a reasonable, in relation to what they want? Is this processing of their data, sensitive data needed for this specific product or service?

[Michael Boutin (Member)]: Should I assume that when it says Connecticut twenty twenty five, it's not what was passed by the Senate. Correct? Right. And I haven't gone through, but is there any data minimization that's from that was passed? Or is this own stuff that came out after the Senate meeting?

[Rick Siegel (Office of Legislative Counsel)]: You know what, actually, I'm going to share this with Jonathan as well. So if you go to Connecticut's bill from last year, it's a markup. So you underline like our style, underline meaning it's new. I think brackets means it's removed, which is different than what we do. So if you go to page Here we go. Alright, page 37. This is their duties and controllers. And you can see that their A1 is different, has been changed. And then you see all this that Brett Priestley talked about, adding the California regulations as best. They tried to do that. Their data security didn't change. Sensitive data did change. So you can see here, Previously does not process sensitive data concerning the consumer without obtaining the consumer's consent or if it's a child without processing it in with COPA. So they added some protections, this fraud sensitive data. It's now that recently necessary in relation to the purpose. So yes, can see what they Some of it is only 2025, but some of it's also brought over from their initial bill. Okay, discrimination. Draft 2.3, a controller shall not collect or process personal data in violation of the laws of the state and federal laws that prohibit unlawful discrimination. And also subdivision nine touches on discrimination, shall not discriminate against the consumer for exercising any of their rights contained in the sub chapter, including denying goods or services, charging different prices or rates for goods or services or providing a different level of quality of goods or services. Connecticut not processed personal data in violation of any law of the state that prohibits lawful discrimination against consumers and any evidence, lack of evidence concerning proactive anti bias testing or any similar proactive effort to avoid processing such data in violation of such law. They love the word such in Connecticut. Such a pain. It's actually, you overuse it. Including but not limited to any evidence or lack of evidence concerning the quality, efficacy, recency and scope of any such testing or effort, The results of such testing or effort and the response to the results of such testing or effort shall be relevant to any claim available for a violation of such law and any defense available thereto. And then they separate out the federal law, which 2.3 combines. Dile process personal data in violation of any federal law that prohibits unlawful discrimination against consumers. Maryland three is the same as five, basically actually it's process and not collector process, just process. Six, discriminate against the consumer for exercising a consumer right contained in the subtitle and including denying goods or services, charging different prices or rates similar to draft 2.3. And then unique to Maryland, collect, process, or transfer personal data or publicly available data in a manner that unlawfully discriminates and or otherwise unlawfully makes available the equal enjoyment of goods by various protected classes. Again, unique to Maryland. California, a business shall not discriminate against the consumer because they exercised any of their rights by denying goods or services, charging different prices, providing different level quality of goods, suggesting the consumer will receive a different price or retaliation against an employee because of exercising their rights. So not huge differences there between the states. Revoking consent. Draft 2.3 shall provide, a controller shall provide an effective mechanism for a consumer to revoke their consent that is at least as easy as the mechanism by which they provide the consent. And upon revocation of the consent ceased to process the data as soon as practicable, but not later than fifteen days after receipt. Connecticut provide an effective mechanism for a consumer to revoke consent that is at least as easy by which they provided the consent and upon such revocation, it's fifteen days as well. Very similar. Maryland, a controller shall provide an effective mechanism for a consumer to revoke their consent that is at least as easy as by which it was provided. There's no time there. California, the consent webpage also allows the consumer or a person authorized by the consumer to revoke the consent as easily as it is affirmatively provided.

[Unidentified Committee Member]: That was an easy section. Right.

[Rick Siegel (Office of Legislative Counsel)]: I think there's

[Michael Marcotte (Chair)]: a lot

[Rick Siegel (Office of Legislative Counsel)]: of path forward on consent, revoked consent. Okay, selling processing miners data. So, some of these came from the earlier targeted advertising I brought it back over, Fitbit applied. So, 2.3, a controller shall not process the personal data of a consumer for the purposes of targeted advertising or sell the consumer's personal data if the controller knew or willfully disregards the consumer is a mire. Connecticut, not process sensitive data concerning the consumer unless it is reasonably necessary in relation to the purposes for which the data are processed and without obtaining their consent. Or in the case of a child processing in accordance with COBRA. Shall I process the personal data of a consumer for purposes of target advertising, this is still Connecticut, or sell the consumer's personal data under circumstances where a controller has actual knowledge or willfully disregards the consumer is at least 13 but younger than 18. In Maryland, the controller may not process the personal data of a consumer for the purposes of targeted advertising if they knew or should have known that the consumer is under 18. May not sell the personal data of a consumer if the controller knew or should have known that the consumer is under the age of 18. California, a business shall not sell or share the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 unless in the case of consumers at least 13 at less than 16, or if the consumer's current or guardian, or in the case of consumers who are less than 13, has affirmatively authorized the sale or sharing of the consumer's personal information. A business that willfully disregards the consumer's age shall be deemed to have had actual knowledge of the consumer's age. What's the distinction between new or should have known that the consumer is 18 years of age and has actual knowledge that the consumer is less than 16 years.

[Michael Marcotte (Chair)]: What are the standard? Yeah.

[Rick Siegel (Office of Legislative Counsel)]: So, you know, actual knowledge is having the awareness that this consumer is 18, either by ID verification, basically, maybe they intent when they registered, they put their birth date, that makes them 18, right? That would be actual knowledge. New or should have known includes knowledge, actual knowledge, but also includes were there signs that you should have realized this person was a minor. It wouldn't be their birthday necessarily, that would be actual knowledge, but it would be other information inferred about that consumer that would lead a reasonable business to know this person is a liar. So, it's kind of a, I say subjective, but it's going to be what a reasonable business who's doing reasonable work and due diligence understand that this consumer is a minor? I wish I could define it better, but that's it's a it's a legal term that is up to a judge or jury to determine should you have known. Follow-up if I may. If the known or should have known, is that just based on data that is exchanged by that customer and or could that be coming from some other source later on? It depends. The business would have to show in discovery what information they had about this consumer, right? Or probably a lot of consumers, right? That if the company for some reason is charged with violating a data privacy law because this bucket of consumers, you should have known these reminders, right? Because of x y z. And that could be data analysis, it could be traffic analysis on your website, it could be patterns on your website. There's things that businesses have used to track their visitors in addition to actually asking for a date of birth. That's one easy way that a business could verify that someone is of a certain age. But it's tricky when they are not in person, right? These are virtual visits. But there are tools businesses have that help them understand that. I would think the

[Unidentified Committee Member]: data minimization standard should further complicate that because now you need to have a reason to ask for the date of birth.

[Rick Siegel (Office of Legislative Counsel)]: Alright. I'm gonna about to show you kids code, may be helpful actually for this because that's a law that you all passed last year takes effect in January. So I actually have that just for this one because it involves minors. So one thing to keep in mind here is that a cover business is not the same as a controller. A covered business in kids code is a business that meets certain standards. They have to make a majority of their revenue from online sales. It's not going to be a business with a storefront. It's likely going to be an online website or app. So let me read what the age appropriate design code says about data privacy when it comes to minors. A covered business shall not, one, collect, share, retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged. Two, use previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected unless necessary to comply with any obligation under this

[Unidentified Committee Member]: chapter. So,

[Rick Siegel (Office of Legislative Counsel)]: you probably want to be careful when you are a regulated minors in this bill that you're not conflicting with the kids code law. And you'll have to determine what you want the policy to be, whatever that turns out to be. Currently, it is shown out of process personally to consumer for targeted advertising or sell their data if the controller knew or willfully disregards that the consumer is a minor.

[Monique Priestley (Clerk)]: So I add the definition for kids go to the actual. Let's when you look at covered minor.

[Rick Siegel (Office of Legislative Counsel)]: Who cover minors? Right?

[Michael Marcotte (Chair)]: Yeah. Yeah. Yeah. Right.

[Unidentified Committee Member]: Oh, that's in Biden?

[Monique Priestley (Clerk)]: No. It's it's in statute. It's in Different section. Different section.

[Rick Siegel (Office of Legislative Counsel)]: Oh, the AG is given rulemaking.

[Unidentified Committee Member]: I was wondering if they had strict liability.

[Monique Priestley (Clerk)]: Right. The AG has given rule making.

[Rick Siegel (Office of Legislative Counsel)]: I'm not sure why believe that. But the AG has given rule making to help businesses determine age because that is that is it is complicated. Like, that is something that is an issue It is determining how old a visitor consumer is when you can't see them. Okay, so that's for the major data minimization piece. That's the comparison between Vermont 71, 2.3, and those other three states. And then you have side by side, which I already went over these, but it might be helpful to see this in a different way. Same information just displayed in a table. I try to line it up, not always exactly perfect.

[Unidentified Committee Member]: Oh,

[Rick Siegel (Office of Legislative Counsel)]: sure. But you can see here, like the sensitive data piece, it's different in all of the states. It's eight in 2.3H in Connecticut, two in Maryland, and then C in California.

[Unidentified Committee Member]: Just a question. Every time we see consent in Connecticut, it's that expressed consent, right? That's what we talked about

[Rick Siegel (Office of Legislative Counsel)]: at the beginning? It's not expressed consent. It's unambiguous because Unambiguous. Yeah, expressed consent and genetic data privacy is very, very restricted. It must be, I can pull

[Michael Marcotte (Chair)]: it below if can look at it, but I'll go back

[Unidentified Committee Member]: Unambiguous consent.

[Rick Siegel (Office of Legislative Counsel)]: Yeah.

[Unidentified Committee Member]: So it's a relatively high level. It's not a buried in policy level, right?

[Rick Siegel (Office of Legislative Counsel)]: I mean, that's probably more, that maybe not something I can answer, but to me this definition is more than just a terms of service that you would just click a box. If you want actually, if you go to a website that has California's practice in place, you'll see a Well, lot of websites actually I 'm talking about California too as far as their consent piece. Connecticut hasn't taken effect yet, so they may not be compliant, right? Places in Connecticut. But I think one way to see how this looks is a website that is in compliance with California, and you'll see a very clear opt, in that case opt out, notice to consumers of all their rights that they have. Not every website does it the same, but I think it's very clear that it can't just be a checkbox and you're done. It's gotta be more than that.

[Michael Marcotte (Chair)]: Yeah.

[Unidentified Committee Member]: And there's some stuff you can you know, I've seen this in other things. I mean, you can instead of a checkbox, you can say, well, you have

[Rick Siegel (Office of Legislative Counsel)]: to type I agree, or you

[Unidentified Committee Member]: have to type yes, all caps, or something like that. Something to get the consumer out of that. Just get me through this mode, you know?

[Unidentified Committee Member]: Yeah, my question is around the law and how it's written and what it requires, So if the law requires that or not is my question.

[Rick Siegel (Office of Legislative Counsel)]: Think it needs to be something so I look at what consent does not include, an acceptance of general broad terms of use or similar document that contains descriptions of the personal data along with other unrelated, so it can't just be a general privacy notice and terms of use. It's gonna have to be something specific to how we can delete the data. And it still may be hard to read. It still may be something that a consumer is gonna just like, I don't care. I don't wanna read this. This is fine.

[Michael Marcotte (Chair)]: I don't

[Rick Siegel (Office of Legislative Counsel)]: care what to do with my data. But it does need to be something that looks different than your normal terms of use that people sign.

[Michael Marcotte (Chair)]: Would it when we look at the list, I'm looking at Connecticut. So the specifics of of consent. So would it be you check a box if I want if I'm allowing you to use my personal sell my personal data? Or would it be everything in one checkbox?

[Rick Siegel (Office of Legislative Counsel)]: Good question. I may defer to other witnesses who can tell you how that looks in the field, but I think the law as 2.3 is structured, obviously you can't sell sensitive data, right, under 2.3. So if you were to go with the Connecticut option, which you could with consent, could that be lumped in with other targeted advertising? I think that may not be the best example, because 2.3 has regulations on targeted advertising. I think it's unclear. And I think what you want needs to be clear. Like if you want these things to be structured a certain way, you should be in the bill that you want this to be X, Y, Z, right?

[Unidentified Committee Member]: Yeah, just following up on that, came in thinking, well, it's two types of consent. You can opt out, you get flows and you opt out. I guess that's consent, some implied consent, I guess. But then you have, well, express consent is where you actually affirm it. Yeah, like we did with the genetic test. I guess I'm coming to the conclusion that there are nuances and grace between the two poles, based on some of the material that you put up there.

[Rick Siegel (Office of Legislative Counsel)]: Yeah, just for fun, if you want, this is six thirty nine, the genetic data privacy. So this is Expressed. Yeah, consumers affirmative authorization to grant permission in response to a clear, meaningful, prominent notice regarding the collection, use, maintenance, or disclosure of genetic data for a specific purpose. Expressed consent cannot be inferred from an action. Agreement through the use of dark patterns is not constitute. That's actually pretty similar.

[Unidentified Committee Member]: But it's not opt out. In other words, you can't just get a disclosure. And if you don't do anything, can do that. They can pass. Under the genetic data.

[Rick Siegel (Office of Legislative Counsel)]: Right. Right. That that that is an opt in.

[Unidentified Committee Member]: Maybe under some of these other states. Can't figure out which.

[Rick Siegel (Office of Legislative Counsel)]: Actually, I'm looking at Connecticut here.

[Unidentified Committee Member]: There's

[Rick Siegel (Office of Legislative Counsel)]: not a whole lot of difference between the two.

[Unidentified Committee Member]: Okay, yeah, that's what confused me, the fanatical. Because it's clear, affirmative act as opposed to implying after he disclosed.

[Unidentified Committee Member]: So this would be, just putting it out there, the kind of thing that to make it align with Vermont law, we would call it express consent, even if Connecticut doesn't, so that it aligns with a different law.

[Unidentified Committee Member]: Something doesn't.

[Unidentified Committee Member]: Even if it's, so right, like, so we're looking at, if we want to adopt something that's very close to Connecticut, we might call consent, express consent, because it lines up with genetic data privacy, even though the definition is the same between the two states. I call it something else. So that's logical? Just confirming my thought process.

[Rick Siegel (Office of Legislative Counsel)]: Well, think I've reached the Oh, one more thing I want to show you all. At the bottom of this chart are the limitations. They're pretty similar. So this is at least in draft 2.3 Connecticut and Maryland. These follow the data minimization subdivisions. So this is talking about how it should not be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain. And then Connecticut adds in yeah, this one and two are combined and two in Connecticut. Same thing with Maryland. So just wanna make sure I'm not missing anything. This here. Maryland has that. So at the end of the limitations, a controller shall not be construed to prohibit a controller from etcetera, etcetera, provided that the selling of the personal data is not a condition of participation in the program. I believe that is just Maryland has Epidot Connecticut. So that's my little comparison just of the data minimization pieces.

[Michael Marcotte (Chair)]: So let me get this straight.

[Unidentified Committee Member]: S 71 is passed by the Senate was based on what version of the Connecticut laws.

[Rick Siegel (Office of Legislative Counsel)]: As they passed originally passed at 2020, 2022.

[Unidentified Committee Member]: But not 2020. Right. Correct.

[Michael Marcotte (Chair)]: Connecticut 2025 takes effect in July. Right. Is very general than looking at how they would apply the consent, consumers' consent.

[Unidentified Committee Member]: I don't know.

[Michael Marcotte (Chair)]: Yeah. They can ask you. No. You can't lump everything together yet. There's provide thoughts for each different

[Monique Priestley (Clerk)]: I'm talking with him at four.

[Rick Siegel (Office of Legislative Counsel)]: Did I mention Connecticut there is a 2026 bill that makes some changes, but not to that piece about one through five. Yeah. No. Didn't. That's not been amended yet. It's also not taking effect. So as you've waiting

[Abbey Duke (Member)]: for it No.

[Unidentified Committee Member]: It hasn't signed. It's yeah.

[Rick Siegel (Office of Legislative Counsel)]: I mean, the 2025. Maybe don't fix that for that, but the 2026 changes are not going be if it passes, it will not be as substantial as the 2025 changes.

[Michael Marcotte (Chair)]: We can make sure that don't mind giving consent, King of Connecticut I'm fine with that, I want to make sure that we're not lumping everything together, that we just check one box and means that you can now sell sensitive data.

[Monique Priestley (Clerk)]: I mean, I I would like to go personally, I'm just as far when it comes to the sale of sensitive data, feel like that's one of the riskiest things that are out there, especially with the consent piece. And multiple states this year have passed, including Connecticut, passed in the very Maryland did the ban on the sale of sensitive data, hard stop, as Rick showed, but other states have also been moving towards that, but more specifically, a straight up ban, including Connecticut on the sale of precise geolocation data in particular, too, for stocking.

[Unidentified Committee Member]: So I heard what you're saying. You're talking about it can't be just one box. Right?

[Michael Marcotte (Chair)]: Even if it's separate from regular disclosures that a company provides, it should be something that's separate. Then in my mind, then we're not gonna lump all of

[Unidentified Committee Member]: those separate consents that are in there into one box either. Right, and once you start that kind of construct, and you sort of itemize, I guess, the different activities that you're consenting to, then it's looking kinda like an opt in with, you have a list and the control can do all these things, if the consumer says, Yeah, you can do that specific activity, sounds a lot like what we did with genetic data. And I'm also wondering, I'm particularly concerned about sensitive data. I will get into general discussion, but I could see a distinction between what kind of, how strict do you want that consent to be especially stated, and maybe a different standard for data that we think is really important, which is other data that's important, but maybe not quite.

[Michael Boutin (Member)]: We heard

[Abbey Duke (Member)]: testimony from a witness about the AG in Maryland and issued guidance about how they're doing of the data minimization standard in Maryland, and they were enforcing it more like the California standard. Do you know anything about that?

[Rick Siegel (Office of Legislative Counsel)]: I don't, but I can get

[Unidentified Committee Member]: back to you. Are you saying that they have had some enforcements? Well, testified that they've done a guidance, that the AG has issued a guidance. Does anyone else remember that?

[Unidentified Committee Member]: I've been trying to Google it if

[Abbey Duke (Member)]: you haven't been able to. But trying to find something to do a little research, so yeah.

[Rick Siegel (Office of Legislative Counsel)]: Can see if I can find it.

[Abbey Duke (Member)]: There were discrepancies questioning the, you know, the visibility, I can't remember, that they were forcing more light kelp.

[Michael Boutin (Member)]: But I didn't find that I didn't

[Monique Priestley (Clerk)]: look super hard, but I

[Abbey Duke (Member)]: didn't find the garden. That maybe

[Michael Marcotte (Chair)]: I've made up dust in my nose throughout the country.

[Michael Boutin (Member)]: What other states around us have a Parkinson's disease? Maine? No, Maine isn't. Not? New Hampshire. New Hampshire or the brain?

[Rick Siegel (Office of Legislative Counsel)]: My brain is focused on these.

[Michael Boutin (Member)]: Is there any particular reason why we didn't do a comparison with Mid Hampshire or Rhode Island? So my guess is those data privacy are probably That's true. In Connecticut. Yes. Is that correct? So one of the concerns that I have been having with this whole conversation is about pushing the over to And it would be nice to see the comparison for those, one number. But for Maryland, which I know is stronger, and Connecticut is obviously stronger than what we passed in the Senate, And California, same thing. And of course, 2.3 is also stronger than what was passed in the Senate. And I just it would be nice to see that comparison, but as one person.

[Michael Marcotte (Chair)]: Little New Hampshire, Rhode Island basically being out of here.

[Monique Priestley (Clerk)]: Basically, the original starting point.

[Michael Boutin (Member)]: But we didn't even get Yeah. Okay.

[Monique Priestley (Clerk)]: Except New Hampshire's 25,000.

[Michael Marcotte (Chair)]: But

[Michael Boutin (Member)]: they don't push you over with a sensitive tag, though, do they?

[Monique Priestley (Clerk)]: No. I mean, I I would say, like, Connecticut, if an if businesses have even one piece of sensitive data and or sub personal data, they will have to comply with Kinetics starting July 1. So they yeah.

[Unidentified Committee Member]: Mindful of rich time.

[Rick Siegel (Office of Legislative Counsel)]: Have nothing else to do with him.

[Unidentified Committee Member]: Don't say that. But if

[Unidentified Committee Member]: we do some more comparisons,

[Michael Marcotte (Chair)]: I think I have a

[Unidentified Committee Member]: fairly good idea of how 2.3 compares to the Senate passed bill, but sometimes it's hard for me to figure that out. It's whatever everybody wants.

[Michael Marcotte (Chair)]: Do you

[Monique Priestley (Clerk)]: have a red line? A red line on

[Rick Siegel (Office of Legislative Counsel)]: the website. I didn't walk through the differences, but there's a literal highlight red line.

[Unidentified Committee Member]: That's right. That's

[Rick Siegel (Office of Legislative Counsel)]: fine. I understand it's not without context, it could be hard because the bills are not aligned exactly. Sometimes the I can use that.

[Unidentified Committee Member]: Sometimes it's nice to get them grouped by scenes, I guess, like you

[Rick Siegel (Office of Legislative Counsel)]: did.

[Michael Marcotte (Chair)]: Right, right.

[Rick Siegel (Office of Legislative Counsel)]: If this were a 10

[Michael Marcotte (Chair)]: page bill, boy, how close do you have? This

[Rick Siegel (Office of Legislative Counsel)]: is not a 10 page bill. But I think, yeah, the question is, as someone has passed by the Senate, the difference between that and 2.3 are a lot. I mean, there are several differences. I will say 1.3, the walkthrough in May, much different than even 2.3. 2.3 is closer to S-seventy one as passed by the Senate. Again, they're not equal, but if you're comparing 1.3 to 2.3, 2.3 is closer to the original s 71. So it's really what you all wanna do. That's what it comes down to.

[Michael Boutin (Member)]: Soliciting opinions on this? I think it's pretty clear what I want. But don't mind sharing my thoughts. But I think we should be a little closer to the way that it was put out through the Senate. I understand that people are going to say, we'd rather have nothing, which I would contend that that's not, to me, just doesn't make good sense for policy. I think being outside of going beyond certainly what Connecticut has done, I feel, you know, we're such a small state. I don't know if that's a great idea. New Hampshire has the original Connecticut and apparently Rhode Island as well. I just think that being such a small state, we probably shouldn't be making it difficult. But that's just my opinion.

[Unidentified Committee Member]: I'm not at that point yet. So, in terms of making the choice, that's why I'm trying to get my head around, that's why I think what Rick did this morning was really helpful. And I've read the Senate bill a lot, and tried to compare it. So I'm just trying to get in my head what the differences are, and then I'll make a decision.

[Michael Boutin (Member)]: I'm not saying I'm ready to make a decision. I just think that I feel like we're doing committee discussion conversation. I'm sorry. No problem. I just feel like the push has been for a more restrictive bill and that's my opinion, that's the way I feel, but I'm more than willing to have the conversation of meeting somewhere between the really restrictive and what we have in New Hampshire, New Jersey, and what was Connecticut. Yeah,

[Unidentified Committee Member]: I'm not into restrictive or broader or less restrictive. I'm into what's going to be effective. Given what we know about the practices. So that's where I'm coming from, what's going be effective. That's why I'm trying to get my head around, what the different models are.

[Abbey Duke (Member)]: I guess I'm pretty aligned with Rick Wheaton. I'm uncomfortable with us doing anything novel. So I'm definitely interested in learning and talking more, but it's I mean, my thinking right now is that the prudent direction is essentially the Connecticut the has passed the Senate with with maybe some or all of the Connecticut updates. But I'm really concerned about unintended consequences of a very small state doing anything normal.

[Monique Priestley (Clerk)]: I have a clarifying question. What you guys are saying are two very different things as far as Connecticut as passed so the version that passed by the Senate versus Connecticut updated at 2025.

[Abbey Duke (Member)]: I think we consider the updates.

[Michael Boutin (Member)]: Yeah.

[Abbey Duke (Member)]: Right? Which, I mean, looking at this and just really understanding, I would want more testimony and really understanding what are I mean, hasn't gone into effect yet. And so I would want to understand what the potential intended and unintended consequences would be. From the beginning and the whole time, I'm just very concerned about us doing anything novel and leading. Vermont can lead on a lot of issues. I just don't think this is one of them.

[Michael Marcotte (Chair)]: Think at the same time, we should be examining this 18 or 20 other states out there right now that have privacy laws that we should be learning from their mistakes as well.

[Abbey Duke (Member)]: Agreed, agreed. I just think we have to be careful.

[Michael Marcotte (Chair)]: Yep, we agree.

[Unidentified Committee Member]: So I'm very much with Abbey. I like the way it looks on the Connecticut, the revised Connecticut belt. Of course, my big issue here has been about consent, about that choice. We don't make tobacco products illegal because people are making bad decisions to smoke. If people want to sell their data to get a deal or whatever like that, I don't think it's our right to tell them they shouldn't. I think we need to tell them, hey, what you're doing, just like you do with tobacco, you say, hey, this is bad for you. But if you want to do it, it's your life. But I also want to touch on what you had talked about, and I think that there needs to be some thresholds. I can see different tiers and take it as it is. But there's the data that's necessary. And that, I mean, it's incentive is implied. If I buy a product, you need to take a credit card number. And then you have additional data that maybe isn't necessary, but might be useful for a better user experience. An example is Netflix. If I sign up on a new account with Netflix, well, you don't have to collect what types of movies I like. It's not necessary to provide the service, but it sure make my life easier. And then even in perhaps a higher tier for what we would call sensitive data, Something that would be more than just a checkbox to opt in, but something a little more lengthy, like I consent to you using my sensitive data. Something you actually have to type out to get, because the one argument I do see in favor of what a lot of people are talking about, people being too busy and things like that, I think it's a valid point, because you get, especially you get all excited, you want to use this product or service, and you just want to push through, and you're not fully thinking things through. So, I think especially when you're dealing with sensitive data, having that extra layer of protection to say, hey, you're talking about personal sensitive data here, are you sure you really want to do this? As far as the selling, I'm on the fence on that. I could go either way. I certainly don't have a problem with companies selling sensitive data as long as the consent is there, but I also see an argument for not doing that at all, and I

[Rick Siegel (Office of Legislative Counsel)]: could go either way there.

[Unidentified Committee Member]: And I felt so over the weekend, I was thinking kinda similar thoughts, in terms of the sort of normal regime and what the way Connecticut used to be before these recent amendments. Seems to me they had a data minimization kind of standard. I mean, that's not all that controversial. It's how you can what are the exceptions? And the traditional exception is what you disclose to the consumer, and they can they can opt out. And I'm in line with you in terms of there might be some data, call it sensitive, you know, whatever that list is supposed to be, where you might want sort of the express individualized or specific or whatever opt in consent. And I think that's important for whatever list we think is appropriate for the sensitive data to have that level of protection. That's about it. Was thinking about what you were saying last week, and that's where I ended up.

[Unidentified Committee Member]: Yeah, and I agree with Monique. The data minimization standard needs to apply. It doesn't matter whether it's implied consent, consent, or sensitive data. That data minimization should be a guiding principle.

[Unidentified Committee Member]: And maybe there's some sense of, I mean, some of this stuff, I don't know. Maybe there should be a ban, some of that stuff. Will keep that open.

[Rick Siegel (Office of Legislative Counsel)]: If I can speak to sensitive data. So the draft 2.3 bans a sale of sensitive data, as does Maryland. Connecticut does not consent. But if you look at Connecticut's processing of sensitive data, it's actually stricter than draft 2.3. So draft 2.3 is talking about sensitive data. Draft 2.3 says shall not collect or process sensitive data concerning the consumer except when the processing is strictly necessary to provide or maintain a specific product service requested by the consumer. So, there's no consent piece there. You were talking about how maybe there should be consent to collect a process. Well, you would actually want to make it straight. So, I'm just saying that we need to understand what we're doing here. So, this chart is helpful, but there's a lot going on. And I think the more we bring in California, Connecticut, Maryland, Rhode Island, whatever the states are, this is gonna get confusing. And I just want the committee to be aware of what are some things you really want? Like what are, maybe ignore the other states for a second, and just what do you want? Like what do you want Vermont to look like? And I hear that it's a small state, right? All these things, that's fine, but I think at some point, just you gotta think about just Vermont, so we're not getting confused with, Connecticut is different. And I don't think it's, that's where the best lawmaking to just rely on other states. And then we're gonna have a mix of states and that's not great either. So I don't know, that's my pitch for do what you think is best and then maybe not always compare it to other states because it's gonna get confusing. I

[Michael Boutin (Member)]: mean, I think that is helpful. Again, that Overton window, where I feel it should be is between what passed the Senate and what Connecticut has in force. And then we talk about the stuff in between. That's my

[Monique Priestley (Clerk)]: I have a question, Michael. So just the rationale for starting behind the protections that Connecticut is offering, Why would we start from a baseline of being less protective? And also addressing things that maybe they fixed because they weren't quite working. Why would we start from a base that's less than where they are now?

[Michael Boutin (Member)]: Because I don't think we should, like Abbey said, I don't think we should be leading on this. We're a small state, and I'm Kirk said, Rhode Island and New Hampshire are more closely aligned to what Connecticut, which is S71 has passed by the Senate. And I do think it's important for businesses to feel comfortable with what we're doing, especially in light of every single time they talk, they talk about regulations, and this would be an additional regulation. I just, to me, that's where I feel comfortable with, and I feel comfortable with my data in general. We had the conversation about TikTok this morning.

[Michael Marcotte (Chair)]: I

[Michael Boutin (Member)]: formatted my entire Galaxy tab just so that I could create a TikTok account because I don't want it mixing with my other stuff. You know, I know how to deal with that. And I just think that that's where I stand, I guess.

[Monique Priestley (Clerk)]: I guess I still didn't hear though, for if we're trying to match a bill that Connecticut passed a year ago, we wouldn't be leading, we'd be catching up. Why would that not be the base? Catching up to where they were a year ago versus?

[Michael Boutin (Member)]: But I'm not sure that I want to be where they are.

[Monique Priestley (Clerk)]: That's that's. Yeah, no, that's that's wondering.

[Michael Boutin (Member)]: I'm sorry. I just because just like, you know, I think of clearer, more easier thing to think about is like raise the right. Like I am completely on the opposite side of a lot of people on that. And I think that this is kind of like that. I'm not with the higher protocols.

[Monique Priestley (Clerk)]: That's Even though our businesses will have to comply like, lot of them, if they have been in a single piece of, like, sensitive data that is defined in Connecticut, will have to comply with their law. So this is why I'm talking about with Apple to Window.

[Michael Boutin (Member)]: But I'm talking about 2025. And I'm talking about on this side, you got 2025, and on this side, you got the senate. Let's meet somewhere in the middle and have those conversations about which ones we wanna pick from.

[Monique Priestley (Clerk)]: Even though the businesses have to be at the 2025 side Nope. On July 1. That's No. That's not saying even though. Masking block.

[Michael Boutin (Member)]: But that's not what I'm I'm sorry. I I'm not I'm not being clear, so I'm getting it. So what I'm saying is that we tailor our conversation within that what I want our window to be, which is on this side, you've got the more restrictive Connecticut and you've got this side, which is the 71 is passed by the Senate. I think we should tailor our conversations to pull from both to find out where we want to be within that window.

[Unidentified Committee Member]: Yeah. I think I I mean, I'm okay with that framework for maybe a lot a lot of reasons. I know you you you would prefer to have that 2020 version Connecticut. I see a lot of the more recent provisions in Connecticut as being very helpful because I'm a little more than you are about data. But that in terms of a framework, I'm okay with that discussion because I could pull from, you know, the the more recent ones to say, jeez, that's a really good idea. And you might say, well, no. It's not a really good idea.

[Michael Boutin (Member)]: Right. It's meeting in that middle. And who knows? Maybe through the conversation, we're like, everything on 2025.

[Unidentified Committee Member]: I'm sure I can persuade you of that.

[Michael Boutin (Member)]: No. No.

[Michael Marcotte (Chair)]: It's just

[Rick Siegel (Office of Legislative Counsel)]: Connecticut 2025 been in place long enough to have any real world history of implementation snafus or implementation history, period or enforcement? July 1.

[Abbey Duke (Member)]: It was in due effect on July 1.

[Michael Marcotte (Chair)]: Sorry.

[Unidentified Committee Member]: They passed the bill in 2023, and they've already put some corrections from that. So we do have some data Two to work years, correct.

[Unidentified Committee Member]: To be fair, I don't think that anything that we put in place could go into effect at July 2026. Anything that we choose to move forward is going to have an effective date farther down the road for businesses, for individuals, for everyone to get ready for that. So, we will have time before it goes into effect to see what happens.

[Rick Siegel (Office of Legislative Counsel)]: Strike that passage. That leaves 07/01/2026, so that's, I'll circle that. Cross passage.

[Michael Marcotte (Chair)]: We posted eighteen to twenty four months. To Michael's point, I

[Unidentified Committee Member]: feel like it doesn't make sense. If they put out a car, brand of car last year, and they found out that it had a technical issue with it, and they said, this year, we're going to update it. If you then said, well, I only want everybody to make cars like that previous edition, They've already identified errors that they wanted to update and fix. And so to me, point two five, they in a thing, they found problems with it, they corrected it. So I feel like that should be a part of our foundational piece. I also feel like we need to make sure that everything we do fits with what we have already all the rest of our Because we don't want to make laws that are going to contradict laws and create more confusion. And when we talk about wanting to be similar, to have a cohesion, a regional cohesion, what we see is that Connecticut twenty twenty five is how we get into start moving toward that cohesion. You can't say that, well, we'll just go back to all the other ones because almost certainly all those other ones are going to start seeing the holes in the problem, too. So I don't see us as being innovators moving forward, doing anything radical by just trying to keep up with the technology and keep up with the current learning. And so I don't see that that's a problem. There are pieces of version 2.3 that I actually think, I mean, we talked about Vermont being its own special little place. And it's not quite like everything else. So we don't want to On one hand, we don't want to be leaders too far ahead of the pack. But on the other hand, Vermont is a unique place. And so we need our legislation to reflect those unique features that we have. So I feel like that there may be things from version 2.3 that specifically meet the needs of Vermonters. And when I hear people phrasing it, a more restrictive versus a less restrictive, I would like us to rephrase that as more protective, less protective, because I think that that's ultimately what we're trying to do. We're not actually trying to be restrictive, we're trying to be protected.

[Michael Boutin (Member)]: I

[Unidentified Committee Member]: agree. I mean, the other way to look at it, how can we build a privacy bill that is as effective as possible, protecting those? Given a whole bunch of different considerations.

[Michael Marcotte (Chair)]: I think we're about as far as we could go today. Is there more information we need from Rick?

[Rick Siegel (Office of Legislative Counsel)]: Needs more information. Hey. You read my mind, rep granny? Because that's I It's It's only May 5. So but, you know, I I do kinda need to know where the committee wants to go with draft, reappoint, whatever, the next iteration. I hear the concerns, but I don't really have the direction as far as the major A few more people in here from tomorrow.

[Michael Marcotte (Chair)]: Think tomorrow afternoon, we have two members that are here right now. We need to really hone in on what road we want to go down there. So think about that tonight, hearing more testimony tomorrow, but then, or afternoon we get off the floor, if we have time to start that discussion to give Rick the direction where we want to go. Okay? So tomorrow at seven one, nine to 10:20, and at 10:30 we're hearing from Department of Labor on the PY Trust Fund, our annual report on how the trust fund will doing. They confirmed that things are still going well. I have no reason to believe that they're not. I just think that if the musician going on with the chart playing, we'd have heard about it long before the Multiple stakeholders take off. So with that, any questions? What are you doing first thing

[Unidentified Committee Member]: in the morning again? What's the first thing in

[Michael Marcotte (Chair)]: the morning? We're hearing more testimony on that seventeenth.

[Unidentified Committee Member]: And so committee discussion starting at one? No. No.

[Michael Marcotte (Chair)]: The floor starting at When do we do committees?

[Rick Siegel (Office of Legislative Counsel)]: After the floor.

[Michael Marcotte (Chair)]: After? Yeah. Providing we have time. Just need my schedule. If not, then we're taking some testimony on Thursday, or on 08:48. That will be at nine nine to possibly eleven. If we get done before that, can continue to commit any discussion as well. Okay. We're good. We can go up live.