Vermont Legislature SmartTranscripts:

[Rep. Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Wednesday, 05/07/2026 at nine in the morning, but we're here to continue to hear testimony on s 71 data privacy bill. So I think first up, Jen. Good morning.

[Jen Caltrider]: Hello. Good morning.

[Rep. Michael Marcotte (Chair)]: You for joining us.

[Jen Caltrider]: Yeah. Thanks for having me. Thanks for inviting me. Alright. Well, I apologies up front if this is a little rough. I I didn't have a lot of time to prepare, but I will do my best to tell my story, and, it'll make sense. So, I'm Jen. I am a proud Vermonter living up in Alberg. I also happen to be a consumer privacy researcher and advocate, which means that I've probably read way more privacy policies than most every Vermonter out there. In 2017, I created a project called Privacy Not Included, where we reviewed the privacy and security of consumer devices, consumer tech products, things like mental health apps and smart watches and smart TVs and cars. And that project was pretty well respected, award winning. I'm very proud of what we accomplished. And that's where my privacy background comes. I've researched consumer privacy tech. So I have a lot of thoughts on this issue. If you Google my name, you'll probably see me talking in places like NBC Nightly News or or Good Morning America or The New York Times or Washington Post or BBC about consumer privacy issues. I've I've yapped about privacy, consumer privacy in a lot of places. I've never testified in front of a state legislatures, so so this is a first for me. And in the process of becoming a consumer privacy advocate, I've worked directly with companies to help them change their privacy practices for the better. I've worked with policymakers and regulators to understand what the problems with consumer privacy are. I've worked directly with the media to help them better understand the problems and issues that they should be covering. So that's a bit of my background about why I'm a first ever monter, but also I have a bit of knowledge about privacy. Enough about me. Let's talk about privacy because I love to talk about privacy. So yesterday, I gave the bill a read. Well, I tried. You know, I'm better at reading privacy policies than I am bills, but I did my best. And I noticed that there were over 60 definitions in the bill, but not one of them that I could find defined what privacy is. And I think that's important. I think it's important that we define what privacy is because privacy is I mean, people have given up on privacy. Right? So maybe if we define it and name it, it will help. So my personal favorite definition of privacy comes from way back in 1890 when the legal smarty pants, Louis Brandeis and Samuel Warren, wrote their landmark legal argument, called the right to privacy. And in that document, they define privacy as this beautifully simple, the right to be let alone. And I really like that definition of privacy, and I really wish we could go back to it because I think it's beautiful. It's way better than the current definitions of privacy that a lot of the big tech companies have pushed on us. They lean into something called contextual integrity that I'm not even going to bother trying to explain today because it's wonky and it's just a bad definition. I don't like it. So, but one, I'll add one more thing about what I think privacy is and how I define privacy. And to me, privacy is dignity. It's the dignity to just be who you are. And we're losing that in our digital age. You know, now we're targeted with ads where companies have made inferences about things like our intelligence and our psychological traits and our political beliefs and our age and gender and religion. And they package these up into things that they think and know about us so they can manipulate us to give us to do something. So if you're trying to quit alcohol because you drink too much and you really wanna get better, good luck because those ads are gonna follow you around because you can't you can't opt out of them. They've inferred that you drink. Good luck telling them that you don't drink. There's not a lot of dignity in that in that. We're victims of fraud because the data that people that that it's out there on us lets bad people pick the easiest targets. The young people that are trying to sort out their political beliefs, you know, get tricked into clicking one video, and then they end down a rabbit hole, and they're radicalized. You wanna host a block party in your neighborhood like like we used to do. Right? Gatherings, you know, public gatherings, and people are afraid to go them to them now because there are cameras everywhere, and if you make one misstep, it could haunt you for the rest of your life. There's no dignity in any of that, and that to me is why privacy matters. Privacy is good for our souls, it's good for our mental health, it's good for our communities, and it's good for our democracies, and we're losing it. And this is why I fight for privacy. Now on to this bill. I'm still kind of new to this, so apologies if I don't get everything right. But I did give it a read, and I think it's pretty good. I think you should pass it. Actually, I think it's the bare effing minimum of what you all should be passing in Vermont, because our privacy is lost. Our privacy is so, it's so bad out there for privacy. And I've been saying this for years and years and years. And we don't have a federal privacy law and we're likely not going to have a federal privacy law with any real oomph to it anytime soon. So I really want you to protect me as the Vermonter and my privacy because it matters. And we're coming into an age with AI where AI we're being taught people are being taught that tell AI everything. The more it knows about you, the better it can help you, the better it can be. You know, your life will be easier, your job will get done faster if you just tell AI everything about you. We have smart glasses. There's a race to see who can build the best smart glasses and put them on everybody's face so that now everybody's walking around with devices that record and video and audio and listen and hear and process that with AI and stream it out to the world. And we're not being protected from that. You know, our cars can track us everywhere. And that's only getting worse because the technology in cars to track us that used to just be where are you going and how fast are you going is now what is your emotion in the car and and and what are your biometrics while you're sitting in your car? And this is all terrifying to me when I see how much we've given up and how much more there is that can be taken. You know, if we don't do something now, like, we're in danger, we're in real danger and it scares me. One of the points that I've heard talk about with this bill is this idea of data minimization. Data minimization is a point, you know, the idea that companies should only collect the bare minimum of the data they need to provide the service. It sounds great. I'm all for it. Once again, it's the bare minimum. And as we enter an AI age, I don't even know how you balance that bare minimum, but it should be, It should just be a default. We should have this. I'll share quickly with you one story about why it feels so important to me. When I was researching mental health apps during the pandemic, during the pandemic hit, we all holed up in our houses and went online and our mental health tanked. And one of the results of that was that everybody and their brothers started learning that mental health apps were a gold mine. And so they started making mental health apps. And you had the big ones, the Talkspace, you know, the big ones, but then you had small, small little people who were like, oh, there's money in mental health apps. And I remember we reviewed about 24, 25 mental health apps for privacy not included. One of which was for an eating disorder app, which as you can imagine, targets mostly young people, women especially. And, you know, the goal was laudable. We're going to help you with your eating disorder, you know, and you're going to journal, you're going to track things, we're going to give you pointers along the way. But I reviewed this mental health app and it was terrible for privacy and security. I think the password requirement was 11 to access it. So anybody could basically access the app that didn't have security protections. Their privacy policy wasn't even really a boilerplate privacy policy that you can download. It was like the lowest level lift of a privacy policy ever. And I reached out to the email address in the apps maker. And I said, you know, hey, we're reviewing mental health apps for privacy and security. We've looked at yours. We have some questions and concerns. Would you get back to us? And of course, didn't hear from them. And then we published our research, and it got a lot of attention in the media, and then they reached out to us. And I'll never forget this guy this guy saying, why are you picking on me? I'm just one person out here trying to make a mental health app and make a living. Why are you picking on me? And I I kind of shook my head and and I replied to him and I was like, you're a small, you're one person, you're a one person operation, but you have a lot of power. You're collecting the personal information of a very vulnerable population, and you're making no effort to protect that and respect that and secure that. And that's got to be the bare minimum. If you're going to take on this huge responsibility of collecting this personal information, you have got to make sure that you can protect it and respect it. And he got back to me and he's like, oh, you're right. What should I be doing? And then I helped him. I helped him, you know, tighten up your password requirements. Let's get a real privacy policy together, let's do better. Because if you're going to collect this information, you have a duty to protect and respect it. And that's just common sense. You shouldn't be protecting, you shouldn't be collecting information that you can on people that you cannot guarantee you will protect and respect, which is why you only need to collect the bare minimum that you're gonna need to provide the service. That's just common sense. We Vermonters love common sense. So I'll just wrap up quickly by saying that remember privacy is dignity, and we all deserve the right to be let alone. They knew that back in 1890, and I'd love to bring that wisdom back to Vermont. So if any of you are worried that this bill goes too far, let me tell you as a privacy expert and a Vermonter, this bill doesn't go nearly far enough, but it's a good start. Thank you.

[Rep. Michael Marcotte (Chair)]: Thank you. Edye?

[Rep. Edye Graning (Vice Chair)]: Thanks, Jen. I appreciate you being here. I did a little Googling while you're talking, and it looks like you've been doing a lot of research on cars and privacy in cars, and I was hoping I could ask you some questions about that. Oh, absolutely. Okay, thanks. I recently had to get a new car. It's a very long story. It's not for this. But I wanted to use their cab in order to do some things, whatever. I wanted to be able to use all the functionality that the car avails to me. And I couldn't figure out how to do that without giving up their ability to track me doing everything. And so I have questions about both that. And are they tracking me whether I give them my approval secret or not through the app?

[Jen Caltrider]: Yeah. I mean, welcome to the world of modern cars. So to answer your first question, is there any way to get the full functionality of your car, like remote start and tracking and things like that without the app? No. No. And that's by design. They want you to download and install the app. I've even heard instances where car dealerships incentivize dealer salespeople that get people to download and install the app. Sometimes they'll download, they'll be like, you'll be at the car dealership and you're picking up your car and they're going through things of how you just bought your car and, oh, it's got this great screen and here, let me just click through this. And as they're kind of clicking through, car salesman's clicking through to show you the features, they're agreeing you to whatever opt ins there are on the screen in the car. And then they'll say, and let me, I know you got, you gotta, you put this app on, you can do all this stuff. Here, let's do that. And they'll do that before you, you can download it. Never showing anybody a privacy policy. Oftentimes, even just doing the clicking for you. That's what they want. And so that's by design. And yes, I bought a new car when we were in the midst of doing the privacy research and I intentionally didn't let the salesperson in the car. And I intentionally, I still haven't downloaded the app. And yes, I can't remotely start my car, which sucks on those minus 12 Vermont mornings. But to me, it's a better trade off. And then the question of can they still track you even if you didn't consent to the app? And the answer is yes. Cars are a privacy nightmare, as you've probably seen in the research that we did. And, you know, when we started to do our research, I didn't even know how to research cars. I was like, how do you research cars? Where is the privacy policy? And literally we spent the first month just trying to figure out how to find the information we needed to research because the car has a privacy policy. The app has a privacy policy. The car dealer has a privacy policy. SiriusXM has a privacy policy. The financial people have a privacy policy. Oftentimes there's three or four in there. GM has a privacy policy for their website, for the cars, for OnStar, on and on and on. And again, when you're a consumer buying a car, you know, you get a look at price, reliability, you know, does it have all wheel drive and, you know, can I drive it in Vermont? Privacy is way down on the list and most people don't even know how to gauge privacy. And so, yes, the cars can still track you even if you don't download the app because all modern cars now come with some sort of cellular data sharing. And so, even if you don't have the app, your car is collecting data on you and it has the ability to share that back out into the world. And so where you're driving, you know, GPS is on there, how fast you're driving, when you're driving, things like that is still likely being tracked, even if you didn't download and install the app and consent to it. And one more thing on cars and privacy, we talk about consent, and it goes back to that shitty definition of contextual integrity that I mentioned of. When did I consent to this? I read a privacy policy from one carmaker that said, the moment you sat in the car, you consented to the privacy policy. And then it added a funny line that said, if you're the owner of the car, it's your responsibility to tell any passengers this privacy policy, which always made me chuckle because I just imagine you're picking your buddy up to go to a movie and you're like, wait a minute, I gotta take the next thirty minutes to review this privacy policy with you because you sat in my car, ergo you consented. So I hope I answered your questions.

[Rep. Edye Graning (Vice Chair)]: So then my follow-up is, what does this bill do to give Vermonters more options? And if you need to think about it more and read about it, I would be happy to have a conversation offline. I think that's really what I'm trying to understand is we don't have privacy protections for Vermonters in the world of today right now. And so I'm trying to understand tech in reality. Right? Like, what are we going to do? And how is it going to work in the real world and not just in our

[Jen Caltrider]: I can give you Right. Well, and again, I will say that this bill is good. You should pass it. It doesn't go nearly far enough. There's no bill in the world that goes far enough to actually protect consumer privacy right now. So but, hey, let's do something. Something is better than nothing. That being said, I'll give you one example from my own personal experience. When we got this car, I immediately was like, you know, I've been doing the research. I was like, oh man, I want to make sure, you know, I can delete everything, you know, go through the process, and I was like, I want them to delete all the I want I have a Mazda. I want Mazda delete all my information because I don't want them to have it. I'm a privacy dork. Right? I go on the Mazda website and I go to the page where it says you can request your data be deleted after digging through because it's not an easy thing to find, but I eventually found it. And then the first question it asked me was what state do you live in? And when I said Vermont, it basically did the computer equivalent of saying, f you and kick me out because I don't, as a Vermonter, I didn't have, at the time, I didn't have the right to have my data deleted. And so they laughed me off the internet. And, you know, if I had lived in California, I could have asked for that. But because I lived in Vermont and I was sad, but because I love Vermont, I don't want to live in California. But I was sad that I didn't have the same privacy protections that other people in The United States had. So that's one small thing. And again, nothing's going to be enough until we fundamentally change how we treat privacy and actually, you know, lean into the the definition of the right to be, let alone. But that's one small thing that would that would give me a Vermonter a better chance at protecting my privacy.

[Rep. Edye Graning (Vice Chair)]: Thanks

[Unidentified Committee Member]: very much, Jen. You know, I think that there's cultural questions about what's creepy, what's over the line, and and so maybe it is that we all need to live like Louis Brandeis and have all the apps that he had, and then we'll be let alone. But I you mentioned a phrase that I wanted to learn more about, and I because I think it might be relevant to just seemed like it was something I think you said one to one. Did I hear that? As you talked about, like, a privacy policy? Did I hear a phrase one to one? I may have just misheard a thing, but I thought you used the term that I was like, I don't know what that means.

[Rep. Michael Marcotte (Chair)]: What are your testimony?

[Jen Caltrider]: I don't can you give me a little more context? I don't know what what

[Rep. Kirk White (Ranking Member)]: I think

[Unidentified Committee Member (overlap)]: she was talking about passwords.

[Unidentified Committee Member]: It was, yeah, it was something about, like Oh.

[Rep. Monique Priestley (Clerk)]: Oh, it was 11 as being the password.

[Jen Caltrider]: 11. Yeah. So the password requirement for that mental health app that I was referencing that collected a lot of very personal data and had really terrible privacy and security, basic tenet of of privacy and security with apps is you wanna have a stronger password. And we've all been through the you create a password and you think it's strong, and then it's like, oh, no. It's not strong enough. Add, like, three more characters. It can get annoying, but it's there for a reason. This app required only required an extremely weak password. I can't remember the exact details, but it might have just only been one one. So, literally, you could have just put one character in and said, have a password. And that's a real big security no no. And so that's what I was referencing though. The one one is a it could have been 12 or one four. But it only required a very weak password, which is bad.

[Unidentified Committee Member]: And Is that something that is addressed legislatively, or is that just sort of the world of people doing things sloppily because that's what we get now?

[Jen Caltrider]: Oh gosh, I would love to see a actual requirement that all passwords be strong. And if not, there's there's something that people can do about it. Something to hold people accountable. Because right now, we're just trusting Fred in, you know, in his mom's basement in Iowa who had the bright idea to make a mental health app that collects a lot of personal information to get it right. And he didn't because he was too focused on beating everybody else to make the mental health app and get it out there so he could get in on the the gold rush. And in the process, he put people's privacy and security at risk. And it wasn't just people. It was vulnerable people, people with eating disorders. Again, young people, a lot of women, people that are sharing very sensitive information that could harm them now or in the future. And so, let's do it. Let's make it so that people that collect personal information, especially personal sensitive personal information, are required to have strong passwords.

[Rep. Michael Marcotte (Chair)]: Thanks.

[Rep. Monique Priestley (Clerk)]: Thanks, Jen. I was wondering if you could address in your testimony, more specifically, if you could help us understand the data minimization and or data minimization attached to just disclosing any purposes that data might be collected so people check a box, but then their data isn't actually minimized type of thing, especially when it comes to the car?

[Jen Caltrider]: Yeah. Yeah. So data minimization is is complicated in our current age. I'm all for it. I think, you know, companies should only click the minimum amount of information they need to provide the service. And that's kind of how the definition of privacy has evolved, but it has got messed up along the way because companies justify anything. Oh, I need this to provide the service. Cars are particularly egregious about this because they'll say anything's for safety. We need a camera on your face to track your emotions. It's for safety. You know? We need to know if you're angry. If you're angry, then we'll shut your car down. That hasn't happened yet, but it the the the technology's there, and we're not that far off from that happening. And so, becomes the problem, right? Data minimization is great, if it's enforced, if it's outlined, and if it's companies are required to do it right. And so, yes, you know, I firmly believe companies should only collect the information that is required and they should only use it for that purpose. And they shouldn't be allowed to kind of stretch and blur and massage and do all the things they have lots and lots of lawyers to do to make that, oh, you consented to this. Oh, well, we need it for this safety purpose. But, you know, I mean, for example, with cars, there's the, you might've heard about it, I don't know, the requirements starting next year that cars have a way to track if you're impaired, like if you're drunk or too sleepy to drive, And the technology around that is still kind of being firmed up. But is it a camera that looks at your face and says, oh, you look drunk, so the car won't start or a sensor? And so, but that's going to be required by law to be in those cars, which, again, is a safety feature. It's kind of questionable about, you know, how well does it work? You know, am I going to be stressed and rushing to the hospital because my kid fell and knocked their head and the car is going to read me as impaired and not start? And that's that's dangerous. But the the thing is is, like, but but set all that aside and say, okay, this is great. We're gonna have fewer drunk drivers on the road. But there's nothing that says, okay, we also have all this data that we're collected. It fits under data minimization because it allows us to provide the service, there's no restrictions on how we can use this biometric data. And so, that's why I think data minimization is great. It's imperfect and it needs a lot of oversight to get it right. And not to say that we shouldn't do it, we should absolutely do it. We should lean into it really hard. So, I don't know if that answered your question or, but it's complicated, and it's even more complicated in an AI world where everybody's being told to give your AI all your information because that's how AI is going to be your best friend. So I think that getting ahead of this, I mean, we're so far behind on protecting people's privacy. Really depressed me. Mean, literally depressed me. At the end of my privacy not included project, I was so depressed and burned out that I've had to take time off and step away from it, because I see the harms that are being done to people. I see what is damaging people and not just damaging us as individuals, but damaging our communities and our democracies and our societies. And it really, really, really brings me down. And so, we need to do all of this and a lot more.

[Rep. Michael Marcotte (Chair)]: Other questions for Jen? Jen, thank you for joining us this morning. We appreciate your testimony.

[Jen Caltrider]: Thank you.

[Unidentified Committee Member (overlap)]: Lisa.

[Rep. Michael Marcotte (Chair)]: Good morning.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: Good morning. Good morning. It's good to see you all, some of you again. I'm Lisa Lavasser and I'm really grateful for the opportunity to share Internet Safety Labs' point of view on this. I want to just I I did provide a a written testimony for you. So I'm gonna touch on the high points, probably not all of them in in what I say here during my verbal piece. But I also wanna underscore the fact of how ISL assesses risks, safety risks, and technology. We we strictly look at the behavior of what the app is doing. We are assessing the risks in software behavior. We don't care what the privacy policy says. We decided many years ago that that was irrelevant. Sadly, that may be like a kind of a jaded point of view, but we did do the analysis originally and we're like oh wait these are written to protect the company. This is not what we're interested in as a consumer protection agency or organization. We're interested in understanding the behavior of the app and measuring it empirically. So we are looking under the hood. We are looking at what the communication to and from the app back to the first party servers and to all third party servers that we see the app directly communicating with. We look at dark pattern. We we test the app manually. We have some automations that help us look at and parse the network traffic, but we are, like, truly in the weeds. We are software experts, and we are deep, deep, deep in the weeds. So everything that I say kind of is founded on that and we've audited thousands of apps like this, thousands. So I'm probably too close to this sometimes to come back out and tell the story at a at a good level, but so what I did with s 71 is I looked at it from from the lens of protecting privacy and online surveillance of children. And some of the testimony that I provided for h six fifty goes into a lot of the details of what we found in our, you know, 2022 EdTech Benchmark where we looked at 1,700 apps used by children across schools in The US. So, again, we've looked very, very, very closely at this like way down in the weeds. So, so I've looked at it from the lens of children, but I've also looked at it more broadly. And I I really agree with what Jen was saying fundamentally about it's an it's a decent start, but it's nowhere near enough. And we, as a rule, spend our time fault finding. It's like what we do. So I, you know, apologies. I'm when it comes to tech tech and and the way we look at it, I'm pretty glass half empty. So okay. So what's good for children? One thing that I like about the bill is that it it clearly identifies and it's it's actually not so clear because it actually it calls in, the definition of a child under COPPA, which is a child under the age 13. But then later in the definitions, it talks about minors. And the good thing about the bill is that it really only refers to minors in the body of the bill. So the definition of minor is 18, which means we're covering more vulnerable developing brains and minds of, youngsters. So that is a good thing. The fact that the bill clearly identifies data collected from a consumer who a controller knew or should have known is a minor is automatically classified as sensitive data. And therefore excluded from being allowed to be shared in first party or targeted advertising. That is good. And in fact, it said it's it's almost redundantly stated in a couple different places in the bill as I read it, but I don't mind that. Like, I'm I think it's okay to be like double down on that and be really, really certain that we're not sending the data of children into the advertising bid stream, which I assure you, we are at scale indiscriminately every time we look at an app, we see it. So it's it's a huge, huge problem. Number three, the definition of sensitive data is good. It's picking up some of the categories that aren't always addressed. I just particularly gotta, you know, endorse the inclusion of transgender and non binary. It's not perfect. I'll say something about that in a minute. The limitation of collection and processing of personal data to what's reasonably necessary. So this is the data minimization. We are a 100% behind this. We at ISL have what we call safe software principles. We developed these, I don't know, six years ago, we started working on these. We published a safe software specification back before it was cool. You know? Like, we were kind of the first people thinking about a software safety specification, and we've had an open standards forum since 2019 working on this. So we've been working on this for quite a long time. So these 10 safe software principles, number four is data collection minimization. So we're happy to see that. Okay. Number five, the limitation of sensitive data collection unless it's strictly necessary. Really like to see that. Hard to enforce, but if we can enforce it, that's good. Because we see, even as Jen was saying, I mean, those kind of apps are for sure gonna collect sensitive information, but we see it all over. And I'll mention a case of that in a minute. And number six, the whole section on the contracts between controllers and processors was really just made my heart sing, I have to say. It's this is absolutely critical in our for enforcement and and laying down the obligations between the processor and the controller and what it must uphold with respect to the the data subject personal information, that's vital. We actually do have a principle. I forgot to add it here. But we have another principle that talks about, like, any settings that the user sets on the controller on the first party site need to be passed down to all processors. It's sort of like the transitive property of user controls and privacy settings. So these contracts hopefully can enforce and demand and mandate that kind of thing. So really happy to see that section. I've been a product manager, software product manager for more years than I like to think about. And, you know, managing the relationship on the data supply chain or the software supply chain has really fallen through the cracks just as a side note. I I have a an MBA from ASU and I reached and ASU has, like, state of the art supply chain. I reached out to them a few years ago and said, hey, what's your what's your software supply chain program look like? Didn't exist. So it's a real like sort of neglected area. So I was happy to see this whole section in there. Okay. Now on to what could be better. I have some concerns about the three flavors of advertising that are defined in the definitions. The first one I'm gonna call out is contextual advertising. I know where this definition came from. I I it it looks like it came from the CDT and as much as I admire their work, I don't I don't agree with this definition. First of all, it doesn't align with the commonly accepted definition of contextual advertising that's in COPPA. And that

[Rep. Monique Priestley (Clerk)]: that's

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: a bit squirrelly because there is no definition in COPPA. And so it's only come out through rulings and such, but it it's the place where I think we really should defer to, what contextual advertising is. I don't think we should stray from that. We should set the bar as high as we can because it's protecting children. So that's one problem. And then the other thing is that this particular definition of contextual advertising includes course location and language. And I'm sorry. That is that's targeted advertising. If if you are advertising using the the individuals in the law and the draft bill, it says individual. It's not really individual. It's actually the device, I think, what they're trying to say, which which is only marginally better because it's it's it's individual is actually more correct. It's technically the device, but it is the individual. So especially for mobile devices. I mean, it's a it's a nuance point. But in any case, this this language is worrisome because it starts to slip into targeted advertising in a in a in a somewhat seemingly, like, well, maybe this isn't so so problematic because it's it's demanding that all individuals within that the ads are are the same. Even if they're served based on the user's language and course location, the ads are the same. And I will say that the course location is defined as one square kilometer, which is very not course. I mean, that's a pretty small area. So so we think that it's highly likely that in the network traffic for these so called contextual ads, we would see unique unique persistent identifiers. And that's really what this is trying to avoid, but I don't think it's gonna succeed in practice. So that's one whole thing. Sensitive data. Number two, while it does cover some new ground, it follows in the footsteps of other bills that fail to protect against gender based algorithmic bias by allowing covered services to collect gender information when it's patently unnecessary. We see this all the time. We see it in apps that ask for gender or title information like mister, miss, miss, whatever. And in reality, very few services need gender information. It is really one of the most highly overused sensitive pieces of information that is as a woman deeply disturbing to me. Number three, while we understand that, you know, cop up that California CPRA paved the way for opt out of risky data selling and sharing, we have never been in support of that approach. This is a this is an anti consumer approach that puts unfairly puts the burden on users to take an extra action to protect themselves from unsafe by design digital products that are sharing, you know, personal information. So we know that this is a this is a norm and and that there's little that probably can be done for it. And we know we've been in these discussions since since the beginning of GPC and all of these things. I as an idealist, I I just disagree that putting this burden on the consumer is fair. Especially given the opacity of these products and the facts that fact that no consumer really understands where their data is going. Half of the half of the manufacturers don't understand where the data is going. Okay. Number four, we're not legal experts, but we we think it would be more beneficial to consumers if there was a private right of action. We understand that there are issues with the with the logistics of a private right of and the cost of private right of action. We wish there was something more egalitarian and cost effective and a more practical sort of justice system that would allow consumers to take action when they're harmed by these products because frankly, you know, there's very few products. If you go into app microscope which is where we have our safety labels at microscope.org. Very few apps get anything, you know, like, some risk is the best you can get and there's precious few apps that get that score. Most apps are leaking data in ways that are risky for consumers. Okay. Data privacy assessments. And this is section two four one five g. We question the efficacy of manufacturers grading their own homework. I know this has history in GDPR and, you know, it's very entrenched all over. I'm not sure it's really doing. It's it's okay. You know, it's good. Manufacturers should know. They should be required to document what they think is happening. They absolutely should. Is it enough? I think when we look to GDPR and we, you know, their enforcement issues and things like that. So, you know, I I'm gonna say that what we really need for any kind of product safety is independent audits. That's been an historical method for ensuring product safety. We don't rely on manufacturers to grade their own homework when it comes to product safety. DPAs, better than nothing, not all the way to independent product safety analysis. We also would be remiss if we didn't point out the fact that data de identification is not a guarantee. It's not perfect. We see it in bills all the time and it's a bit of a road you know, a speed bump, but it's not perfect. And to to think that it is, I think, maybe gives us some comfort that, oh, we're gonna be okay, but it's a speed bump, and we shouldn't we shouldn't really think it's perfect. And then finally, I added this in because I had a thought that I wanted to add this morning. So would normally have put this by the contextual advertising thing, but this this first party advertising definition is really quite interesting to me. It looks like it's trying to paint a more benign type of advertising, And I frankly don't see that it's any different at all from targeted advertising. It's just because it's first party data being used to target doesn't mean it's not targeting. You know? And also doesn't mean that that personal data isn't going out into the bid stream, the advertising bid stream into potentially hundreds of thousands of advertising entities. You know? So it's again, this is this is under the hood looking at the data flow and understanding how the data is actually gonna go with this stuff. So it so this first party advertising, you know, is is is, I think, tricky, the definition. Another thing that we see all the time is most large digital product manufacturers always obtain supplementary customer data information, data enrichment. We're seeing more and more customer data platforms, identity resolution platforms. The, you know, selling of personal data at, you know, in bulk. And it's becoming more and more pervasive with every passing day. And so it's it's sort of unreasonable to think that a manufacturer has a pure first party only data pro customer data profile. Like, we and we wouldn't know that unless we were, like, looking at the customer implementation very, very closely and ensuring that their targeting wasn't actually using third party. It's gonna be very hard to monitor and enforce this kind of thing is what I'm getting at. And finally, the other thing that I think is confusing about this is normally, in the past, when we've seen first party ad, the language has meant that it's an ad advertising a product from the first party or the publisher. Meaning, like, if if it's a kid's game provider, then it's the kids it's it's an it's an advertisement for another kid's game that that publisher produces. That's the normal definition of first party ad. That's so I was really quite surprised to see this kind of new definition of first party advertising. So, that's all my comments. Again, a little bit in the, you know, looking at this kind of precisely under the hood in the weeds a bit. So I hope it's helpful.

[Rep. Michael Marcotte (Chair)]: Thank you, Lisa. Any questions? Kirk?

[Rep. Kirk White (Ranking Member)]: So thanks very much. I particularly, my ears, antenna picked up when you talked about data protection assessments. I come from a regulatory background. In that background, regulators generally, there's an obligation for auditing and papers of the regulated entity that goes to the regulator, and then they can go back and forth in terms of whether that's sufficient. And I share some of your thoughts about whether this is an effective enforcement mechanism. You mentioned independent audits. Do you think there's room for not only by independent so I'm I'm thinking the enforcement entity and whether they should have a little more scope over these data assessments.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: And who's the enforcement agency on this?

[Rep. Kirk White (Ranking Member)]: That would be the attorney general.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: Okay. Yeah. Are you asking if that would be an adequately independent auditing source?

[Rep. Kirk White (Ranking Member)]: Well, I think I was asking maybe two, certainly that point of whether it's a sufficiently independent entity to monitor the activities of controllers and processors. But also, sort of the notion of rather than it just being a one way street in terms of information that's being provided, it'd be kind of a two way street and some opportunity to challenge the initial assessment and ask for additional information.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: Yeah. So the first one, I think it could be, you know, one of the things that we do is we're trying to sort of, candidly, we are, we we have been doing audits for, like, since six years. We, like, we are, I think, one of the most original, auditor come, you know, safety auditors, independent safety auditors. We do this all day, every day. We're trying to and we're nonprofit. We're trying to get it, you know, like, get it out in the world, somehow more distributed. Do I think that the AG office could do this kind of thing? Maybe it would be, I think, maybe expensive. Wouldn't it be great if we could set up labs at universities all over that were using, you know, kind of a confirmed testing process? That's kinda my vision, by the way, is to to do that where we had these, you know, at universities, places to go and do this. So there was one more bit to your question.

[Rep. Kirk White (Ranking Member)]: Whether there needs to be assuming that DAV could fulfill that function and they had the resource to do it, whether it's sufficient just to have the one way street.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: No, it's absolutely not. We're starting to look at South Carolina's age appropriate design code, which calls for an audit. And as far as we know, nobody's done it yet. But we've been looking at it and we we absolutely think there's a lot of two way discussion. We think there's two way discussion between the auditors and the manufacturers. We think there's two way discussion between the auditors plus the manufacturers plus the AG. You know, like so there's sort of two tiers of of of many two way discussions to to remedy and resolve and to clarify because this is this is new territory, right? So, it's gonna be bumpy. These first ones are where it's like sharp pointy rocks that have to have the edges rounded out of them. So, we're gonna have to, do a lot of trial and error on this but absolutely has to be two way communication. For the foreseeable future.

[Rep. Michael Marcotte (Chair)]: Thank you.

[Rep. Edye Graning (Vice Chair)]: Yeah.

[Rep. Monique Priestley (Clerk)]: Yeah. Thanks, Lisa. I wasn't expecting with you and with Jen and then committee questions, I wasn't expecting data protection to come up. But I feel like when I've been in rooms with cybersecurity folks and compliance folks, the number one thing is privacy builds don't actually do anything. People should be focusing on data protection and security. And I have an amendment that goes at protection and independent review audits when it comes to handling sensitive data. I'm just curious. I'm curious if that's a big lift to ask certain size businesses and if it would make sense to add and then attach to larger size businesses to start.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: Yeah, well, mean, absolutely. I mean, it's not there's cost. There's effort to get

[Jen Caltrider]: on it.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: So it's not not, you know, it's not not it's not zero. So, yeah, I think having a threshold, I think maybe a threshold of how many users are impacted, how many Yeah. You know, users they have. I'm not sure what the right metric would be but that off the top of my head, I would I would think about that because that's the impact. Like, how many people would be impacted? And then, we are constantly trying to figure out ways to automate and lower the cost of this. And, you know, we're still in the early days of we've done our own audits, right, like, against our own principles. That's what you see in appmicroscope.org. That far exceeds what any law says. And I think Jen made this point too. It's like, there's no there's no law that has it right. And so that's why we were never a compliance organization for GDPR or CPRA or anything like that. And so even as we synthesize the requirements from, like, for example, South Carolina's age appropriate and your age appropriate design code app act, which I am doing. Yeah. It's Yeah. I think having having a a threshold for a company because it's it's nontrivial. I'll tell you that there are, like, a 100 nearly 250 line item tests that we do in the synthesized version of, like, a child safety kinda thing. And so it's nontrivial. So trying to minimize that cost is but we but we just pulled that together. So we can't you know, we gotta crawl, walk Yeah. Run. Yeah.

[Rep. Michael Marcotte (Chair)]: Questions? Lisa, thank you for joining us this morning.

[Lisa LeVasseur (Executive Director, Internet Safety Labs)]: Thank you.

[Christina Glabas (Founder, Gazelle Consulting)]: Was that call for Christina?

[Rep. Michael Marcotte (Chair)]: Yes.

[Christina Glabas (Founder, Gazelle Consulting)]: Okay. Great. Thank you. And I'm I'm audio only today.

[Rep. Michael Marcotte (Chair)]: Okay. Well, thank you for coming in.

[Christina Glabas (Founder, Gazelle Consulting)]: Thank you so much for having me. So my name is Christina Glapus, and I'm the owner and founder of Gazelle Consulting, a HIPAA compliance and data privacy consulting firm based out of Portland, Oregon that serves organizations nationwide and internationally. While in Oregon, I had the honor of working with the Oregon DOJ to develop Oregon's Consumer Privacy Act, passed in July 2025. And now I've been asked to assist with clients who are being audited under this law from the Oregon DOJ as well, which has given me a pretty interesting full circle perspective on the topic of the boundary of healthcare data in this law. So my practice really focuses on HIPAA. I work with so many different organizations like small software providers, major healthcare conglomerates, clinics, hospitals, insurance companies, startups. And I've also been asked to assist in court cases as an expert witness determining whether or not certain uses of PHI follow the law. We're weighing in on that. So I've worked with the DOJ in a couple of different capacities. And so it's very interesting for me to see now as they go through enforcement, whether or not the issue of the entity exemption for health care is practical or not. And so that's really what's going to be the focus of my testimony today is talking about what I see businesses needing and where I see the boundary of the entity or data level exemption in the healthcare in practical reality. So I've worked with over 100 different businesses from social workers to software conglomerates, helping them with data privacy projects ranging from implementing full scope HIPAA programs, just doing risk assessments, doing GDPR implementations, creating CCPA audit for audit programs. I've worked with audit firms to help them develop audit programs for CCPA and GDPR. So really on the auditing side as well, but I am more of a compliance company. So I've firsthand seen the challenges and successes that businesses have in adapting to the demanding pace of technology growth. And from my perspective, having done all kinds of different assessments with these laws is that businesses do not understand the technology that they have built. That is the foundational problem with every business that approaches a compliance task. The way that businesses conceive of themselves from the perspective of their own brand has nothing to do with the data that they use most generally. Generally they are not describing their work in terms of whose data they have, where do they get it from, what do they use it for, why did they collect it, are they still using it for the same purpose that they collected it. Those questions don't come up unless somebody asks. And so that is really the biggest value add that this bill provides to society is asking those questions of businesses because they're not asking it of themselves. And every time we go to do an assessment of a business, they the first thing that we do based on laws like the Vermont Consumer Privacy Act is we look at what are they collecting? Who do they get it from? Where do they send it to? What systems is it stored on? And every time they find major unknown unknowns. Just things that they never even occurred to them that they were doing. So that without a structure for getting these organizations to do these sort of interdisciplinary assessments of themselves, it just doesn't happen. And so there's a critical moment for that regulators need to play right now. A critical role that regulators need to play in this moment and that's to give businesses enough practical guidance to make meaningful impacts on protecting consumers so that they can get back to what they're good at doing because the other problem is they are not good at doing cybersecurity. They're really not. Cybersecurity is incredibly hard. So but the fact is that their businesses depend on data. So until their business model stops running on data they're going to have to learn how to be ethical stewards of it. And right now our whole society and its technology functions on data ecosystems. And until the government can take some of this work out of their hands, which I think is what needs to happen, we need to make some of the internet a public good because this is just so much work for every individual, every business to keep up with but they must keep up with it. We must. There's no other option, you know, besides fail and have a huge data exposure and potentially lose your business because you didn't have awareness of systems that were even exposed. So if we as a society don't provide guidance and resources on how to keep up with the threats and issues in managing data. Companies won't bother doing it because they just don't know how. And we need to help these businesses find ways to protect this surprisingly precious information that they have about potentially any and all consumers. It's really not that hard for businesses to collect data on all consumers in The United States. Just you know depending if they ask a specific enough question they can get information about everybody. Any business can do that. So they really are outpacing themselves and that's why they need guidance from this bill. So having I really do believe that this legislation needs to be workable affordable and feasible and I know that it is because I've worked with hundreds of different businesses to do this. I have seen them do this they can do this when they choose to afford this. Yes they can but this is the cost of doing business in this era. If you're going to be doing work with huge amounts of data you're going to have to pay the costs of maintaining it and it is hard but that's where we come in. So the benefit of doing this work for companies is that they don't fall behind in protecting their systems from data loss, lack of maintenance, or aging out of functionality from technical debt. Data privacy laws do contain the groundwork for inventorying one's data and the information systems that contain them and how companies use that data. It's quite difficult to explain just how critical this business is this is for businesses who are always surprised by the findings. There's a huge gap in their knowledge of themselves that these bills help them fill. And so while there are costs to this, there are benefits. And yes, there are costs, but it's simply the cost of doing business. And it's not The cost of maintaining technology ecosystems does not need to fall on the consumer by any means. These businesses are just building and building and building, adding new software, adding new systems, adding new integrations. That has a negative externality that the business has to pay. We didn't ask for the businesses to rush in implementing AI into all of their systems, but they have. And that there might be some costs to that, to doing that. There might be some costs for these businesses that want to keep up with the pace of technology is what I mean. And so that should that cost should not fall on the consumer. We need to support the businesses that do have a business need to keep up by writing bills that will guide them in how to do so. So we just need to keep pace with the technology growth in society as well. So moving on to this bill and its exemption of HIPAA, there's been a lot of conversations around whether this bill should grant an exemption for just for any entity that is covered by HIPAA, which would be a covered entity or business associate, or whether the exemption should exempt only data that is covered by HIPAA, which would be PHI, protected health information, specifically your medical records. And so I want to talk a little bit about what would happen if we an entity level exemption as opposed to what's currently in the bill, is a data level exemption. So the main problem with an entity level exemption is that there are hybrid entities. There are a lot of hybrid entities that provide health care services and non health care services. And there's some very obvious examples like pharmacies. When you go to your pharmacy, it might be inside of your grocery store. Just because you have a grocery store offering pharmacy services, you don't want to then exempt everything that they do with their retail grocery business from coverage under this bill. So the marriage of retail and medical services is why you cannot have an entity level exemption because it's very easy to say, Oh, well, Walgreens is a covered entity as their pharmacy so I guess we don't need to watch anything that they're doing with any of their retail purchasing data. No, that doesn't make sense. They're one of the biggest retailers in the country. Name any of the biggest retailers in the country and I will bet you that they have a pharmacy somewhere someplace that's legitimately offering healthcare services even if 90% of the rest of their business model has nothing to do with healthcare. If selling pharmacy stuff, then yes, they would fall under an entity level exemption. And so that's why we have to prevent that from happening because the entity level exemption is way too broad. So a few more examples of businesses that would not be covered if you gave an entity level exemption. So any banking services, if there was a bank inside of a hospital, if there was food inside of a hospital. All of that would be there would be no coverage for any of those retail services or consumer services that were occurring inside of facilities that have more than one purpose. Any online organized any online company that wants that wanted to offer telehealth. We saw a lot of businesses I'll give an example of Amazon. They're working on Amazon Health, allowing people to find healthcare providers through their platform. That doesn't mean that just because they have one service for offering healthcare that all of the rest of Amazon should not be covered by this bill. That would be crazy. Like if we did an entity level exemption that would eliminate that would probably exempt every major retail corporation that this bill is really actually targeting. Those are the ones that are producing all of the data at the end of the day. What this is about is people's purchasing history. So we cannot just say anybody who is ever a healthcare entity doesn't have to follow this law. A data level exemption means that any entity who is using data in the context a data level entity So data level exemption protects the data regardless of the entity's status in other contexts. So if what you're doing meets the definition of PHI under HIPAA or if the activity is covered by HIPAA because some activities like marketing may not involve PHI in healthcare circumstances, but they are written into and by they're written into the HIPAA laws. They're included, you know how hospitals do need to do marketing to non patients for public health activities and things like that so we want to make sure that that is not exempt so anything that's covered by HIPAA should be exempt excuse me I'm sorry I'm making that confusing We want to allow hospitals to do marketing to don patients. So marketing is covered by HIPAA even though it's not PHI. So we want to make sure that anything that is covered by HIPAA is not also covered by consumer privacy bills. So we're trying to fill a gap in coverage here, not let any entity that sometimes does health care work have a pass from complying with this law. And it's been really an honor to testify in support of this bill and work with Monique and her team on getting all the pieces together. I think I've been testifying on this since the first It's been like two years maybe, but I believe this bill is absolutely necessary to protect the citizens.

[Rep. Monique Priestley (Clerk)]: Thanks for reminiscing.

[Christina Glabas (Founder, Gazelle Consulting)]: I'm doing great. It's just been so fun. I just don't want to stop. I believe this bill is absolutely necessary in protecting citizens of Vermont by addressing gaps in HIPAA and providing recourse to harms. So thank you so much for allowing me to share my perspective. And I really hope you guys pass this bill.

[Rep. Monique Priestley (Clerk)]: Thanks, Christina. I have two questions. So one, I had asked a question while the medical society and health care folks are testifying because they were saying that the federal government had provided basically guidance around technology use in HIPAA. And I asked, is that actually law, or is that just guidance? They go back to me and said, it's just guidance. It is not law. So I was wondering if you could fill us in on the impact of the Chevron deference decision that was overturned by the Supreme Court, that guidance from agencies is no longer an authority when it comes to decisions and that has to go to the court and just like what that actually means. And then I have a other question completely different.

[Christina Glabas (Founder, Gazelle Consulting)]: Sure. So I believe it was last year in 2025, the Chevron deference decision was overturned by the Supreme Court. And the Chevron deference decision granted authority for determining the meaning of ambiguities in the law. It granted that authority to the agencies. So typically the Department of HHS when it comes down to HIPAA. But when the Chevron deference decision was overturned, it returned the authority for dealing with ambiguities in the law, it returned that authority to the courts. So now it's basically disempowered the HHS from granting from publishing this kind of guidance which is crazy to me because in the field we look to this guidance constantly and so that guidance was never yeah I guess you know in a court case you would look to that guidance to determine whether or not somebody was in violation of the law. Now you just get whatever court, whatever legal team gets pulled together, which sometimes could be really skilled in this area, but most of the time isn't because this is a really super niche topic. And so now rather than have all of the hundreds of career experts at the HHS weigh in, you just get whatever random court whatever random court is going to be making the decision on it. I have having worked with attorneys on court cases, I can tell you attorneys are not experts in this field. They really aren't. And it is such a niche field. It requires such an interdisciplinary skill in technology, law and business application that they are not the right ones to be making that call. But anyway, it's their authority. So what does that mean? What are we supposed to do with the guidance from the HHS? Well, as an auditor, there's a lot of different ways that the consequences come to bear. Most of the time HIPAA is not being sorted out in court. If you're dealing with some of the world's biggest corporations, then yes, HIPAA does get sorted out in court in those contexts. Those are the ones that are having like class action lawsuits, big social media companies and things like that. But your average healthcare provider, the process of going to court for a HIPAA violation is preceded by a lot of conversation with the justice department. The enforcement program is not meant to start with a punishment. Like, all right, you're going to court right away. It's like, no, when you get audited by the DOJ, whether it's the Office for Civil Rights at a federal level or know, your the, state level Department of Justice, they're going to send you an audit request list. And then you have to reply to all of it. And then they send you back, they're like, I don't agree with what you've analyzed here. And then you have to prove it. And then if they really still don't agree with what you've analyzed, then they're going to send you to court where So everything leading up to that is probably going to involve a lot of the guidance from the HHS. You know, when I'm preparing and still think that the guidance from HHS is going be incredibly relevant in the courts. I think they can just disregard it and I don't know. So I think we're still seeing that shake out. Yeah. Do you have any clarifying questions about that?

[Rep. Monique Priestley (Clerk)]: No, that was great. I have a completely different one that you made me go into horrified to grab a hole in my head on, which is, so we're talking so to give some context, so I had met with the government affairs for Spotify at a conference, and they wanted me to make adjustments to my high risk consequential AI bill. They said they're being caught up in the definition of chatbot. I was like, great. I love Spotify. Like, that makes like, I can make a change. But I was like, wait. What? Why? Why are you getting caught up? And they basically told me about the future that they foresee of most people in the world are using free accounts, have DJX that has ads on it, and basically shared with me a future where they're always listening to what people are listening to. So say I listen to 10 depressing songs in a row. I might be suicidal. So then DJX would come up as a therapist and then provide me therapy and then also offer me prescriptions for antidepressants. Which freaked me out and I dropped my Spotify But now I'm like, wait a second. If we're thinking about a world in where our Netflix and our Amazon and everybody else is tracking our emotional, just like our cars, tracking our emotional status and then trying to intervene with whether or not we're an alcoholic or whether we're depressed or whether, That you know, then if we're giving a HIPAA for these entities that are having, like, highly sensitive health data, if we're giving HIPAA entity level exemptions, are we are we then maybe possibly also exempting things like Spotify therapy prescribing chatbots in the future?

[Christina Glabas (Founder, Gazelle Consulting)]: Yes. Cool. Yeah. So let me think of an example of that, of a company. Jesus. I know. The whole thing that is just like because so I'm a musician and I listen to so much music. I'm like, get out of my head. Don't try to diagnose me. But yeah so that would be consumer health data so we're talking about the difference between consumer health data and protected health information and HIPAA is a pretty old law it was first passed in 1996 and it's the health information portability and Accountability Health Insurance Portability and Accountability Act. So it is really geared toward the health insurance industry because that was what really needed attention in 1996. It is not addressing web based healthcare delivery. It's not addressing any healthcare delivery that is outside of insurance. So anything that you don't get covered by insurance on an individual basis is not covered by HIPAA. And that's a weird little tidbit about HIPAA that a lot of people don't know. But for example, if you are a nonprofit and you get your health care services from a nonprofit health exchange that gets paid in bulk, like we're going to give you $200,000 to help as many people as you can. That is not associated with an individual insurance transaction and therefore is not covered by HIPAA, which a lot of, you know, creates a lot of problems for nonprofits and social services who, you know, don't get paid on insurance. But anyway, that there are some major gaps in HIPAA. HIPAA is actually a lot more targeted than people realize. And so what this bill needs to do is provide a little bit of coverage for consumer health data, which we don't have laws around in this country. This would be that law. This covers data that is related to an individual's health that is not covered by HIPAA. That is in the consumer context. And that could be a lot of things. It's not just Spotify, but it's stuff like free clinics. If it's a free clinic, it's not covered by HIPAA. Isn't that sad? Just makes me so sad thinking about people who get their health services, people who are the most underserved in our society, get the least protection because they don't have insurance. So it's not just the big conglomerates. It's really just fixing this gap in kind of one of our most ancient laws in this country. But yeah alternative medicine is not covered by HIPAA. That would be covered by this law. Single owner health clinics that don't take insurance not covered by HIPAA would be covered by this law. High end health clinics that don't take insurance would not be covered by HIPAA, would be covered by this law. And that's just the you know obvious cases of consumer health data but when we're talking about inferring consumers health from other data, woof. The use cases like that Monique described, I feel like are already so out of control and really need to be reined in with the way that people's minds are being analyzed in mass. And I certainly don't believe it's being used to sell them antidepressants. I really think the actual use case for this is a lot more nefarious. I don't have any evidence for that. I just wanted to make that comment. I think we need to be a lot more protective. Thanks.

[Jen Caltrider]: Yep.

[Rep. Kirk White (Ranking Member)]: Thanks very much, Adam. I thought I knew a little bit about HIPAA and its application to financial institutions and insurance, and maybe I didn't know quite as much as I thought. And I'm curious about a couple of aspects of your testimony. One had to do with the notion of hybrid entities.

[Jen Caltrider]: Mhmm.

[Rep. Kirk White (Ranking Member)]: And how how those are or not dealt with under under HIPAA.

[Christina Glabas (Founder, Gazelle Consulting)]: Mhmm.

[Rep. Kirk White (Ranking Member)]: Because I think the assumption of lots of folks is that exempting a covered entity, a business associate, somehow constrained the use of personal data or personal health information, I guess. And yeah, personal health information to other activities that are not directly associated with care and treatment. And I think you're telling us that's not a valid assumption. Like to, I don't know what you're submitting a written testimony to us for us to review, but I would appreciate sort of pointing to the provisions of HIPAA that kind of support what you're saying there. Not to contest it, but just to understand a little bit better, why that you think that's a problem?

[Christina Glabas (Founder, Gazelle Consulting)]: Yeah.

[Rep. Kirk White (Ranking Member)]: Go ahead. I have another question.

[Christina Glabas (Founder, Gazelle Consulting)]: Okay. Well, for one, I'm glad this was an entertaining HIPAA presentation. This is not always the feedback that I receive. It can be a very dry topic. But to your question about hybrid entities and how that works under HIPAA and will that be enough to protect consumers in this case. So selecting a hybrid entity designation requires you to create a separate compliance environment that has a really carefully drawn line between the data that goes between covered component and your uncovered component and you are not it is illegal under HIPAA to share data between the covered component and the uncovered component.

[Rep. Kirk White (Ranking Member)]: Yeah, that is. That's kind of been my assumption.

[Christina Glabas (Founder, Gazelle Consulting)]: That is correct. But we're not talking about a component level exemption. If we were talking about a component level, know, I think that that would be fine, but we're exempting the whole entity regardless of the component. That's my reading of the bill.

[Rep. Kirk White (Ranking Member)]: Okay. Yeah, that's helpful. Maybe related, I think what I heard you say was that there are a bunch of entities, medical practices, really, whether they're free clinics, whether they're, you know, I'm afraid I can't remember what they call them. They don't take insurance. Practices, I guess.

[Christina Glabas (Founder, Gazelle Consulting)]: That

[Rep. Kirk White (Ranking Member)]: they are not covered entities. Is that correct?

[Christina Glabas (Founder, Gazelle Consulting)]: Yes. Yes. Well, they're not covered by HIPAA. And I can provide the research, regulatory citations on this as well.

[Rep. Kirk White (Ranking Member)]: HIPAA That would very be helpful.

[Christina Glabas (Founder, Gazelle Consulting)]: It might take me a couple of days because this is a detailed report here. But yes, I can do that. So deep down, deep in the boring part of the law, in the very beginning of the definitions, it limits what is considered protected health information to those that are associated with standard transactions. And all of the standard transactions have to do with coding billing for her insurance. Anything that's not used like ICD 10 codes that does not any clinic that does not conduct those standard transactions for health insurance portability are not covered by HIPAA.

[Rep. Kirk White (Ranking Member)]: Okay. I appreciate that. Got it.

[Christina Glabas (Founder, Gazelle Consulting)]: And so what you're looking for there is just to find the regulatory citations on that?

[Rep. Kirk White (Ranking Member)]: I get probably fine.

[Christina Glabas (Founder, Gazelle Consulting)]: Okay. Yeah, the standard transactions. That's the key term there. Did I correct? Did I answer that final part of that question there?

[Rep. Kirk White (Ranking Member)]: I'm sorry. What was your question?

[Christina Glabas (Founder, Gazelle Consulting)]: I just wanna make sure I adequately answered your question.

[Rep. Kirk White (Ranking Member)]: Yes, you did. Thank you very much.

[Unidentified Committee Member]: Great.

[Rep. Michael Marcotte (Chair)]: Christina, thank you very much. Good information. We appreciate your time.

[Christina Glabas (Founder, Gazelle Consulting)]: Thanks for having me.

[Rep. Michael Marcotte (Chair)]: So early.

[Christina Glabas (Founder, Gazelle Consulting)]: Yeah. Thank y'all.

[Rep. Michael Marcotte (Chair)]: Thank you.

[Christina Glabas (Founder, Gazelle Consulting)]: Bye bye.

[Rep. Michael Marcotte (Chair)]: Bye bye. And Good morning.

[Gaurav Laroia]: Morning. Good morning.

[Rep. Michael Marcotte (Chair)]: Thank you for joining us.

[Gaurav Laroia]: Absolutely. And, of course, you know, thank you for having me and, for the opportunity to submit this testimony in strong support of seventy one, particularly its substantive data minimization provisions. My name is Gaurav Leroy, and I've been a technology lawyer and advocate for over ten years. Until about a year ago, I served as a consumer protection adviser to FTC commissioner Becker Slaughter. I was her point person on data and technology issues. Today, I wanna share why her team at the FTC fought to turn the page on the outdated notice and consent framework that put untenable burdens on people and set the stage for the kinds of privacy violations your committee is working to address today. During my time at the commission, we view these issues through the lens of unfairness, the abuse of data, and market power rather than just as privacy abstractions, the data minimization provisions in s 71 limiting the collection and processing of personal data to what is reasonably necessary and proportionate to providing the product or service they requested, I think is the foundation of a fair exchange, the data that companies actually need for the services people want. I think if enacted, Vermonters would have among the best digital protections in the nation. And more concretely, it means the people of Vermont can use digital services knowing that they're not giving up more than what's fairly owed to the companies that mediate modern life. You know, weakening this bill and abandoning these protections threatens to repeat the same mistakes that plague federal data protection efforts for decades, allowing companies to take the information they please for the purposes they please so long as they disclose it, places an impossible burden on busy everyday people and it forces busy Vermonters to navigate endless privacy policies or complex opt out mechanisms rather than placing the obligation on the well resourced companies you've entrusted with your data. It's worth briefly understanding how we got here, how poorly the assumptions that held up notice and choice enforcement fared in reality. You know, the deregulatory fervor of nineteen eighties, the agency took a hands off approach to protecting people's information in the face of rapidly changing technology. Regulars made the regulators made the assumption that consumers could take control of their personal data by educating themselves about privacy policies and making informed decisions in the free market. You know, decades later, we know this framework is broken. Privacy scholars have called these endless disclosures the transparency paradox as companies provide longer policies simply to comply with the law. The documents become incomprehensible to the average person. Recent studies have shown that the average privacy policy is almost 7,000 words long. It would take an average person a week to read the privacy policies of the websites they visit in a typical month. Digital services are the essential infrastructure of modern life. Know, faced with take it or leave it privacy policies. Any normal person will choose to participate in the economy. This failed idea has led directly to the data system we know today. Massive data breaches, endless robocalls, blockbuster fines, repeated FTC order violations, and the creation of a massive shadowy data broker industry. So, you know, during my tenure advising, commissioner Slaughter, we spent years sounding the alarm that the system is fundamentally broken. So the FTC had relied on its section five deception authority to make sure companies stayed true to their privacy policies and little else. They created a system where companies had the legal protection to gather, use, and sell as much of their information so long as they admitted it in fine print. So using the limited authorities the FTC has, it looked to the legal standard for unfairness to create data memorization orders with actual teeth. So under the FTC act, business is unfair if it meets three criteria. First, it causes substantial injury. Second, the injury cannot be reasonably avoided by consumers. And third, the harm is not outweighed by benefits to consumers or competition. So I think when you look at the digital economy, the unfairness of rampant data collection outside the bounds of a reasonable commercial interaction is plain on its a plain on its face. When there's little real competition amongst platforms, especially on privacy, when digital services are required to function in modern society, consumers cannot reasonably avoid having their data extracted, leading to all the downstream harms we came here to address. Using this authority, the FTC found certain data practices harmful and unlawful regardless of what a privacy policy may have had to say. The agency took on action against Cafe Press for holding on to consumer data indefinitely without a business need, brought cases against companies like BetterHelp for taking sensitive mental health data to third party ad networks for targeted advertising. The agency also took aim at the data broker industry and in a series of cases against data brokers like Cochaba, XMode, in market, the agency found companies indiscriminately selling precisely the geolocation data that could track Americans with sensitive locations, like reproductive health clinics and places of worship. By going after these data brokers, the agencies, secured substantive bans on the selling of sensitive location data. So as commissioner Slaughter frequently noted during my tenure, the only way to truly protect consumers is to turn off the data pump. Data that's never collected, cannot be breached by hackers, cannot be abused by data brokers. But, of course, the FTC section five authority is a limited tool. The agency is forced to fight these battles case by case and company by company. And so the fight for a substantive privacy protections is in the hands of the states. Of course, Vermont has this historic opportunity to build on the foundation that the FTC has laid with the power to codify these substantive limits in the statutory law to, you know, learn the hard lessons, that we've learned over the past twenty years. And so, of course, this isn't just a history lesson. There's a a real fork in the road. I think you can either mandate substantive limits on data collection or you can fall back to these failed disclosure based regimes. And to see the difference in these two paths, the FTC has actually taken actions in the last few weeks or the last two months that that kind of show these two different roads. You know, first, the old paradigm last month or maybe in March, FTC settled with Match Group, which runs the dating app OkCupid. The FTC found the app took profile pictures and extracted locations of millions of users and handed them over to a completely unrelated AI startup. And why? Because OkCupid's founders were financial investors using their users' photos as a free data pipeline to boost outside investments. You know, and what was the legal solution under the deceptive framework? Match has simply been ordered to not misrepresent its privacy policies in the future. That means as long as they update the the policies, the extraction can continue. I just can't imagine the average person thinks that when they're using a dating site or other other services, companies secretly feeding images of their face into a third party facial recognition AI. And then briefly, you know, a second, I think, much better path. I think two days ago now, the FTC finalized a resolution against the data broker, Cochaba, for selling the precise location data of millions of people. But instead of just demanding better privacy policies, the FTC secured an order that places substantive limits on data collection and use. So Cachaba is now legally barred from selling that sensitive data unless it's used to provide the service directly requested by the consumer. So I bring these up by way of examples. Obviously, cases prosecuted under Vermont's privacy law will look different, but I think that core choice is is quite similar. And so, you know, I just ask which regime Vermonters would like to live in. When a company abuses your data, will it help to know that an explanation was hidden in the user agreement, or should the law ensure that companies simply don't collect or share what they don't need? And then, of course, as we enter the era of artificial intelligence, I think strict limits on data collection are essential. AI powered inferences means companies can now deduce highly intimate details about Vermonters from mundane, nonsensitive data. If AI can turn everyday data into a window into private lives, I think procedural disclosures have even less protection. You know, opponents of the bill have already said that substantive data immunization is untested or that it may break the Internet, but truth. I think it can help fix a broken market. The data economy incentivizes people to extract the most personal information to people instead of squarely providing value to them. So the FTC has already broken ground on substantive data protections, and in fits and starts, it's continuing that work. And so I think the federal government showed on the efficacy of this framework, and I think Vermont should choose to go, to continue that working going forward. So I just urge you to preserve the strong data immunization provisions in s 71. And by doing so, I think you'll ensure that Vermonters can participate in the modern economy, safely and fairly. And, thank you very much for your time.

[Rep. Michael Marcotte (Chair)]: Thank you. Any questions?

[Rep. Monique Priestley (Clerk)]: Just thank you so much. I was just wondering if you could, as we try to balance basically minimization, but then we attach it to disclosed purposes, which then potentially opens up a whole sphere of things. I'm just wondering if you can help us with minimization, but the disclosed purposes and consent and how just kind of the interplay and what we have to be careful of, I guess, here.

[Gaurav Laroia]: Right. You know, so going back to my background, there was this case, Drizly, the alcohol delivery app, and we you know, in in in breaking ground on these kinds of disclosures, the FTC mandated that the Drizzly had to publish a data retention schedule, and explain exactly what the business's business purposes for each point of its data collection, will be in the future. I think, you know, that is that is certainly, I have to admit, that moves the ball forward. I think that these kinds of disclosures do have some disciplining effect on the collection, especially because they have to articulate the actual reasons why they are, collecting and using this data. But, again, the over you know, disclosure alone on policies that obviously no person can read and regulators, you know, will be overwhelmed in reading as well, you know, don't actually place those substantive limits. Again, in the Contava context, you know, that sensitive data can still be used if the user opts in, and that is my understanding is similar to what seventy one contemplates. But, of course, that that usage is further limited only for the purposes that the, the for the services that the user has requested, meaning that you can't opt in to, you know, unlimited data usage, retention, and the other things which minimization is concerned.

[Rep. Michael Marcotte (Chair)]: Thank you for joining us this morning. We appreciate your time.

[Gaurav Laroia]: Alright. Appreciate it. Thank you.

[Rep. Michael Marcotte (Chair)]: Thank you. Meeting will take five minutes. Five minutes. Enough. So we'll go offline back here in five minutes. We have