Vermont Legislature SmartTranscripts:

[Rep. Michael Marcotte (Chair)]: Good morning, everyone. This is David Marhaas, Commissioner of Commerce and Economic Development. Is Tuesday, 05/07/2026, at 11:23 in the morning. So we use this time to just have a committee discussion on the '71. We might be going auction committee members by the chain. So I think it sounds like me, at least we've had some discussions moving in the direction of Connecticut 2025 may be helpful in everyone. Also building we're looking at our definition regarding kids' codes, making sure that we're following those definitions as well. And so we're asking Rick to do some drafting, the first batch of those done, but he's more asking him about something. I've wanted everybody's thoughts and maybe if you can

[Rep. Monique Priestley (Clerk)]: alright. Let me just go through what I'm okay. So right now, so working with Rick on a base of just hearing from testimony as well as trying to pick up everybody's thoughts on committee, starting from a base of Connecticut 2025, the data minimization standard, basically working off of where Connecticut is in 2025 with the disclosure and consent framework, Resetting all of the targeted advertising and all that kind of related stuff. So target advertising to the definition that Connecticut has in 2025, removing all of the definitions that would rely on the adjustments you're making. So no first party, no contextual, no unique persistent identifiers, no marketing measurements. I think off the top of my head what that is.

[Rep. Jonathan Cooper (Member)]: When you say no, you mean?

[Rep. Monique Priestley (Clerk)]: Removing those definitions. Yeah. So we'd basically just be working off the target advertising definition that Connecticut has 2025, which is the definition that is shared amongst all the other states. They didn't veer in that definition twenty twenty five versus where they had been that I know of. Sensitive data definition, removing some of the ones we heard about that would be problematic for businesses. So removing keystrokes. So this would be updating twenty twenty five but removing keystrokes and online activity as the ones that businesses said would be the most problematic. I think I can look, but there's a few that Connecticut wouldn't have. We'd love to discuss things like status as pregnant, something that is updated in other states like Connecticut did not update in 2025. I'm happy to look up the specific if you want. Removing so there's a line at the end of the loyalty program protections. So removing that businesses were saying would interfere with their loyalty program. So removing that loyalty program sentence to reset it to what is Connecticut '20 25, adjusting the primary HIPAA related data level exemption to copy 121, which is based on and Herb, I know you're working on something. So if you have other ideas, but right now it is resetting to what we had on 01/2021, which is the HIPAA entities, but excluding the component pieces You you were

[Rep. Michael Boutin (Member)]: said you said on '21?

[Rep. Monique Priestley (Clerk)]: Yeah, yeah. Which is when I asked them on the record the other day. Yeah, yeah, yeah. The hybrid is like the pharmacy. Exactly. It's the ones that don't necessarily completely follow HIPAA. Yeah.

[Rep. Herb Olson (Member)]: Got it. So you're saying 02/21 already made that distinction between covered entities and their Components. Designated components? Yeah.

[Rep. Monique Priestley (Clerk)]: And if you were working if you were working on something

[Rep. Abbey Duke (Member)]: else Oh, no. Okay. Compare notes.

[Rep. Michael Boutin (Member)]: Is that throughout the actors' ad? Will you

[Rep. Monique Priestley (Clerk)]: There's just one here. Hold on. Let me I can read it to you.

[Rep. Edye Graning (Vice Chair)]: That was said that you wanted to say stop, slow down.

[Rep. Monique Priestley (Clerk)]: Yeah. And I can totally go over shit in more detail for sure.

[Rep. Michael Boutin (Member)]: I guess what I'd wanna know is what's different in our law versus Connecticut's.

[Rep. Monique Priestley (Clerk)]: Yeah. So I'll do should I just keep going?

[Rep. Emily Carris Duncan (Member)]: Okay. I think it was. Okay.

[Rep. Jonathan Cooper (Member)]: On your way to finding something that I was curious about.

[Rep. Monique Priestley (Clerk)]: Can we maybe I'll come back to That'd

[Rep. Michael Marcotte (Chair)]: be great.

[Rep. Abbey Duke (Member)]: Which order should I

[Rep. Emily Carris Duncan (Member)]: do to say? Whichever. Okay.

[Rep. Monique Priestley (Clerk)]: I'm gonna flag coming back to hippos. Okay. So the so okay. There's so in Connecticut 2025, just so you get something that we have not it's not been heard generally testified that I just want to make sure you are all aware of is the 2025 pieces that we didn't have in our draft. Because when I pulled over 2025 from Connecticut to be a base, we only were doing it with definitions and the hot button kind of related items. 2025 has additional things like impact assessment updates, transparency updates, the use of data in AI systems, appealing automated profiling decision making type stuff by AI systems. So those are in this draft as well. We're basically making a copy of Connecticut twenty twenty five, updating all of it. The thing a thing that is different, which I would love to discuss, is but a and Rick reviewed it, which is a civil rights protections for anti discrimination and profiling that is in Maryland. And that's a thing I would personally love to discuss with people and go over. There's a few clarifying pieces from there's, like, two clarifying pieces from Colorado and California rulemaking where they made clarifying adjustments. There's a few clarifying protections that I think we had people who testified yesterday about the relationship. So not only does this bill seek to give guidance to businesses, protections for consumers, but it also has so you have basically requirements of controllers, so the entity that's taking in the data and that kind of stuff, and then requirements of the processors, not only to the consumer but also to the controllers. So if I'm a business I'm using Salesforce or HubSpot or something, my website, that kind of stuff, this not only outlines what I have to required for my to run my businesses, but it also is what Salesforce, HubSpot's blah blah blah's requirements are to me as a business. So there's a few contractual clarifiers that more or less protect the businesses from the systems they're using to not be able to abuse the data that they are using the systems for. And I'm happy to go over those. It aligns we're trying to make sure Are

[Rep. Herb Olson (Member)]: those third party obligations? It's processor obligations to the controller. Well, but a contractor of the processor? Is that

[Rep. Monique Priestley (Clerk)]: what you're The processors are like, it is in the there's, like, pieces where it's, like, the contract that there needs to be basically, it's saying that the contract needs to be clear from the processor to the controller Oh, is that kind areas.

[Rep. Anthony "Tony" Micklus (Member)]: Yeah, yeah, yeah.

[Rep. Monique Priestley (Clerk)]: There's just trying to do careful alignment with kids code on the data broker bill to make sure we're not passing bills that are then going to be in conflict with each other. In this one, have maintaining the sale of sensitive data and not using sensitive data in target advertising, reiterating that we have removed online activity and keystrokes, which was a trigger for the business community. I am interested in discussing a private right of action at $1,000,000,000 through the underlying Consumer Protection Act, requires people to prove harms. So essentially, it's one sentence that says, the AG is solely the enforcement body unless a condition is met and the condition is the company makes a billion dollars or more in revenue in which they'd have to prove harms if they were trying to use it. Understand if that's not something people want to do. I just would love to have that discussion. Tony, I'm curious what you think about the I just have a note for the data protection standard pieces in particular. Curious about that, especially if we were to attach it just to sensitive data and just to a large data holder, somebody that holds 30% of the population or more or something arbitrary. Anyways, that's it. And I can go back through if people

[Rep. Abbey Duke (Member)]: watched. Okay.

[Rep. Edye Graning (Vice Chair)]: Rick is putting language together that covers this

[Rep. Abbey Duke (Member)]: scratch, And so we were hoping to have language to review.

[Rep. Edye Graning (Vice Chair)]: But this is a good conversation to

[Rep. Abbey Duke (Member)]: have where we can go back when we see

[Rep. Edye Graning (Vice Chair)]: the language and say, this works, this doesn't work.

[Rep. Monique Priestley (Clerk)]: So Jonathan, currently, as we've had in committee on the draft 2.3, the exemption was protected health information under HIPAA, so it was a data level exemption. So the language from 121 that currently have as a proposal is from one twenty one, which is a covered entity so it's an entity level exemption. A covered entity that is not a hybrid entity, any health care components of a hybrid entity, or a business associate.

[Rep. Jonathan Cooper (Member)]: You were just reading something that I haven't read.

[Rep. Monique Priestley (Clerk)]: Yeah. No. This is this is what's, like, proposed in that draft for Rick to yeah. It's

[Rep. Herb Olson (Member)]: yeah. And that's in in 02/11?

[Rep. Monique Priestley (Clerk)]: That's in 01/21 from 2024 that we passed out that passed that was vetoed.

[Rep. Jonathan Cooper (Member)]: At the toe

[Rep. Monique Priestley (Clerk)]: And at the time, it had been out of trying to work with everybody to get a finely crafted thing.

[Rep. Herb Olson (Member)]: So you're going back to the bill?

[Rep. Monique Priestley (Clerk)]: The yeah. That's what I'd asked about when they were testifying.

[Rep. Herb Olson (Member)]: Yes. I I I kept

[Rep. Monique Priestley (Clerk)]: looking Just on that one sentence. Actually. No. No. No. No. No. No.

[Rep. Jonathan Cooper (Member)]: I should have thought

[Rep. Michael Boutin (Member)]: that question.

[Rep. Jonathan Cooper (Member)]: I'm trying to go behind us at that time that you addressed directed that to was somebody from Vaz? Representing the small providers? And I think there was a third individual representing.

[Rep. Monique Priestley (Clerk)]: We had a whole room full. Kevin Green from the medical side, I think, the one who answered it.

[Rep. Jonathan Cooper (Member)]: But it felt like it was that just so would you say that only one of the entities that was testifying that day with respect to 71 said that that was I

[Rep. Monique Priestley (Clerk)]: don't know because they were representing a broad coalition. They I asked them to clarify.

[Rep. Edye Graning (Vice Chair)]: We invited all of them, and they said that one person would be speaking for everyone.

[Rep. Jonathan Cooper (Member)]: Well, some of them but several of them spoke. I think there

[Rep. Anthony "Tony" Micklus (Member)]: Yeah.

[Rep. Herb Olson (Member)]: Yeah. There were two.

[Rep. Jonathan Cooper (Member)]: Yeah. There were at least I think there were more than two.

[Rep. Herb Olson (Member)]: Well, was Jess

[Rep. Michael Marcotte (Chair)]: and I. Uh-huh, Jessa.

[Rep. Herb Olson (Member)]: Jessa and Sue.

[Rep. Jonathan Cooper (Member)]: Gavin. And then Susan or something. It was a woman that was talking about a very small scale health first. Is it safe to presume that all of those are comfortable with this?

[Rep. Monique Priestley (Clerk)]: I asked them offline to

[Rep. Abbey Duke (Member)]: check with their people.

[Rep. Monique Priestley (Clerk)]: I mean, because the thing I've not received any language from any

[Rep. Jonathan Cooper (Member)]: Smaller providers, I guess, is the thing that's sort of on my mind. Yeah. Yeah. So clinics and, you know, I saw the the small place that my daughter goes in North Bennington. So I was just like, okay. I hope that they're feeling comfortable with the one twenty one.

[Rep. Monique Priestley (Clerk)]: I've not received anything in writing. I've just

[Rep. Jonathan Cooper (Member)]: Either way. Yeah. Okay. Well, that's good to know. Yep. That's something to follow. The other thing I wanted to, if I could just You went through some of the things that were being stricken, keystrokes, etcetera. Can we just go through

[Rep. Monique Priestley (Clerk)]: those? Totally. Yeah, yeah, yeah.

[Rep. Jonathan Cooper (Member)]: So I can

[Rep. Edye Graning (Vice Chair)]: Page 16 of the bill that

[Rep. Abbey Duke (Member)]: we have now is for sensitive data.

[Rep. Monique Priestley (Clerk)]: I was trying to work up highlights of my own stuff. Yeah. So for sensitive data, removing k keystrokes and removing n are the online activities of a consumer over time and across devices, websites, online applications, blah,

[Rep. Michael Marcotte (Chair)]: blah, blah.

[Rep. Herb Olson (Member)]: So K and N?

[Rep. Monique Priestley (Clerk)]: Yep. And

[Rep. Jonathan Cooper (Member)]: all the draft is including all the other elements.

[Rep. Monique Priestley (Clerk)]: Yes. I mean, that's totally wanna hear from committee on that.

[Rep. Jonathan Cooper (Member)]: And there was there was a discussion of as an example of pregnancy. Was that am I

[Rep. Monique Priestley (Clerk)]: looking Yeah. Hold on. Let me hold on.

[Rep. Anthony "Tony" Micklus (Member)]: Let me back. I gotta open up.

[Rep. Monique Priestley (Clerk)]: Okay, so if you look at the definition of sensitive data itself, the definition I'm going to only say what's unique between what we have and what Connecticut twenty twenty five is, if that's Okay because that's all I have right in front of me. So Connecticut twenty twenty five did not have under B, reveals a consumer's racial or ethnic origin, so they don't have national origin. In that same subsection, they do not have where it says religious beliefs, we have religious or philosophical beliefs. Continuing in that same subsection, they do not have status as pregnant. They do not have income level or indebtedness. And they do not have union membership. And then they do not have is a consumer's tax return or account number, which is e. Everything else is the same.

[Rep. Jonathan Cooper (Member)]: It's the idea that what's being proposed is to align it with Connecticut or to add these elements into?

[Rep. Monique Priestley (Clerk)]: Our 2.3 currently has additional elements that I just mentioned. Suggesting we leave those. I haven't heard anybody say they don't want those elements protected, but would love to hear from committee if they don't think that pregnancy status, for instance, should be protected.

[Rep. Herb Olson (Member)]: I don't want to preempt.

[Rep. Monique Priestley (Clerk)]: No, no, you're good. You're good. I think we're all good. Think we're fucking So,

[Rep. Herb Olson (Member)]: touched on one of the issues, which was the HIPAA issue. Yeah, yeah. And in particular, I thought there were two sort of categories of issues. One was the hybrid approach and the framework for HIPAA entities to designate, say, the retail store or the pharmacy. Yeah,

[Rep. Anthony "Tony" Micklus (Member)]: yeah, yeah.

[Rep. Herb Olson (Member)]: And I wanna make sure that we get that right. And I've done some thinking about that, but I'd like to see what you did on that too. Because I think, personally, I think the HIPAA exemption advise you should be directed at the Truly Health editors and not their retail store or whatever. And then there could be other things. But that's one. And then the second thing I heard from the witness was that there are some entities that are medical practices, pre clinics or whatever, that are not covered by HIPAA. And my takeaway from that was, why would they not have the same type of protection or exemption as the ones that are formerly HIPAA? So I'd like to address that. I don't know the perfect way to do that, but I'd like to address that in some way too.

[Rep. Monique Priestley (Clerk)]: Can I ask a clarifying question? So, are you saying you do want them to be covered by data protections, or you don't want to be, or you want them to see their data covered as if it was HIPAA type of thing?

[Rep. Herb Olson (Member)]: I think I would want them to be exempted from the statute in the same sort of manner that their counterpart that's actually a HIPAA covered entity would be. Thinking about the three clinics. I think they mentioned some Oh, they mentioned direct providers, for example.

[Rep. Michael Boutin (Member)]: Subject

[Rep. Herb Olson (Member)]: to similar limitations that HIPAA imposes on covered entities.

[Rep. Monique Priestley (Clerk)]: So so so that's in that last piece, you're saying the we had a version at one point that was like there are similar entities, so as long as they treat their data as if they were covered by HIPAA, it's okay.

[Rep. Herb Olson (Member)]: Yeah, and maybe not the whole panoply of HIPAA, because that's really complicated and it sort of ties it. There's a lot

[Rep. Monique Priestley (Clerk)]: of I need you to

[Rep. Emily Carris Duncan (Member)]: craft this, Herb. I need you to craft this, because So

[Rep. Herb Olson (Member)]: it just seemed to me that if we were exempting these folks who are HIPAA covered entities in the business units under the law, it seems rational to me that you would want to do so for medical practices that serve the same function.

[Rep. Edye Graning (Vice Chair)]: But the reason that they get an exemption is because they're protecting the data under So adding an exemption for someone that is not required to

[Rep. Abbey Duke (Member)]: protect data goes contrary to data privacy.

[Rep. Herb Olson (Member)]: Unless you also include an exemption or requirement that they have protections for their consumer health data. What kind of protections? What is it? Privacy, security.

[Rep. Monique Priestley (Clerk)]: It's like what standards, though. I think that's a

[Rep. Herb Olson (Member)]: I know. It just seemed to me anomalous that we would be subjecting, say, a free clinic who's not technically a HIPAA covert entity differently, especially the size of them.

[Rep. Monique Priestley (Clerk)]: So,

[Rep. Herb Olson (Member)]: understand it might be a little complicated thing to identify what sort of protections we're talking about as similar protections. I'm just talking about if we're having a broad discussion around the things that are on my mind around health care practices.

[Rep. Michael Marcotte (Chair)]: Can you touch base with Yeah. And and Devon?

[Rep. Herb Olson (Member)]: Yes, I can. I also touch bases with Mhmm. Jill. Yes.

[Rep. Michael Marcotte (Chair)]: And just bring them together and sit down with them.

[Rep. Herb Olson (Member)]: I'd be happy to.

[Rep. Michael Marcotte (Chair)]: And then have that discussion. Maybe we need a better understanding of how things work

[Rep. Herb Olson (Member)]: in here, so that we feel more comfortable. That's good to be happy to do that. I've also been in touch with a witness. Can't remember. Gabriel? What was her name? The woman we had that had

[Rep. Michael Boutin (Member)]: Oh, Christina. Christine.

[Rep. Monique Priestley (Clerk)]: Yeah, yeah, yeah. It's consulting, I think. Because

[Rep. Herb Olson (Member)]: she seemed to have some expertise that, frankly, was a little beyond me, And I wanted to make sure that it worked in the manner that I was kind of intent.

[Rep. Monique Priestley (Clerk)]: I think two things just to flag for you to wrap into your conversations is things that could be high risk that have come up in the past, so like crisis pregnancy centers and other similar nonprofits, and also things like if you start exempting entities that are taking healthcare data, you also need to think about AI therapy solutions, Amazon health and pharmacy stuff, Walmart pharmacy. Oh, okay. Anyways.

[Rep. Abbey Duke (Member)]: I ended my device.

[Rep. Monique Priestley (Clerk)]: Oh, your device. Okay. Thought you're taking time. Yes. Smart devices, this whole realm of

[Rep. Herb Olson (Member)]: I gotta believe

[Rep. Monique Priestley (Clerk)]: it. Big tech I gotta believe it. Trying to use these exemptions to then serve monetary

[Rep. Herb Olson (Member)]: services. Saying it's simple, but Yeah, seems to me

[Rep. Abbey Duke (Member)]: course, yeah. And also, because when you

[Rep. Emily Carris Duncan (Member)]: get into all this stuff, all

[Rep. Abbey Duke (Member)]: this starts to mix in with medical very quickly.

[Rep. Herb Olson (Member)]: So the other issue, talking about general issues, it's been a long time. I mean, common law back in fourteenth century, I think talks about That would be first

[Rep. Emily Carris Duncan (Member)]: time. You

[Rep. Herb Olson (Member)]: don't have much of a right without a remedy. And I understand where we're going or what I see in the documents around, okay, we're gonna let the AG enforce. My concern is as good as those folks are and as hardworking as they are, if they're going up against a how many trillion? I can't remember. Looked at the valuations. It was just immense of Amazon, Google, that. However hard they work, however many states they join, I'm trying to think of a mechanism that's effective in terms of those big players, while not imposing something on the folks that aren't billion dollar companies. And so, I'm familiar with So the idea would be, not They can always recoup under the Consumer Protection Act, they can always recoup their costs in a final judgment. Those kinds of enforcement actions take on them, and you need people who have a lot of expertise in the subject matter to really do the trick of analyzing the alleged violation, and even bringing it to court. So, think the AGU's office needs some wherewithal to be able to conduct the investigation and analysis prior to the judgment. There are provisions in both insurance, regulatory regimes, and financial institutions, and things that allow the regulated to charge the entity, the regulated entity, for the costs of what they need to do to investigate the alleged violation. I understand that you wouldn't I would wanna have a threshold for that in terms of the size of the company. And I can see it being quite large. These are huge companies, some of these. So, she's setting that threshold for when the AG can look to basically get an advance on the cost to really only the big, big, big company. But that's the idea that I'm thinking of.

[Rep. Abbey Duke (Member)]: Can I zoom us out

[Rep. Edye Graning (Vice Chair)]: a little bit? We don't have language to talk about, but what do folks think generally? I know we care about the details, because that's why we're here, because we care about the details. What do folks think generally about this direction? And you can add herbs remedies to what Monique brought up and just give people an opportunity to talk about that in the twelve ish minutes that we have.

[Rep. Jonathan Cooper (Member)]: I can commence down to twelve minutes. I'm really, appreciative that, you know, we received that testimony from Nut Free Chocolates that specified the cross platform behavioral data of n that it's like, okay. Now I'd really like to see how they feel. Like, with that removed, does this free them up to continue business as usual? Because that's, I think, an important acknowledgment of some testimony that we got that really did give us good thing to work on. So I really am appreciative of that, and I am interested to hear how that edit may free up, or just the extent to which it may free up some of the existing practices that allow Vermont businesses to stay competitive in the way that they need to. I like seeing that sort of input get reflected back in the legislation, the post decision.

[Rep. Michael Marcotte (Chair)]: Which issue was that, Jonathan?

[Rep. Jonathan Cooper (Member)]: This had to do with the sensitive data. We adjusted N, Oh yeah, N. Online so we heard from a business in Vermont who emailed us and it said that, yeah, this is cross platform behavioral data that they need to use.

[Rep. Anthony "Tony" Micklus (Member)]: Things on the pregnancy thing. I want to expand this out a little bit to even religious things But as here's for the pregnancy one, I'll give an example that I think we can all relate to. A young couple finds out they're pregnant and they want to have a baby shower. Well, I don't know about you, but I've had a lot of invites to baby registries where they have a list of gifts that they really could use, and I would not want to have legislation that prevents that. That would be my concern with making pregnancy sensitive data. Would that not allow a couple to have a baby shower?

[Rep. Herb Olson (Member)]: No. Okay.

[Rep. Anthony "Tony" Micklus (Member)]: Yeah. No.

[Rep. Monique Priestley (Clerk)]: I can say that was confidence.

[Rep. Anthony "Tony" Micklus (Member)]: Right. The second point is on what you and I were talking about, about cybersecurity. Yeah. And I was doing a little research. It should be NIST CSF two point zero would be the standard. Okay. It's a pretty low standard. It's it's a stand relatively speaking. I mean, it's not the level of, like, Department of Defense. That's the standard, like, with all of my IT clients. That's the standard I go with. The two point zero? Yeah. Which basically says, you need to have a plan. You need to have a backup. You need to put multi factor authentication. You need to apply in a nutshell, it says, you need to apply reasonable protections protections to the data. And I think it should absolutely be required for data processors. I don't care whether you're carrying one person or 100. Controllers, once again, my preference would be, doesn't matter. I don't care if you have one record. All of that should be protected, but I'm open there. Because a of controllers, like I'm a data controller, I didn't write my own CRM. There's another company that does it, and I trust. I mean, obviously, I've done research to make sure I trust but verified that they can handle that.

[Rep. Monique Priestley (Clerk)]: Yep. About Tony, so if you suggest, like, if say just hypothetical. Say it's a zero threshold, which I think it I like I do support, like, a bigger business. But say for that, what about, like, an implementation date of, like, a year from now or something specific to this company? As as much time.

[Rep. Anthony "Tony" Micklus (Member)]: Yeah. We need to give people a reasonable amount of time to get there. Okay. Yeah.

[Rep. Abbey Duke (Member)]: Yeah. Okay. Big very big picture. I

[Rep. Edye Graning (Vice Chair)]: think we need to stay within regional kind

[Rep. Emily Carris Duncan (Member)]: of regional standards. So, obviously, there's

[Rep. David "Dave" Bosch (Member)]: gonna be details and language to look at. But, you know, conceptually,

[Rep. Herb Olson (Member)]: I I support this direction. The can I get do that?

[Rep. Anthony "Tony" Micklus (Member)]: Medicate the 01/2025. General. General.

[Rep. Emily Carris Duncan (Member)]: I

[Rep. Michael Boutin (Member)]: appreciate we're notching it back a bit. I do wanna point out that there's only 20 states that have passed privacy laws, correct? 21. Yep. 21. And for regional, we've got New Hampshire and Rhode Island and Connecticut and New England. Connecticut's further. New Hampshire is what Connecticut was, and so isn't Rhode Island minus the 25,000. I didn't mean to almost hit you there. So and then you've got other states that hasn't passed anything, which, you know, one of the things that I think that Vermont should do is, again, not lead on this, and Connecticut's laws 2025 haven't even gone into effect. So Correct?

[Rep. Monique Priestley (Clerk)]: The updates from 2025 is

[Rep. Michael Boutin (Member)]: on effect on July 1. Right. So we don't even know how those affect the state. And I'm thinking, and the more this conversation goes, just feeling about how the future is, how things are presented to us, Not presented to us, that didn't come out because that made it sound something different. Our path. And I said this in my email last night that I sent to everybody. You didn't see an email?

[Rep. Monique Priestley (Clerk)]: I did. We all have

[Rep. Emily Carris Duncan (Member)]: an email. If you confirm.

[Rep. Abbey Duke (Member)]: I can read it.

[Rep. Jonathan Cooper (Member)]: Yeah.

[Rep. Michael Boutin (Member)]: There's three directions we can go, which I'm glad that we're ratcheting the bag.

[Rep. Michael Marcotte (Chair)]: I went to the bottom.

[Rep. Jonathan Cooper (Member)]: Yes,

[Rep. Michael Boutin (Member)]: which I think that's important for us to know. And I just This whole conversation, we need to have balance. And I actually think the balance would be S-seventy one as passed by the Senate. It puts us right in the middle of the the New England states. Right? New York, Maine, Massachusetts. Do they have a privacy law?

[Rep. Monique Priestley (Clerk)]: So I'm happy to

[Rep. Herb Olson (Member)]: go. I'm gonna

[Rep. Monique Priestley (Clerk)]: be talking about New York, Maine, Massachusetts.

[Rep. Michael Boutin (Member)]: Oh, do they have one on the record?

[Rep. Monique Priestley (Clerk)]: No, because they're trying to So those three have no

[Rep. Michael Boutin (Member)]: privacy law. New Hampshire has Connecticut, and so doesn't Rhode Island. And Connecticut has an updated version that's closer to 2.3. If we were to pass S71 with modifications to include language that accommodates for kids code, which I supported heavily. And I lobbied people for that, took cuss words in the cedar rope over it. I think that is the best route for us to go. I just the more push on this, the more I feel that that is the right direction to go. It's our businesses who constantly are complaining about regulation, are yelling at us saying, Hey, stop. And with that, that's where my thought process is. And I really think that that's where we should head. And I appreciate, again, you have come so far, but there are people that have come just as far on the other side of not thinking we need a database.

[Rep. Edye Graning (Vice Chair)]: You could send me that email because it did not.

[Rep. Michael Boutin (Member)]: You know what? I specifically

[Rep. Monique Priestley (Clerk)]: This Health Commerce.

[Rep. Michael Boutin (Member)]: Yeah, I replied all to your email.

[Rep. Monique Priestley (Clerk)]: It was a reply all to mine. That's

[Rep. Herb Olson (Member)]: what it was. Yeah.

[Rep. Michael Boutin (Member)]: Oh, it's because you get an iPad. That's my statement. And I just, I think I appreciate all of it. I just don't think our businesses are ready for this. They're not going to pay for Well, I sure hope that a lot of our businesses are ready for it. Especially if they're doing business outside the state, they have

[Rep. Michael Marcotte (Chair)]: to be compliant with the other states. I think they're ready for it.

[Rep. Monique Priestley (Clerk)]: They're gonna

[Rep. Michael Marcotte (Chair)]: just complete it. The really small ones may not be ready for it, but I think what we are going to craft, I think next year, we're already talking, making sure that there's money in the budget for technical assistance, that in this bill, that there will be an eighteen month implementation before it goes live, which gives everybody plenty of time to start educating our business community about how this is gonna work. And I mean, my thinking, is that why would we because New Hampshire and Rhode Island determines that they're satisfied with Connecticut original. Why does that Why do we have to be satisfied with that for our consumers? Why can't we at least have our consumers have the same protections that Connecticut 2025 has? Top of that, if we have an eighteen month implementation, we're gonna know how Connecticut's works. There's issues, we have eighteen months to fix it. So, I want to make sure that our businesses can comply and that we're not overburdening them. And I don't believe that we are with the changes that we're making and if there's some other things that we need to tweak, I'm all for that. But to just say that 2023 or 2022 Connecticut is fine because New Hampshire and Rhode Island have it, I don't think we're being

[Rep. Michael Boutin (Member)]: fair to our consumers. Listen, it's a difference in our opinion, And at the end of the day, I've had this conversation with everybody here before. End of the day when I don't know, it is what it is. I'm stating where I am on this. I don't hold the same beliefs on it as others in this committee do. And I just think that I could really think that our best course, our surest course to get from here to the governor's desk to the law is by going by a 71 as passed by the senate with the modifications with kids code.

[Rep. Herb Olson (Member)]: That was an Iran

[Rep. Michael Marcotte (Chair)]: thing. What?

[Rep. Michael Boutin (Member)]: No, modern is

[Rep. Michael Marcotte (Chair)]: our Iranian. I like that.

[Rep. Abbey Duke (Member)]: Okay, I had to check. I understand. I hear, in some ways what you're saying. I think the thing that I get stuck on is that Connecticut instituted a lot and stopped it to make adjustments in China. If they felt that need, then it means that there is something that wasn't totally great with 2023, that needed a little bit more beefing up or realignment. But I'd rather, if we are gonna go forward, to align ourselves up with where they're at now. I am happy about this direction. I think that lining up with our regional neighbors is a helpful thing, especially for our multi state or multinational companies based in Vermont. As a small business owner, I understand that even I would be swept up with some of these things, but I want to be. I want to ensure that our environment, our data environment that is so critical for just getting basic services is actually robust. It's actually clean. It's actually providing the correct information in that we don't have subpar information going out into the world, into an AI driven world that can make inferences and deny you service based on those inferences. When I think back to Kids Code, I wanna fight for adults as much as I wanna fight for kids because adults are attached to children. Their future, their information also matters. So yeah, I think it's important to fight for adults too.

[Rep. Anthony "Tony" Micklus (Member)]: I would just say, I mean, my support comes from taking testimony from the business community. It seemed to me like that's something they were willing to live with, was Connecticut. Yeah.

[Rep. Michael Marcotte (Chair)]: Which version?

[Rep. Michael Boutin (Member)]: Well, we're gonna take more testimony after, so we'll get clarification.

[Rep. Herb Olson (Member)]: Can I just add a little piece to what you were talking about in terms of next year or whenever, making sure there's outreach and education and stuff like that? I think that guidance from the AG and safe harbor stuff would be helpful. I know they're reluctant to do that. If I were in their shoes, I wouldn't want to have to write things that I wouldn't have to be banned by. But I think in this environment, it might be really helpful for them to do that, if they have the resources and all that, because I think it would give some comfort, especially for some of the businesses that aren't so familiar with the ins and outs to say, Okay, if I follow this around this particular issue, I'm okay.

[Rep. Abbey Duke (Member)]: Yeah. I also want to concur. I'm very excited about the tobacco assistance. I think it's really We want our small businesses to also be able to meet the mandate.

[Rep. Michael Marcotte (Chair)]: In the honor, that's something that we think we included in 01/21.

[Rep. Edye Graning (Vice Chair)]: Yeah. Yeah. Yeah. Some office and stuff.

[Rep. Michael Marcotte (Chair)]: Yeah. So Yeah. I think that's something that that will needs to

[Rep. Anthony "Tony" Micklus (Member)]: be a.

[Rep. Monique Priestley (Clerk)]: Definitely. Yeah. Super, super great. I just want to because Abbey, you had a question about the Maryland AG stuff, so I followed up with the legislators who have been the leads on their bills and stuff. And so they have not been enforcing so far, and not due to a their lack law not being something that people can follow. It was expressly that they don't have the staff and time to do it. They basically said, we can't do anything until you give us money to hire more staff. Got it. And so this year, Maryland passed legislation to give them a budget for privacy stuff. Nice to it. So now got it.

[Rep. Michael Boutin (Member)]: Yeah. So k. That makes sense.

[Rep. Abbey Duke (Member)]: Yeah. How much did

[Rep. Herb Olson (Member)]: I budget this? I have no idea.

[Rep. Michael Boutin (Member)]: Didn't look. But Yeah. Yeah. Okay.

[Rep. Michael Marcotte (Chair)]: So we're eating in three to one. Yep. So So sweet. Well, it's me, if Rick we're hoping that he'll have a dry horse by tomorrow afternoon. At 01:00, we will look we'll have Cameron in and Susan McClure in as well to look at the version of five twelve that's being sent back to us to see if we can concur with that or not. And then we'll have Rick come in and walk us through the language. The language will be out so everybody can have a look at it and kind of go through it over the weekend and let us know if there are pressure points in there that we need to discuss and continue to work on it next week. Tuesday, we'll be working on H-six 48, so we'll delay action on that Herb, tomorrow for two legislative days. We're hoping We'll do that. I mean, request it. I'll let the speaker know, that we can bring that to the floor on further amend and send it back over to the Senate. Then we'll put things together next week. We'll continue to work on the 70. Okay. So we can go off live. I doubt that we're gonna have time come back in here this afternoon by the sounds of it. So we'll be back here at nine tomorrow just to see if things change.