Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Wednesday, 05/20/2026 at 09:05 in the morning. We'll review to continue our discussions and deliberations on S-seventy one. First up, we have Andrew Guggenheim. Andrew, good morning. Good morning. Thank you for joining us this morning.

[Andrew Guggenheim (SIFMA)]: Well, mister chairman and members of the committee on commerce economic development, my name is Andrew Guggenheim, managing director and associate general counsel for the Securities Industry and Financial Markets Association or CFMA. Thank you for inviting me to testify this morning. CFMA is a national trade association representing over three fifty large, medium, and small broker dealers, investment banks, and asset managers, many of whom have a strong presence in Vermont. In fact, nearly 8,500 people are employed in the financial services industry in Vermont. There are three broker dealer main offices and five seventy eight financial advisors. The purpose of the language before you in this exemption is to narrowly tailor a broad based industry exemption to those entities that are actually regulated, overseen, and examined for their compliance with consumer data privacy requirements. The language specifically identifies who, as defined in Vermont statutes, is subject to the exemption and requires that they be a regulated entity. The goal is to prevent entities who are not regulated and not subject to oversight from trying to claim this exemption, which as I understand it was the purpose behind Connecticut including similar language in their 2025 update. The Grant Leach Biley Act was specifically designed to place privacy requirements on financial institutions. This law represented the first time that Congress enacted sector specific comprehensive privacy and data security requirements. Securities firms are regulated and examined by the Securities and Exchange Commission, the Financial Industry Regulatory Authority or FINRA and the depart the Vermont Department of Financial Regulation. To tailor the requirements of GLBA to securities firms, the SEC adopted Regulation SP, which was last updated in 2024. GLBA and Regulation SP strike a balance between the consumer's privacy interests and the need for information to complete financial transactions with robust privacy and data security standards and the need to comply with antifraud, money laundering, and illicit financing requirements. GLBA requires financial institutions to provide consumers with notice relating to the collection and handling of consumer data and with information about their privacy and data security practices. Financial institutions are prohibited from disclosing information related to a consumer to a nonaffiliated third party unless that consumer is provided with notice and an opportunity to opt out. Vermont takes this one step further and requires an opt in for disclosure, a protection that the Vermont Securities Act regulations recently affirmed in their most recent update that was completed in April. This exemption is narrowly tailored and consistent with privacy laws in Connecticut as well as pending legislation in several other states. I'm I will pause there, and I'm happy to answer any questions.

[Herb Olson (Member)]: Questions committee?

[Michael Marcotte (Chair)]: Very clear. Okay, Andrew, thank you very much. All right, thank you. Megan, John? Good morning.

[Megan Sullivan (Vermont Chamber of Commerce)]: Thank you.

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: Sarah Marcotte, vice chair of granting members of the committee, Joshua Diamond on behalf of the Mott Chamber of Commerce.

[Megan Sullivan (Vermont Chamber of Commerce)]: Megan Sullivan, executive director. Nope. It's like flashback to the Betsy days and my heat stroke there. Vice president of government affairs for the Vermont Chamber of Commerce.

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: Thank you for this opportunity to chat a little bit about the latest draft. I believe it's 4.2 of s 71. Just to to set the table and to remind folks of really where the chamber is coming from at the end of the day, that there are three policy concerns that we have when we review these drafts. First and foremost, we wanna protect consumers. We wanna do it in a way that's regionally compatible for for several reasons or at least a couple. One is to make sure that the business community is not at a competitive disadvantage to those that are in our neighboring states. But also this is a complicated piece of legislation. And so using the lexicons of the definitions and the other provisions are important that they align with other states so that when businesses are trying to be compliant, they have a, frankly, a greater chance of success in doing so when there is common definitions being regionally because you can look at other states and see how they're doing as a way to say, hey, this is how we should do it here in Vermont. We appreciate that version 4.2 comes a long way to creating a bill or a piece of legislation that is regionally compatible, but there are some still meaningful distinctions. And I'd like to address a few of them. In particular, the effort to graft on the definitions from the kids code legislation into this general data privacy bill, we think creates some concern. And let me start back from my client's predisposition. We did not get involved in the kids code and in really examining the particulars because it was for a narrow purpose. It was to protect a very defined and vulnerable class, children, as well as applying to a narrow set of businesses who really were not our our membership at the end of the day. And so we think in light of that, to graft on those definitions creates ambiguities. I'd like to go through some examples of people prefer to have definitions that have been utilized in the other states so that we have that common lexicon. Let's start with biometric data. That definition that is used in this latest draft contains some specific examples of what biometric data is, and I think the chamber would be fine with that greater clarity. But it is the introductory paragraph that talks about, and I'll quote, the data generated from technological processing of an individual's unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer. And one example of the distinction between what's been used in other states and here is that term allow. Allow, we believe, is language that is inherently broad as opposed to what's used in Connecticut, Rhode Island, and New Hampshire, the phrase used to identify a specific individual. That is, we think, more concise, more precise, and allows for a greater opportunity for compliance. Another example is the definition of personal data. In that definition, and let me read the particular language that's found in version 4.2 that we think departs from the region. That includes information, including derived data and unique identifiers that is linked or reasonably linkable alone or in combination with other information to a device that identifies, is linked to, or is reasonably linked to one or more identified or identifiable individuals in a household. So, that concept of household also is new. There's other language in there that is new as well. And just by way of illustration, by utilizing household creates a compliance set of ambiguities for businesses. Because if, let's take a spouse, a couple, married or partners or what have you, that share a computer. How is the controller or the processor, but most likely the controller, going to know whether one party has said, yes, I want to opt out of direct advertising and the other doesn't. And yeah, if they can identify it back to the individual, that's one thing. But this here talks about household. And so you're going to have an inherent inconsistency and problems we think with compliance. That concept also applies to the definition of de identification as well. De identification departs from the regional model. Another area that we've identified where there's a departure that may create some ambiguity for compliance is in the definition of identified or identifiable in the reference to an identification number. Our understanding is that having identification numbers is really central to de identification. The only way that you can do that is to create some kind of algorithmic number or a bunch of symbols in replace of that identifying data of the person's name, address, things of that nature. So we think that that creates an inherent inconsistency for compliance as well. And maybe the most problematic we think of all the definitions is the definition of publicly available information, which does not align with our sister states. That includes an exemption. And let me read the exemption portion that I think is problematic to us. The definition excludes public information that is collated and combined to create a consumer profile that is made available on a publicly available website or made available for sale or an inference that is generated from them. So the thought is, as I understand it, you've got publicly identifiable, you've got public available information, and it makes sense that if it's out there, that's not gonna be treated within the confines of this legislation. But if I sell it, if I put it on a website, if I derive information from just that publicly available information, all of sudden in this regulatory construct, and that doesn't seem to make sense. If it's public, it's public. I should be able to do whatever I want with that public information. It could impact candidates running for office to the extent that you're creating get out the vote list from publicly available information and you're creating targets, then you're gonna fall within that exemption, and and that therefore is going to be a problem. I also think you're gonna have real serious First Amendment questions. Supreme Court's been very clear in a case called INS versus Sorrell. This was a case that was generated from Vermont, the Supreme Court that basically said it violated the first amendment for restrictions on the sale of pharmaceutical data. What is important, I think, in that case was the concept that data equals speech at the end of the day. And if it's publicly available information to start creating restrictions without the kind of concerns that might allow for the identifying of a compelling governmental interest or narrowly tailoring, which is kind of the test around First Amendment jurisprudence, I think you're gonna have some real problems. And if the information is already public out there and people already have access to it, what is the compelling purpose to regulate that? It's it's already out in the public ether. And I think if you start restricting public information, you're gonna find yourselves potentially with a serious first amendment challenge and exposure on that issue. So those are our concerns about not using regionally compatible definitions. I'd like to talk about applicability. Now, applicability regionally at this time, there are different levels. There is a 35,000 threshold, I believe, in Rhode Island, a 25,000 threshold in New Hampshire and in place now, although it's about to change, is a 100,000 in Connecticut. That's gonna be adjusted down to 35,000 starting July 1. Connecticut does have these one and done provisions, which we think creates real concern for the small business community. And in the draft before you, you also have those one and done provisions. So what it means is if you sell any data once, you're gonna fall within the statute. If you process or collect sensitive data, just one set, you're gonna find yourself within the confines of the statute. Let me give some just examples,

[Megan Sullivan (Vermont Chamber of Commerce)]: and

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: I know I've done this before about just the sensitive data. I think for professionals like lawyers, for accountants, and frankly, already have regulations that deal with confidentiality and a regulatory scheme to deal with this. Just a mere doing their job, matter how small the law practice or the accounting firm, they're gonna fall within the confines of this statute. I think anyone that does HR could as well. You can imagine HR folks who are collecting resumes. There may be information on those resumes about candidates or background that could include sensitive data about their ethnicity. It could be their race, could be about a disability. That's collecting sensitive data. And therefore, anyone who's doing that, any business that's doing that is going to find themselves within the confines of the statute. So we think that's highly problematic. We think you you should avoid that. Could there be some different thresholds for the sale of sensitive data? I think the chamber's willing to work with you on that. But I think the one and done is really problematic for Vermont's small businesses. We will also note that the exemptions regionally don't flow into this bill. While they are they are primarily not our members, certainly, the nonprofit community is not gonna have a categorical exemption. I think they're gonna be impacted by this legislation if it should be passed. I'd like to also note data minimization. The language is somewhat different from Connecticut. We think it's probably okay, but because we it's new, we're still digesting it. And I just wanted to put a placeholder there, but we think it moves in the right direction. And then finally on enforcement. In the draft that was passed by the Senate, because for many businesses, this is gonna be new. It's not that they're doing this necessarily for other states, that having the opportunity for a cure period, if it is functionally possible, we think is the right approach. The Senate version has, I think, an eighteen month requirement that the attorney general, if feasible, to provide a notice and an opportunity to cure before you start enforcement proceedings, we think that is a reasonable way to bring Vermont businesses along in this process. So

[Michael Marcotte (Chair)]: I think that's similar to what we had in the bill two years ago as well.

[Megan Sullivan (Vermont Chamber of Commerce)]: I think I think there was a shared period. So

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: those are those are some of the things that we're concerned about. We think this bill did move a lot in the right direction, but grafting on the kids code definitions in mass, we think is problematic as well as the one and done provisions as well.

[Emily Carris Duncan (Member)]: Thanks, Josh. Could you clarify for me, go back to that HR example, what activities that are the normal course of business that you see being disrupted here?

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: Yeah. So a lot of businesses notwithstanding what's happening in in Washington DC still wanna promote DEI principles. And underlying DEI is going to be sensitive data. So if you are collecting information about people's backgrounds, for purposes of creating a diverse workforce, that arguably could be the collection or processing of sensitive data.

[Emily Carris Duncan (Member)]: And does that feel like an area of ordinary language that could be is but is are we correcting is there other existing challenges with the way businesses are processing and holding, maintaining their their employees' data that's are we correcting something? Is there do you see this as being a corrective within within the business world?

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: From our perspective, I think it's the impact. I think a large business could probably absorb the technical requirements of,

[Megan Sullivan (Vermont Chamber of Commerce)]: okay, if we're collecting this data, now we gotta live with the whole statutory scheme. But if I'm a small business to take on the implementation costs because of what I do in a normal course, I think doesn't strike the right balance. And if I can just jump in with that. I have been thinking a lot about this and candidly trying to focus on my members, but thinking more about nonprofits. Right? Because the nonprofit exemption is not something that that Connecticut or the Connecticut does maintain a nonprofit exemption. So the one and done doesn't apply to nonprofits where it will in this. And, we have some nonprofit members. They tend to be larger nonprofits. But I work for a nonprofit. I'm on the board of a few nonprofits. So I keep coming back to, I think this is going to impact small nonprofits and small businesses in a more impactful way. Because that collection of sensitive data is something that nonprofits who may be based around an identity are more likely to have. I serve on the board of an organization. And as a board member, I'm asked, what is your demographic information? And that's specifically because people who are providing grants, whether it's state or philanthropic, wanna know what is the diversity of your board. We collect that information for the people who participate in the program, again, because those grantors want to understand, are you meeting your mission of serving your entire community? So thinking a lot about how how are nonprofits who are exempt in other states so this isn't gonna be like some of our businesses where, okay, I need to comply with Vermont in the same way I'm complying with these other states. Those folks are gonna be this is gonna be new to them. And I've been struggling to think about what what does make sense for our our smaller nonprofits versus our larger nonprofits and who are is gonna be collecting that information for granting purposes and for selling purposes when you look at how broad the definition of selling is. You know, we had a conversation with, one of the professional groups that collects tax returns. You could sort of guess who that might be, to say, like, okay. What is the difference between the really small guys and then the bigger guys? Right? The the guys who are probably, you know, gonna be complying with this versus the, you know, the at home person and that has to keep these on file for a certain number of years. They said around three thousand. So that would be what I throw out there as a number is 3,000. But I do think the thought on how this bill as a whole and those provisions is specifically where my mind has been tossing around, and I've been trying to talk to some nonprofit folks how this impacts nonprofits who operate very differently. They're not doing an e commerce business, but they are in the e commerce world. I think there's a lot of nuance here that will have to be thought about for those groups and when they might get brought in and what the requirements are that they have that's different than a for profit business.

[Edye Graning (Vice Chair)]: Thank you. I'm curious to know on this conversation about nonprofit is also a nonprofit worker, also runs nonprofit. I'm curious about if there are specific steps in what's being proposed that feel like they're gonna be a real pitch up, or is it just the fact that demographic information is being held and there will be a standard applied? I think my thought is, as nonprofit stewards, on the other side of the ledger, we have an issue of liability, what it means to be holding and collecting that, regardless of whatever statutory framework we have set out, and the real dangers of not having the data security no matter what. And so I think part of this is also prompting what is our protection framework gonna feel like in Vermont for our businesses so that they are not then liable.

[Megan Sullivan (Vermont Chamber of Commerce)]: And the data security question, I think, is big and important. And I think something that I've thought about is, Okay, so if I have to report, I've gotten a grant, and I have to report on who I'm serving. And in that, I have to collect demographic information. And that individual says, have to delete my data. What does that mean? So let's talk about security and more, okay. Well, they I'm now under this, and they've told me I need to delete their data. So can I not include them in my reporting requirements? These are questions Is

[Edye Graning (Vice Chair)]: identified or do I identify from that example? Because a lot of times, when we're doing that based reporting, it's

[Megan Sullivan (Vermont Chamber of Commerce)]: not identified information. It's just how do have this many people? That's where I think bringing the nonprofit groups in to have those conversations, these are questions that I have been asking. And again, my experience with nonprofits is I serve on the board, work for one. We have a few members of nonprofits. But these that's where my mind keeps going when I'm thinking about these as well. How does that work? And, like, as a nonprofit, we have an event. And there is a state organization that sponsors that event. And they have DOD requirements for reporting. And so they ask us for our list of attendees to that event as part of their sponsorship so they can do their DOD reporting. So we have now sold that staff. So we're in. Right?

[Edye Graning (Vice Chair)]: I think that probably means to look that up. What is the DOD reporting requirements? Can you do that on the data? Well, they've asked

[Megan Sullivan (Vermont Chamber of Commerce)]: us for the list. The state agency has asked us for the attendees.

[Edye Graning (Vice Chair)]: In order to fulfill what request? Within the DoD. I hear you. Mean, we do need to sort out something

[Megan Sullivan (Vermont Chamber of Commerce)]: Yeah. To get So there's a lot to dig into, I think, on this to understand. Are there unintended consequences? Right. And there's time. I don't know if if the ASR can't make nonprofits do a study, but if there's a way to say, can you guys come back to us, especially the nonprofits, look into this. Talk to folks. Are there concerns? And maybe not. And I'm, like, common good could testify at it.

[Unidentified Committee Member]: So, you. From my perspective, I'm less concerned about the business formation. Is it nonprofit? Is it an L3C? Is it an LLC? Is it

[Megan Sullivan (Vermont Chamber of Commerce)]: a cooperative? Is it an

[Unidentified Committee Member]: S corporation? Then I ask about the scale of the business. There's plenty of mission driven, for profit child care center, for example, or home based child care, where they've got 30 clients. And they're collecting sensitive data. They have to. Where my mind's been going is there's a statement and kind of a question, which is, there's what is the best policy that we can have that provides the right balance and also protection? And then, what is the runway in which we're really helping businesses to get there, so to speak, to handle their data correctly, to improve? And so, there this sort of idea of one and done? I guess the question is, if you've thought about this, instead of saying everything goes into effect in eighteen months, it's, Okay, there's going to be a high threshold for applicability for a certain amount of time. And then there's a trigger and it lowers. And there's an ability to learn how because I've put a lot of thought into, like, how does a business comply? We had testimony where a woman said, It's going to cost $20,000 for a nonprofit to comply with this law. Well, that's challenging. I don't know if you've thought about that at all, about a longer runway or a step, almost like an approach where we step into it, step into it.

[Megan Sullivan (Vermont Chamber of Commerce)]: And I think we appreciate the eighteen month runway for, you know, certainly our membership. And then that, you know, that 3,000 number is what then the feedback that we got.

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: So 3,000 for sensitive data? Yeah. And if I may, there may be a distinction between the processing and collecting of sensitive data versus the selling

[Emily Carris Duncan (Member)]: of sensitive data. It's huge. Right.

[Megan Sullivan (Vermont Chamber of Commerce)]: For sure. Huge. Huge difference. As long

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: as there's a pathway to sell, and it seems like there is in the new data minimization language with affirmative consent, then I think if you one way to potentially address this concern is to acknowledge that there's a distinction. And so not to tag small businesses with the mere processing and collecting of sensitive data, but maybe being more restrictive on the sales side.

[Megan Sullivan (Vermont Chamber of Commerce)]: And then certainly for next year, might be looking at, in an economic development bill, some technical assistance for small businesses, be they for profit or nonprofit, to help with the security side and with the compliance side.

[Unidentified Committee Member]: Right. Because it is key to remember that outcome we want is for businesses to handle their data correctly, not to put up a privacy notice just because they have to, more to understand it and to handle their data in a safe way.

[Monique Priestley (Clerk)]: Honing in on the publicly available information, it's often I guess maybe this is more for committee. And this was given in letters from chambers in Massachusetts and Maine, so I have a presentation that was created for Maine. But that the the Sorrell case, was struck down because it was found to be speaker and content based, and it had burdened commercial speech, but not academic speech, and that the issue was never about the sale. And the misquote that is used over and over and over and over and over in every single state to go after the publicly available information is maybe I could just show it. So there's a piece that says, the state also contends that heightened judicial scrutiny is unwarranted in this case because sales transfer and the use of prescriber identifying information are conduct, not speech. And then there's a whole bunch of information, and the last line of the thing is there is thus a strong argument that prescriber identifying information as speech for the First Amendment purposes. So often, this quote takes out of context both the beginning and the end of this case. So I just Who is that?

[Emily Carris Duncan (Member)]: Is that a pretty

[Monique Priestley (Clerk)]: It's a versus I m m IMS health document. Happy to share it to you.

[Emily Carris Duncan (Member)]: It's Supreme Court. That is who you are reading. Whose whose court decision was this? I'm sorry.

[Megan Sullivan (Vermont Chamber of Commerce)]: Yeah. Supreme Court. Thank you. Okay. Yeah. Yeah.

[Monique Priestley (Clerk)]: Yeah. So the the quote is often. The Supreme Court has held that sales transfer and the use of personal identifying information are dot dot dot speech for First Amendment purposes. There's lot of dots. There's a lot in the dot dot dot. I just want then the definitions as far as like saying that they applied to the kids code and not generally able to apply to a comprehensive data privacy bill, the definitions between the comprehensive data privacy bill, the data broker bill, and the kids bill were all in alignment with each other. They were initially created for the comprehensive bill based off of other things that exist in other states. For instance, the biometric data, the technological processing piece. In a lot of states, it's either technological or analysis or automatic measurements. We had gone with technological processing at the advice of engineers and product managers from big companies who said that is the most standard that makes the most sense, that they understand how to abide by it. When it comes to de identified data, I would really actually love to know which companies are having an issue. Because that, again, we heard from Anne Waldo. I spent hours and hours and hours and hours, more hours than I wanted to ever experience of being firehosed about de identified data and HIPAA, and the way that those experts are brought in to try to determine what is de identified. In fact, there's not many people that can actually be brought in to determine what is de identified data. It's highly technical, usually around HIPAA, although businesses bring in experts to try to help them figure out when they've actually met the standard. So it's not the same as taking off a name and anonymizing it. It's a standard that's used to highly technical. I would love to know which chamber members specifically are struggling with that, because it feels like that is something that would be for bigger clients. And also, when it comes to the personal data, again, that is one that household and stuff that has been brought up is found in California, household issues, in Oregon, household issues. That's just another some of those definitions that are being said that they can't be complied with, even though a lot of companies that are that are are already complying, that are, you know, having to change things, are already complying with California. And those are things that they're already meeting. I'm just confused. The average small business is not going to be trying to track people's devices themselves and figure out who's in the household themselves and de identify data themselves. And so just really curious who we're representing at the table.

[Megan Sullivan (Vermont Chamber of Commerce)]: So as we stated, we did not get involved with kid code kids code last year. And so we didn't look into these, definitions. So four point one brought definitions in, and we were asked to look at them. How how do they move over? Right? How are these different language from what's done regionally? And they are different language from what's done regionally. And, if large businesses don't have a problem complying with those, that's fine. We're talking about, does that change when we're talking about Vermont based businesses? And that's what we're trying to look into. So I'm glad you've had lots of conversations with very large businesses that don't have a problem with this. That's not who we're trying to think this through for. And in the last three days, have we been able to survey every member? No. But we've invested in policy expertise to be able to have this conversation because it is moving quickly. So if you've got specific questions that aren't, who are we representing, do dig into those specific questions?

[Monique Priestley (Clerk)]: The question is for de identified data, personal data, the definitions, and publicly available, that kind of thing, who are the businesses that are having a problem with that? And are they already complying with California law?

[Megan Sullivan (Vermont Chamber of Commerce)]: We have some businesses who are complying with California and plenty who are not working on California, who are looking at this bill to say, what does this mean for me? And that's who we're trying to think this through for, but it's also highly complicated. So they ask us to do some of this work. And so that is what we have invested our money in trying to bring along an expert to look at that. And that's the questions that Josh is asking.

[Monique Priestley (Clerk)]: So the ones that are not already complying with California, like, which ones are those? And are they complying with, like, Connecticut and Hampshire? Or is this brand new for everybody? Like, we're trying to make it the most It's

[Megan Sullivan (Vermont Chamber of Commerce)]: not in. Can They're all in New Hampshire. Feel like the answer.

[Edye Graning (Vice Chair)]: I think

[Monique Priestley (Clerk)]: we need I'm just wondering which business you're even talking

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: and they're they're representing businesses. They're not gonna come here and tell you which companies are doing what.

[Monique Priestley (Clerk)]: Then how do we know how to tailor the law?

[Unidentified Committee Member]: Well, there's tons of businesses that only are doing business in Vermont, but they're not complying with And

[Monique Priestley (Clerk)]: that's They're not complying with anything. Right? So, yeah. So this is, you know, yeah, So they're not changing things.

[Unidentified Committee Member]: Yeah. I mean, there's there are plenty of businesses that this whatever the Vermont law is, they will be confronting this stuff for the first time.

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: Yeah. It's

[Herb Olson (Member)]: questions. Okay.

[Edye Graning (Vice Chair)]: So go ahead, Janine, then I wanna So

[Anthony “Tony” Micklus (Member)]: I think I wanted to think about the spirit of why we have this clause in there. And what I see, it's one thing to go to a public records database and find out where I live or my voting record or something like that. And that makes sense to me. It's another thing to pay a company to take all of the data from all the different public databases and aggregate that into something that's very quick and easy to understand. And I think that's what we're trying to regulate. So maybe if we can walk that path, you know, I'd be interested to see what you have to say, you know, about how we can walk that line. Because to me, it's more the aggregation. It's not the direct public access. One thing for me to do the work. It's another thing for me to pay someone else to do it.

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: And that that's a that's a fair observation. And I think it's about the degree, and I don't know where to draw that line, to be honest with you. Right? Because I go back to the candidate example. I'm the candidate and I'm thinking about these are the people that I wanna go knock on their doors based upon the publicly available information. I don't think that's the scenario that you were describing in your hypothetical. I could probably come up with another half a dozen of those. There are lawyers, frankly, when they are looking at the jury panel, we're looking at the fully available information about where they're employed, where they live, things of that nature to say, okay, maybe these people will be sympathetic to my client. Am I going to be then caught up because I'm doing that natural process as part of my job as a lawyer? So the question is where do you draw that line? And I don't, sitting here, have a precise way to do that, but I feel like because it's publicly available information, it's already out there. And so if I'm gonna use my intellectual capital, if you will, to kind of deduce some information, not from information that's been combined with private information, but publicly information,

[Megan Sullivan (Vermont Chamber of Commerce)]: you know, that's fair game.

[Edye Graning (Vice Chair)]: Herb, did you have a question?

[Herb Olson (Member)]: Yeah. I was just I thought Tony Tony made a really good point about what the point of this exclusion is. And I'm looking through, you know, the different subdivisions of what's excluded. And I think it really does get to what Charles talking about. It's not purely publicly available information as we sort of think of it. It's particular ways in which a controller or processor would take that data and then use it. That is the thing that I think consumers accept the willies about. I just sort of add a little bit. Josh, you talked about the Supreme Court case. Right? And, you know, that's that's kind of the direction that First Amendment and commercial speech has gone over the past couple of decades is really weird, but that is a lot. But I think what do you think about the distinction between the legit the the the governmental interest in prescribers information versus personal privacy information, which seemed to me to be a much higher somewhat higher on the on the latter rung of what's important. And I'm wondering whether you agree that the Supreme Court would think that that's more important than an ordinary prescriber's interest in terms of commercial speech. Mean, I we're trying to present consumers' privacy data, and I think that's a pretty high gun

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: And I and I wasn't suggesting that the entire legislation would be subject to a First Amendment challenge because I agree. Can't I predict what the Supreme Court's gonna do, especially in the last few years. Yeah. But I do believe there is a cogent argument to be made that protecting privacy is a compelling governmental interest at the end of the day. But if it's information that's already public, then that privacy interest is eroded because it's not private. You've already allowed that information to be part of the public sphere. I get it, but

[Herb Olson (Member)]: that gets into Tony's issue around is it just publicly available information on its own? Or is it what's being done to it that changes the nature of that public information or is it something that could be harmful to consumers?

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: Is it possible? Sure. Where that line is, but I think there's a lot of line in that analysis. I appreciate that. That's in the public realm. Yeah. And that is part of public speech. And that if you start regulating, you're gonna find yourself, I think, subject to a very good First Amendment argument. And we can be dancing on the head of the pin, right? A bunch of lawyers, not angels, lawyers dancing on every pin. But I think there

[Herb Olson (Member)]: can be differences of opinion about whether or not the privacy interests that we're trying to articulate and detect here rise to the same level of what was considered by Supreme Court

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: a few years. I generally agree with the concept, but I think in the realm of information that's already in the public sphere, I think that's a very difficult argument to make.

[Herb Olson (Member)]: You can agree with this.

[Edye Graning (Vice Chair)]: Cognizant of the time, Emily has another question, and I want to make sure that we actually get through their list of questions. So do you have a question? Back to a technical assistance conversation with regard to nonprofits, but I'll share some answers. Is that something that

[Megan Sullivan (Vermont Chamber of Commerce)]: your organization helps your members with at all? We don't have that technical expertise. We are very impressed with the Small Business Law Center out of the law school and their work on that. We wouldn't be looking for providing that ourselves, but would be looking to boost the trusted technical advisors in the state. The RDCs, the Small Business Development Center, the Small Business Law Center, whose name is not exactly that. I think everyone knows who they are than everybody is. That's who we would be looking towards.

[Edye Graning (Vice Chair)]: Chamber brought us, what, six different areas, five different areas to talk about. Just the chair was hoping that we could kind of think about those, and maybe we do it when he's back, and just so that folks can be, we can talk about those specific issues and figure out if we're comfortable with making those changes or not. So is your testimony on our website at some point?

[Herb Olson (Member)]: Oh, we will get it to you. Okay.

[Edye Graning (Vice Chair)]: Oh, yes. Great. And then we can use that to Yes.

[Herb Olson (Member)]: So we can have that discussion later or

[Edye Graning (Vice Chair)]: I think we have to have it. I would like to have it with the chair here.

[Herb Olson (Member)]: Yeah, I appreciate that. Yeah, I got it. Good thing.

[Edye Graning (Vice Chair)]: But I just wanted folks thinking about

[Herb Olson (Member)]: You want to know things?

[Edye Graning (Vice Chair)]: Want you being prepared to have that conversation, because we are now dealing with calendar math and trying to get

[Anthony “Tony” Micklus (Member)]: We're not going to solve this in ten minutes.

[Emily Carris Duncan (Member)]: Are you

[Joshua “Josh” Diamond (Counsel, Vermont Chamber of Commerce)]: referring to a list

[Emily Carris Duncan (Member)]: of questions that is where? Did you say six items?

[Edye Graning (Vice Chair)]: Josh mentioned a number of items, and he's going to get us something in writing so that we can actually On the same page.

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: Now I

[Emily Carris Duncan (Member)]: got it. Okay. Any

[Edye Graning (Vice Chair)]: other questions for them before we let them go? Thanks everybody. Dylan?

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: Good morning. It's been literally. Appreciate the ability to take off my jacket today.

[Edye Graning (Vice Chair)]: 70 degree breeze comes through, we all go.

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: Yeah. It's really the humidity that gets there. So for the record, Dylan is working lean on public affairs here this morning on behalf of Vermont Technology Alliance or BTTA. Just kind of around the committee and BTTA for the Vermont Technology Alliance to represent the family's technology companies based in Vermont that start here, grow here, and thrive here. And I just want take a moment to say largely when we think about the tech environment in Vermont, I think many folks minds go to dealer or OnLogic. You heard from Justin McCabe, who's the board chair of BTTA. And so I'm here this morning on behalf of those companies, but then also the the smaller companies that are kind of where maybe dealer or Orange and Border ten or fifteen years ago before they became a household name. And when I think about policies like those the one in front of the committee today, what we're thinking about is both how it's gonna impact those successful later stage companies, but also the, companies that are trying to grow here in Vermont and become the next dealer or the next on Logic. And so, when I think about that, I think about the resource application. And part of what I have tried to do since the draft was released yesterday is talk with members, as many members as possible, both to understand on the policy level, kind of what would this functionally mean for you have not, obviously, given the time time, been able to hear from as many folks as I would have liked to. But then also, what does it mean functionally for you if you are applying, if you're a VTTF business and you're applying with Connecticut or California with each additional state that comes on when there are no provisions? What function does that mean? I appreciate that's been part of the committee discourse. What are we talking about in terms of time and resources, both in house and and outside? And so for a lot of those smaller businesses that don't have in house counsel to be able to help them think through this, In many cases, they are asking me about what this means for them and how it's going to flow through. And I am not their legal counsel. I'm not their compliance counsel. And so I can't answer that question for them. Folks like Justin, our attorneys or general counsel for OnLogic have a much, much better position to sort of look at legislation and and understand its implications. But those small businesses that are hoping to grow here, don't always have the resources to go out and have and hire outside counsel to look at each new draft and understand how it will impact them. And so I spoke with one business this morning who I would qualify as kind of a medium sized business in Vermont, small probably in most parts of the country. And they told me that their spend when CCPA come on came online was roughly $50,000. It's not insignificant for a company of that size. Each additional privacy law, depending on the order of magnitude, requires some spend. That could be as little as a few hours. But a few hours of attorney time, it's still a couple thousand dollars. Could be in the certainly in the four or five digits each time there is an update. And so there is a cost there and understand that that that's a balance that this committee will have to, consider. And so going back to draft 4.2, similar, I think our concerns generally from what I've heard from members thus far with near what you just heard from the chamber in the alignment of definitions with, Connecticut versus HITSCO, and then also the exemptions that that are inconsistent with what we see regionally will have an impact and will add to that cost and any resource that this Vermont businesses are going to have to take on, even if they are already compliant with other states. Think about the small business that may not be working in California, may not have had to the initial hurdle of the 50,000. And so for them, if that is their first time coming into clients, it's going to be a more significant spend. And so like the chamber, we looked at the age appropriate design code when it moved through the legislature, both in 2024 and 2025. And it's not uncommon to get questions from members about, well, we were concerned with this particular definition, but then we look at the scope of applicability and it's very clearly targeted at sort of 10 or 12 largest companies in the entire world. And so if we got engaged every time there was a provision that didn't apply to us, but that might be problematic, we'd be very busy. And so I I do think, as Josh indicated, there probably are definitions that do make sense. And to represent Priestley's statement, I I wanna be clear. I'm not here to say that we can't comply with that. You can comply with anything at a cost, and it's really about understanding what that impact is. And so the the three bills or laws that have been pointed to in this discussion that largely those definitions line up with our age appropriate design code that those definitions are not in effect until next year. The genetic privacy bill, which is still moving its way through the process and h two eleven, which is still moving its way through the process. So this is really not about aligning with the definitions that are on the books and in practice that businesses are understanding, to the extent that businesses may be may be subject to AADC. They certainly are thinking about that. That's largely not the folks that that we represent at Vermont Technology Alliance. And so I would just ask the committee to think about that as you think through this. It is worthwhile to acknowledge that the definitions in AADC are in their own separate subject. They are not the same definitions that are in Chapter 62 of Title IX, which is the definition section for the protection of personal information subchapter. So it is not inconsistent to have different definitions as it applies to different entities and with the goal of protecting, as Joshua mentioned, a different class. Minors are obviously a different situation. And so when it comes to publicly available information, for example, it makes sense to sort of have a narrower definition of publicly available information. But I think we would share the same concerns that the chamber does, about that inconsistency and and similarly with some of those first and all concerns. And I'm conscious of time here. I I did just wanna say, I think we all collectively shared the goal of getting something on the books this year that will provide additional rights and protections to consumers. That's a tough balancing act. Representative Graning, I heard your I was listening to the Florida debate yesterday about masks on federal agents. I heard your comment about a bill that was recently beat up by the governor because of constitutional concerns. And so I just I don't know what the governor might do with a provision like this publicly available information where the state has faced litigation. Appreciate each case has its own merits, Representative Priestley, and certainly would not know what this particular Supreme Court would do. But I would just encourage the committee to approach with caution definitions that get into constitutional challenges because that could present as a hiccup for for the bill becoming law and providing cheats to promoters.

[Edye Graning (Vice Chair)]: Do you have a question? Okay. Does anybody else have a question?

[Monique Priestley (Clerk)]: Can you just pinpoint the areas of the publicly available information definition that you're concerned with?

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: I think on its face, the exclusion from publicly available information, information that's made available for sale, I think about that like, well, my address is publicly available. I can go down to my town office and ask for an address list for anyone who owns property in town that's publicly available. If I turn around and sell that to my neighbor, I don't know why he would pay me for it. But I'm not sure why that suddenly becomes not publicly available. And I would echo Josh's comments about the correlation of other publicly available information. This is not with my VTT off PTT hat on, so I'm gonna take that off. But, you know, we do work with folks, that utilize publicly available information. For example, the missing children's, center, the alerts that I'm sure everyone got on their phones yesterday, that is reliant on publicly available information. And so, if you narrow the scope of what is included in publicly available information by adding novel exclusions from that definition, it will have an impact on some of those downstream uses of that data. Think about parents who are not paying child support or folks who are not paying alimony, like many of the tools that are used to track down and make sure that those folks are fulfilling their legal responsibilities rely on publicly available information. Fraudsters are present the broader, the narrower that definition of publicly available information is, the more exclusions from what is incorporated into publicly available information, the more opportunity you present to bad actors to sort of exclude their information from the system. And so I think looking to and I have I think I've shared at least with the senate committee a broader definition of publicly available information that goes beyond Connecticut 2025, that I think folks are generally comfortable with, that contains the exclusions of biometric information, genetic data. It's reasonable to assume, well, my face is in the public. But I wouldn't expect and nor I think would anyone anticipate that my facial recognition suddenly becomes publicly available information. It's reasonable to exclude that. Expect that because you might be able to get sampled my hair skin cells because I've sat at this table that it's suddenly publicly available. But the sale and the coalition, I think, are where the real challenges are. Happy to share that definition. That does, again, go beyond. So I just wanted to point out where we would be comfortable going above and beyond and providing more robust definition without getting to the point where I think it presents those constitutional challenges.

[Edye Graning (Vice Chair)]: I think we have time for one last question. Is that Herb? Okay.

[Unidentified Committee Member]: You

[Herb Olson (Member)]: may have sent it before, but I'd like to know what definition of publicly available, I guess exclusion part is what the address IP. He's gonna look at that again. You

[Edye Graning (Vice Chair)]: have a question? Sorry,

[Monique Priestley (Clerk)]: I was asking how this bill interrupts me being able to sell my address to stack. I guess in your in your example, you said, like, I could get my

[Edye Graning (Vice Chair)]: address. So it

[Dylan Giambatista (Leonine Public Affairs, for VTTA)]: I didn't say interrupts. I said that once I have sold that address for me as the business in this case, it is now excluded from the definition of publicly available because I have made available for sale. And in fact, the way I read it, it wouldn't the sale wouldn't actually have to go through. I would just have to make it available for sale. And as soon as I have, it is now excluded from the AI and then subject to all the other provisions in the bill.

[Edye Graning (Vice Chair)]: Thank you, Dylan. Thank you. Committee floor bell is ringing. And so let's go offline. And we have time after the floor again, as the chair said, every time we get off the floor, please come back here. We will have

[Michael Marcotte (Chair)]: more