Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee of Commerce and Economic Development. Again, Thursday, 05/21/2026 at, looks like, 11:03 in the morning, so we're back from the floor from the recess. So we'll continue our discussions on a 71, namely the definition to thank you. Forget. Brought it back up again. So I know we have Ryan Krueger with us. Morning, Ryan. Thank you for joining us.

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Good morning. Would you like me to start? Yes, sir. Okay. I don't wanna waste your time. I've introduced myself previously. I've been doing privacy consumer protection for about sixteen years now. I currently work for the Massachusetts Attorney General's Office, but my testimony today does not reflect the opinions of the Massachusetts Attorney General or that of our office. I

[Anthony "Tony" Micklus (Member)]: regret that I have

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: not been able to closely follow all of the debate that has been happening around public information, but as it so happens, there have been a number of attempts to amend public information definitions around the country, and a lot of legislators and AAGs and other offices have been getting memos from various industry groups arguing against these, and I've been collecting these memos and reviewing them and finding so much misinformation in them that I'm working on my own memo. I don't have it done yet, but I have been looking at these arguments very closely about public information for the last month and other words. I'd like to start with kind of a fundamental. As everyone knows, this law S-seventy one talks about personal information. If it's not in personal information, it's not covered by the law. That's the fundamental definition. Public information is excluded from personal information. The premise here, and what I have heard said many, many times, is that of course you have to exclude public information from personal information. No privacy law has ever tried to include public information personal information, and if they did, they wouldn't be able to be unconstitutional, the First Amendment would prohibit it. That is untrue, okay? It's untrue on both bases. First off, the idea that if you have a privacy law, you have to exclude public information. That public information exemption was put in the early Data Breach Notification Act definitions of PII, and then it kind of jumped the moat over to privacy laws, but in state laws that has been the case. But historically, it has been the opposite. One of the earliest privacy laws was the Fair Credit Reporting Act 1970. The Fair Credit Reporting Act is an interesting one to think about because it actually mirrors S-seventy one and the rights that it gives a lot. Fair Credit Reporting Act, in that case, the fundamental data unit is a consumer report, a credit report. And what rights do you have with regard to credit reports? You have a right to access, you have a right to know who's collecting the data about you, you have the right to request that it be corrected, you do not have the right to delete it, but you do have the right to say don't share it with anybody else, which is kind of the next best thing by freezing your credit report. You're saying don't share my data with anybody else. So it is very analogous to the kinds of laws we're looking at now, it just only applies to consumer reporting agencies or sometimes called credit reporting agencies. Importantly, the Fair Credit Reporting Act does not exclude public information. Okay, it contemplates that credit reporting agencies create credit reports in part based on public information, and it gives you a right to access, it gives you a right to correct, it gives you a right to say you can't share this with anybody else. Now, that right to access and right to correct is actually critically important. The CFPB, the Consumer Financial Credit Protection Bureau, which mainly regulates the credit reporting agencies, issued a report in which they said over a two year period the single most common complaint that they received from consumers about anything at all was inaccurate credit reports. I saw another statistic that one in five credit reports contained inaccurate information. Now think about this, credit reporting agencies, the big three, are some of the most sophisticated data collectors out there. They are under the most public and regulatory scrutiny of any data collectors, and they still get it wrong 20% of the time. So if they're not capable of having a 99% or 99.5% success rate, what are the odds that a company that's collecting and selling your information with no oversight whatsoever, you might not even know they're collecting it, is getting it right. Now, we heard Dylan talk about LexisNexis sharing with law enforcement and all that other stuff. So he may be talking about one of the big products that LexisNexis has is the Accurint database. The Accurint database is used by law enforcement and others to assist in their various jobs, their law enforcement duties, background checks, things like that. There was a report that came out a couple years ago, and I think I may have submitted this on the Senate side, by the National Consumer Law Center, came out in 2021. They talked about a contract that Accurint had or LexisNexis had with the Social Security Administration for the administration of supplemental security income. So SSI is an insurance program that the Social Security Administration runs for low income, disabled, elderly people who need this extra government income. It's not Social Security, it's a separate thing, SSI, and it's means tested. So they started using the Accurate database to make sure that nobody was getting these benefits who had extra money somewhere, including owning real property that they had not reported. They were specifically looking for, do people have real property in this? And according to the National Consumer Law Center, the Accurate database, this is a database relied on by law enforcement and others around the country, was riddled with errors. It was reporting that poor people were owning property that they did not own. And the theory of the National Consumer Law Center is what they were doing was looking at public property records, looking at names in the database and saying, Oh, John Smith owns an apartment building two towns over, must be this John Smith, we're going to give them credit for owning that apartment building, despite the fact that there might be more than one John Smith out there. So again, accurate database, public data. It may have some private data, but it's combined with public data. And because it has public data and because it's not a credit reporting agency, although the NCLC argued that it should fall under the Fair Credit Reporting Act, they had no duty to let anyone see what data they had on them or to correct it. So that's the first big point, this idea that if you have a privacy law, you have to exclude public information is incorrect. The Fair Credit Reporting Act does not exclude public information, the Federal Privacy Act, which is the privacy law that governs federal government, does not exclude public information. GDPR does not exclude public information. Now you might say, okay, well GDPR, that's Europe and Europe doesn't have the First Amendment and the First Amendment would prohibit us from doing that. Again, that is incorrect. We hear IMS v. Sarelle get thrown around all the time for the premise that the First Amendment protects the sale of information and any attempts otherwise are unconstitutional. That's not what IMS v. Sarelle says. I've read IMS v. Sorel backward and forward. It happened slightly before my time in the Vaughan AG's office, but I've read it. I'm not gonna go into the details of, they did find the statute unconstitutional, but it was not because it was just selling information, that was not what it stood for. And I've seen some major misquotes of that case, and I just kind of wanna set that to rest. In fact, TransUnion sued the Federal Trade Commission when the Fair Credit Reporting Act came out and said it was unconstitutional under under the First Amendment. And the court said, actually it's constitutional, okay? Sale of data is constitutional. And as far as I can find, that is the leading law on the subject, So I wanna put those ideas to rest. Now, so I personally believe that good policy here would just be to not carve out public information at all, that's what the Fair Credit Reporting Act does, and credit reporting agencies are doing great business and it's not interfering with anything like that, but that's not what's on the table right now. So what has happened was drafters have said, well, we're probably not going to win the battle of just getting rid of the exemption entirely, so let's define down public information to the extent that even though there's an exemption, it's exempting less than if it were the full collection. So when we see exemptions from public data, you're basically seeing an exemption from an exemption. It's a double negative. Public data is out, except this is out of public data, which means it's back in the law. It's not artful drafting, I mean it's as good as one could do under the circumstance, I'm not criticizing anybody's drafting ability, but from a let's create a bill that people can understand, it's not the best way to go about it. The best way would just be to say, you know, here's what's exempted and leave it at that. On At Issue right now, as I understand it, is two parts of those exemptions. We're talking about saying, okay, public information is exempted, but public information that is being sold is not exempted. So let's think about that. So what would that say? That would say that if I am a research institution or a public health agency or any other organization that is collecting an enormous amount of data for my research purposes, and you went to me and said, I want to know what you have on me, that company could deny your request because they're not selling the information, they're just collecting it. So public information is not part of the law unless you decide to sell it. Why does it matter whether it's being sold or not? Well, because if it's being sold, that means that someone is buying it to rely on it to make decisions. And if that data is incorrect, then it is going to be harmful to you. And there are numerous examples of incorrect information, people being linked to terrorist organizations, all sorts of stuff coming out with incorrect information. Even if it's incorrect, there's the question about the right to delete the information, okay? Remember, one of the critical elements here, one of the critical privacy concerns involves websites like whitepages.com. Now, I am old enough to remember, and I suspect that a number of people on this panel maybe as well, that back in the day you would get a phone book. Every year the phone company would send you a phone book. It had some yellow pages and some white pages, and that was how you knew the phone numbers of everybody in your town and their addresses. But my parents, I was too young, but my parents could contact the phone company and say, please don't list my name in the phone book. I value my privacy, I want to opt out from your sharing that information, and the phone company would honor that request. They didn't have a legal responsibility to do it, they just did it because it was common sense and basic human decency to say, we're not going to share your information if you don't want it shared. Did that mean the information was no longer public? No, it was still available, you could still find it in tax records and whatever, but it meant that if you wanted to find someone's phone number and address and they weren't listed, you basically had to hire a private investigator or you had to follow the person around. It was much harder. The data was still publicly available, but it was much harder to access. The Supreme Court has addressed this concept in a case and they called it practical obscurity. So the information was still public, but practical obscurity made it hard to get to. Just like our marriage records or our property records that are sitting in some town clerk's office, sure it's public, but it's harder to get to. When the data brokers came along and the internet exploded in the last ten years, what they've basically done is eliminated the concept of practical obscurity. If it's public, it's broadcast. If it's public, anyone can get at it. That is the unprecedented thing. That is the unusual thing. It's not like this information has always been public to anyone who wanted to get it and was easy to get at, and now we're trying to remove that from the public sphere. No, this data traditionally was very hard to get to, even though it was technically public. And what that meant was that if a mentally unstable guy broke up with his girlfriend and she moved to hide from him, it would be very difficult for him to find her again. Now it's really easy. It meant that if some crazy person wanted to show up at the home of a judge or a legislature to do harm to them, they might imagine it, they might dream of it, but practically they didn't even know where the person was. Now it's incredibly easy for them to do it. So when you hear about this sale of data exemption, it's like, okay, one, yes, that might, if the information is not there, then law enforcement might have slightly less information, and I'll get to that in a second, but that also means the white pages folks don't have that information. The two concepts are joined at the hip. I don't see how you can have one without the other. Either you can sell this information or you can't sell this information. Now, there are law enforcement, there are crime and fraud exemptions in this bill that would still let law enforcement access a lot of this data. But what we're really concerned about, and I think what one of the major privacy concerns of so many citizens is how easy it is for people to access their data, even people who don't have their best interests at heart. And another thing to think about in terms of, is it public or is it private? What does it matter? How easy it is to get at? Let's talk about the crime of doxing. Okay, what is doxing? It is when someone in an online forum wants to harm somebody, so they post their phone number online or their email address or their address. So all doxing is, is taking publicly available information and publishing it to a group of people. If this were first amendment unproblematic behavior, then doxing wouldn't be a big deal because anybody on that forum could have gotten that information if they wanted to, but obviously putting the information in that context, context matters, context is everything, putting the information in that context puts someone in major danger. Because as we know, friction exists for a purpose. Friction can be our friend. People have crazy thoughts and then they're not allowed to immediately act on them, and then eventually the crazy thought goes away and they move on. But if we take away the friction, if we make it really easy to get this information, which is what the data brokers and folks like Lasix Nessus are doing, then we are not putting that barrier between the crazy person and their action. Guess those are kind of my main points on that. And then I think in terms of the derived information, I think that argument has already been made. I think it makes sense because derived information is not information that's obvious from the public. It's a guess, it's an educated guess that has been made by these companies that they're then telling people about you. And it makes sense to be able to say, yeah, we wanna know their educated guesses. And I guess the last point that I would make, and I apologize if it's already been made, is that the Connecticut Attorney General who has more experience with comprehensive privacy laws than almost anyone else, save for California, issues a report every year. And in their last report, they specifically said, you gotta dial back this public data exemption because we keep going after data brokers and they keep saying, sorry, publicly available, we're not doing any, you can't touch us. And that's why it's so important that we get this right. And in terms of sharing with lot, remember, oh no, consumers aren't gonna be able to open accounts. Sure they will, that's Fair Credit Reporting Act data, it's exempted. So that doesn't work. Law enforcement won't be able to get our information. One, there are exemptions from the law that would allow that to happen. Two, just to back out a little bit, traditionally law enforcement has a lot of information about criminals. They have rap sheets. You get into the system, they have your thumbprint, now you're in the system. What LexisNexis is arguing for is a system where innocent people are in the database, anyone is in the database to be found by law enforcement. Does that make law enforcement's job easier? Of course it does. Does that mean they'll be able to solve more crimes? Of course it does. I'll tell you what, if the number one concern we have is finding kids and helping law enforcement and stopping crimes, let's pass a law that requires everybody to turn on their phone cameras and microphones at all time. I can almost guarantee you crime will go down. Law enforcement will be able to catch more people. It is a truism that the more surveillance you have, the less crime there's gonna be. But there has to be a line somewhere. So anytime you hear a data broker coming and go, but law enforcement, but crime, but national security, yes, they're right. Allowing more data to be available will in fact help those groups, but we don't give them free ride. I mean, that's what the Fourth Amendment is all about, is saying that there's a line and you guys have the opportunity to draw that line. And I think the line should be innocent people's information who've done absolutely nothing wrong should not be able to be pulled into a dragnet where police can accidentally identify them because some data broker got their data wrong, and which we can't look at and can't correct. So with that, if anybody has any questions for me, I'm happy to answer them.

[Michael Marcotte (Chair)]: Jon? Thanks, Ryan. One of

[Jonathan Cooper (Member)]: the things that we've been talking about is with respect to publicly available information, this notion of information that is made available for sale. One of the Romanettes we have of, I think, nine. And I think is can you articulate and it's kinda hard to do this, like, what the negative, what the version what it looks like when we don't have that. If I think we're trying to figure out where the I mean, and to to your point about where the line is, It seems like we have biometric data, and then we have observational, inferred gathered information about you data. The biometric seems to be a thing that ties you to that is about you in some immutable fashion, maybe. Things about, like, you know, your

[Rick Segal (Office of Legislative Counsel)]: like, where

[Jonathan Cooper (Member)]: you live, things that can change, things that can, you know, that can be collected and can change. But I'm just kind of thinking about that, like, how those two kinds of information work in concert, one as an alternative to the other. And I'm wondering if by making by saying information is made available for sale, are we treating two different types of information the same way? Is that wise?

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Biometric information, I believe, falls under the sensitive data category, right? And correct me if I'm wrong, I haven't So that creates a bunch of additional protections for biometrics. So we're not really treating public data for sale and biometric the same way. Biometric information is critically sensitive because I only have one face, I only have one thumbprint. If a criminal steals my thumbprint, I can't change my thumbprints. I can change my password, I can't change my face and I can't change my thumbprint. And so the idea that someone should be able to collect, remember, thumbprints traditionally, only law enforcement was allowed to have our thumbprints so that they could catch criminals. Now, companies want to collect our thumbprints to get into six flags. That was a case in Illinois. And it's fine, if you want to give someone your thumbprint, okay, that's great. But then when they want to sell it to someone else who you don't even know for whatever reason, that's where things get tricky. And that's where we want limits on that sort of thing. And we want extra security around them. So thumbprints, biometrics are generally considered some of the most sensitive information out there, because once it's out there, most information ages. If it gets stolen, our purchase history isn't going be as valuable a year from now. Our credit card isn't valuable fifteen minutes from now if the bank is doing a good job of finding the fraud and turning it off, but our thumbprint is with us forever. So that's critically important. Now, in terms of data for sale, remember that the context of what we're basically doing here is saying that if this is the only exemption, this is about public data. And we're not saying you can't sell this information, it doesn't change the abilities of companies with regard to public data if they're selling it, it just says because you're selling it, we now get to ask you if you're selling it, we may get to know who you're sharing it with, we may get to say we'd like to see what you're selling about me and correcting it, and in some cases delete it. But again, there were a bunch of exemptions from the deletion right. And the critical thing here is if we don't have that for sale exemption, then any public data that is being sold about us by any company, be it Home Depot or a data broker or LexisNexis, completely falls out of the law entirely. There's nothing you can do about it. If you have that public information that they've collected, if they went into the city clerk's office and collected information, and then they're selling it, and maybe they put the wrong name on it, Maybe they are using outdated information. Maybe they have collected information about a child that was later expunged from the record. Okay, so it was public information, now it's in their database, but at 18, the record got expunged, that should be locked down information, but it's already in their databases. And now they can do what they want with it, because it falls outside the record. So that's why it's important to have that sale of data exemption. Again, the bigger step would just be say, let's not exclude public information, let's treat information like information, but if we want to limit it, then I think that sale is a really critical one to keep in there.

[Herb Olson (Member)]: Yeah, thanks very much, Ryan. That is very helpful to get a sort of more comprehensive picture of specific provision that we're dealing with. My assuming of your main concern about not excluding the sale of information from the definition of public information, available information, I think there were a number of reasons that you mentioned, but I think at least one of them was track record of inaccuracy of what it is that the controller is, what projects are putting together out there. Just And throwing this out there, not really sure of myself, would some sort of a more specific treatment in terms of the appeal rights of a controller perhaps get at that issue of accuracy or is that a no go?

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: I think that the only entity who is going to have the most interest in making sure that data is accurate is the consumer whose data it is. So if we're talking about appeal rights in terms of if someone asks for their data to be corrected, and what if they don't wanna correct the data and things like that. Well, if we don't put in the sale thing, then they don't even get to ask to correct it in the first place. They don't even know the company has the data, because we've taken it completely out of the statute.

[Herb Olson (Member)]: Yeah. No. I I I understand that. I I'm thinking of if you keep that provision in there around, you know, the sale isn't public information, but you allow the controller to, you know, and then the cons so the consumer would know, you know, have the ability to identify what what's being held about them. But you then say to the controller, can refuse to delete, I guess, information that is accurate.

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Sure, so are already, so the area to look in that would be the request to delete, there's a whole section that says the controller can deny the request to delete based on dot dot dot dot dot. Law enforcement to prevent fraud, these are exemptions already. So whether it's public or private, there's a lot of different ways that a controller can say, I'm going to deny your request. And by the way, as far as correction goes, I want be very clear on this, the way correction as a general matter works is you request to correct it, that's not an absolute right. You can't say, hey, you said my income was $80,000 it's actually $5,000,000 change it. No, you make the request and just like with the credit reporting agencies, they can come back and say, no, no, we're pretty sure that our data is correct. We're not changing that. They just have to investigate, they have to double check their data. And under the Fair Credit Reporting Act, and I'm not sure how it's dealt with here because I haven't looked at it carefully, under the Fair Credit Reporting Act, if you have a dispute with the credit reporting agency, you say it's A and they say it's B, you can ask to put a note in your file. So they're not gonna change it, but when they share your credit report, it comes with a note from the consumer saying, I disagree with this particular fact, I think it's this. And then whoever gets the information can do whatever they want with that. So I think the way to deal with this questions is, so I guess one way to look at this would be to say, if someone makes a deletion request about public data, how does the company deal with that? I suggest that they get to say, no, we're not gonna delete this in any circumstances, because usually the public data, again, that's addresses, that's phone numbers, that's white pages again. This is public data, but it's not easy to get at and they want to remove the practical obscurity and make it easy for anybody to get it. And I know that intuitively it sounds a little bit weird to say this data's out there, but you're not allowed to share it. But again, if I got on LinkedIn or Facebook, and I said, here's Monique's email address and phone number and physical address, that would be an egregious act on my part. And for me to be able to say, oh, it's public data, I can do whatever I want with it. No, I mean, you don't do that. And these companies want to argue that yes, they can and they should be able to do it for profit and it doesn't matter if there's real harm to people because we're doing it. And the only way to get them to stop doing that is making sure that public data is included in the sort of stuff that they cannot sell, because otherwise that public data exemption is just gonna like remove them from the ambit of this law.

[Herb Olson (Member)]: Thank you, that's helpful.

[Dylan (Industry representative for LexisNexis/data broker interests)]: Questions

[Michael Marcotte (Chair)]: for Ryan? Alright. Brian, thank you.

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Thank you. I'm just gonna Take your time. Until you adjourn, think of me as still in the room in case anything comes up.

[Herb Olson (Member)]: Great.

[Michael Marcotte (Chair)]: Have a good one. Good.

[Dylan (Industry representative for LexisNexis/data broker interests)]: Do you wanna weigh Yes. Dylan's way here to weigh in on. Sorry. Thank you, Rick. I'm a little confused by mister Krieger's point because at the end there, he said we need to make sure that data brokers can't sell publicly available information. I thought the attempt here was to provide the consumer right to delete information that is made available for sale that would otherwise be considered publicly available. I'm a little confused about what his intent is here. Maybe it was a misstatement. I do not think that the fraud and security incidents exemption in twenty four fifteen nine by nine covers because it applies to a controller's internal security operations, not a business model that's built on aggregating publicly available information. So and that is an email that I shared. I wanna speak to a very specific use of publicly available information, and that is highlighted in a recent LinkedIn post by mister Krieger, where he talks about being using a LexisNexis product, although he doesn't use it by name, to verify his identity. He's uncomfortable with sharing his biometric information, presumably through his phone, to validate that it is actually him logging into his bank account. He describes the financial institution sending him, via text, questionnaire where he answers public record with public record information, series of questions. They were actually kind of tricky, the color of car I owned, obscure details on my driver's license, past businesses I worked for. Many of those pieces are publicly available information. So here's the previous witness utilizing product for my client to validate his identity because he's not comfortable sharing his biometric information, which is completely within his right. So what's the fundamental challenge there? Well, if you include in the exclusions from publicly available information, information that's made available for sale, that automatically pulls it out and is subject to the deletion right, an S71. So if Mr. Frigar, I think I'm going make an inference here, is probably someone that thinks deeply about privacy and probably would exercise that deletion right properly. And so if he had gone in and deleted his publicly available information because it is made available for sale by my client, they would have no rational basis to deny that deletion request when he goes to log in to his financial institution, refuses to use his biometric information to log on. Not only may they not have may they may not have access to his phone number to even text in the questionnaire, but, the questionnaire would be based on information that he has subsequently deleted. Makes it much more difficult for him to access his financial accounts. I think the FCRA exemption is an interesting one because what we're really talking about here is making sure that consumers have the right to know what information, publicly available or otherwise, a business holds about them, the right to correct that information so that any inferences generated from that information, public or private or a combination thereof, are as accurate as possible, well, then let's talk about correcting information. But the FCRA does not, as he indicated, provide the right for you to delete your records. A pause, a credit freeze, is easy. I've frozen my credit. I want to go apply for a mortgage. I walk into my local bank. I call them ahead of time and say, hey, I'm going to be applying for I call the credit reporting agency. I say, hey, I'm going be applying for a mortgage. I know they're gonna run my credit. Unfreeze my credit. I can then return and freeze it afterwards. That is fundamentally different than deleting the information from a database that can't be then recovered. Because first of all, we're gonna put you on suppression list. So we're not gonna once that information has been deleted, anytime your information then comes into the system, it's going to be segregated and deleted because we're on that deletion. So unwinding that is very challenging. And I think bifurcating the deletion really honing in what we're talking about is the ability to delete this information. What are the consequences of that? Representative Kent's point about being unintended stops being unintended once these concerns have been put on the table. Knowing what data they have about you, correcting it so that the information being shared is as accurate as feasible, that's all completely rational.

[Herb Olson (Member)]: But deleting the information will have downstream consequences. I understand what you're saying, but I think you're conflating the deletion issue from the definition of personal data issue. The personal data is defined. I mean, that's why we're talking about what would be an exclusion from publicly available information because the personal data definition talks about publicly available information. So if you just don't, if you don't have, if you're not including publicly available information that's often for sale or that's combined with other inferences, etcetera, it's out of it, I think. And and you would never have the ability to correct. You'd never have the ability. Am I wrong?

[Dylan (Industry representative for LexisNexis/data broker interests)]: I think you may be wrong, representative. Here's why. Because personal data, page nine of draft 4.2, personal data does not include key identified data or publicly available information. So it is publicly available information. It's excluded from personal data. Then in the definition of publicly available information, you are saying what it is, and then you're saying what is excluded from it. Exactly. And so if the information is made available from sale, it is subject to that deletion right. The information that is made available for that would otherwise be made let's use an address. An address is publicly available information. I make it available for sale. That then exempts it from the definition. It is in the exclusion. It is no longer publicly available information. It is subject to the deletion.

[Michael Marcotte (Chair)]: Yeah. But

[Herb Olson (Member)]: well, I'm misunderstanding something trying to mess with you. I'm I'm reading line six and seven on page nine. And I that doesn't square to me.

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Can you,

[Rick Segal (Office of Legislative Counsel)]: by the way, so Rick Segal, Office of Legislative Counsel, your question, can you start from the initial question you have about?

[Herb Olson (Member)]: Okay, we've been talking about publicly available information, and the definition is trying to be specific about what we mean by that. And first it says, define sort of sound sentence, right? But then it's had a whole lot of list of stuff that isn't included. And So if personal data, the definition of personal data does not include the information that you just excluded from the designation of public. And it's not personal data. And if it's not personal data, it's not No.

[Rick Segal (Office of Legislative Counsel)]: It is personal data. So if you yeah. No. If if you if something is made available for sale, if Lexus Nexus company x aggregates data, right, that they get and then they sell that data, that's personal data. I think the sides agree, by the way. I think Ryan Krueger and Dylan agree that, like, this is a thing. It's a policy choice. Right? Like, you are going to affect certain entities, good and bad, that a consumer has this right. And it is a decision you have to make as to whether you want the consumer to be able to leave that data.

[Herb Olson (Member)]: Yeah. You know, maybe I got it wrong, but somehow I'm linking those exclusions from the definition of publicly available information as critical because without those exclusions,

[Michael Marcotte (Chair)]: a consumer won't have the right to delete that.

[Rick Segal (Office of Legislative Counsel)]: That is correct also.

[Herb Olson (Member)]: But that's what I'm getting at.

[Rick Segal (Office of Legislative Counsel)]: Yeah. Yeah. So if you remove if you remove the for sale exclusion, then if that data is made for sale by company x, company y, the consumer will not be able to delete. Or anything that is in this bill, any consumer right in this bill, the consumer will not be able to get that right because it is excluded from personal data.

[Herb Olson (Member)]: So from personal data and you don't have those rights.

[Rick Segal (Office of Legislative Counsel)]: That is right.

[Herb Olson (Member)]: K. That that was my whether I read the the other It's exactly. I think I got.

[Rick Segal (Office of Legislative Counsel)]: It's only a 56 page bill. Okay. It's a 56 page bill. Right? Yeah. But there's a few words that are really important. That's one of the most important things in the bill.

[Monique Priestley (Clerk)]: Yeah, would just love to hear from Ryan again, since there were specific questions still raised about his testimony in his online profiles. Ryan?

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Thank you. So I just wanna start off by saying the fact that Dylan or his handlers thought it was okay to cyber stalk a private citizen to make points before this committee is really creepy and I think inappropriate. And it really goes to the ethos of these guys, the lengths they're gonna go through to win their argument. Yeah, I posted something online, and I'm not embarrassed by posting it or anything like that, but I've never thought to go and look at somebody's social media postings in order to, I'm just a private advocate here on my own behalf, I'm not speaking on behalf of a government entity or anything like that for this. But getting to the actual subject matter, I did misspeak, I said I would want these guys to not to sell my data, it was a two step, I'd want to potentially delete the data, thereby they would not be able to sell the data, that's kind of the step I skipped there. And Dylan was correct that if there were a broad deletion right, I would probably take advantage of that deletion right. Would that mean that when a company using an online tool and he said that it was a LexisNexis tool, I hope he was just guessing that and they didn't actually research which tool was used to authenticate me in a private banking transaction anyway. Would that possibly make it more difficult to authenticate me online if there's less information about me? It might. I can say that online identification, first off, I was just talking to a lawyer who banks with, he told me TD Bank, and that for certain wire transfers, they require him to go down to the bank in person to do it. Yeah, I want really strong protections for transferring money. I mean, I'm all for that. My post was actually complimenting the bank for the systems they had in place. Would it be harder to authenticate me? Yes. I will say that in terms of online authentication, this is a challenge that a lot of legislators and advocates and enforcers are dealing with right now because of all these laws that are popping up for age verification and for other types of verification for online use, and I believe that coming soon, we're going have whole new regimes in place to try to figure out who people are online. I am hopeful, I believe in the power of technology and computer scientists to come up with a way to figure this out without completely compromising our privacy. That's really the challenge, how to do it without saying you have to upload my ID. There are people working on that, they call it a double blind authentication, things like that. But the idea that in order to solve any of these problems, all my data has to be out there for anybody to access without me having any rights over it, I don't think that's the best solution to this problem. And that's what I've been trying to say, and that's all I'm gonna say.

[Michael Marcotte (Chair)]: The

[Jonathan Cooper (Member)]: thing, Rick mentioned, it was a 56 page bill, and it feels like seven words on line six of page 11 are outsized in ports, information that is made available for sale. What is the bill without those without line six? And that's an air that's really the thing I'm trying to understand. Does the bill make sense? And and and, Ryan, this wasn't necessarily a question for you. I'm happy to hear your thoughts on it. But it's it was something more for the committee. If everyone agrees that if we read on what that what what six is saying, or line six on page 11, is romanette three Right. Really is where the entire bill turns in its efficacy. Let's see. What do we accomplish elsewhere in the bill without this? What do we not accomplish elsewhere in the bill without this? And that's I mean, I'm feeling like we've hit on this important thing. And I would love an articulation of how the the hundreds and hundreds of other lines of the bill won't do what we want it to do, won't grant rights of meaning Yeah. To consumers without Roman history. That's I wanna hear that paragraph.

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: Sure. I I will be very blunt with you. Pretty much the other 22, I think, comprehensive laws have a complete carve out for public data, and I don't know if any of them or how many of them have the carve out from the carve out. This is a fairly recent development in legislation. So what would do if we got rid of this is this would be more similar to a lot of the other laws that are out there, and those laws are very weak laws, and this is an attempt to fix a problem in those other laws. So yes, there would still be rights, people could still enact them, there would just be a lot more denials of those rights, There would be a lot more companies ignoring the law because they would be saying we have public data, even though we're selling it, we're going to ignore the law because it doesn't apply to us. That's it. This is not the most critical thing in the bill in terms of everything hinging on, it's just removing it is going to remove a lot of businesses that are collecting and selling our data from

[Michael Marcotte (Chair)]: the

[Ryan Krueger (Privacy and Consumer Protection Attorney, Massachusetts AG’s Office; testifying in personal capacity)]: ambit of this law and keeping it in will give more protection to consumers and bring more people within and more activities within the law. That's it, that's the distinction.

[Dylan (Industry representative for LexisNexis/data broker interests)]: So

[Edye Graning (Vice Chair)]: two things. Ryan, I'm not sure what you were referring to at the beginning, and if somebody treated you badly because of something that we're doing in this committee, I just want to apologize to you for that. And I hope that they I don't know what the situation was. I just heard your reference. I don't so I guess at some point, maybe I need to learn, understand more about what happened. Maybe I don't. But that doesn't feel right. I think for me, what I'm hearing is the question is, at what point do we as individuals give over our control of our data to business? And at what point does business have more rights than individuals? And I think that's what really we're grappling with here. And when we were talking about what happened, when we had phone books, we could, I remember that, and we could say, Don't put my information in there. It was very different than it is today, where, especially for us, right? I represent Jericho. I work in Montpelier. People can make all kinds of references of what I do between here and there. That's public information. It's very were recorded every day. These meetings aren't just written notes where they used to be. So there's so much more information out there about what is happening. And so, because that information Because this happened over time, and this information getting out and businesses having more and more and more of it, and us not knowing who has it and what they're doing with it has just been happening, it's really hard for us to put our foot down and say, we're not gonna let this business practice keep happening because it is gonna have business impact. It will, whatever we do will have business impact. And we just have to decide at what point are we comfortable saying the personal rights need to be protected here. And so it's a big struggle for me. I know it's a struggle for everyone around this table. And I appreciate that we're doing this in a way that is collaborative, even when we get frustrated by it. So I don't

[Emily Carris Duncan (Member)]: know that I had a question there, but I just.

[Monique Priestley (Clerk)]: You just made me think of something. I guess when we think about the business impacts, this is specifically businesses that are selling information. And when we think about that being data brokers and the last time I checked, we didn't have a single Vermont business registered in the data broker registry that was active. I don't know if that's changed recently. So I don't actually know that this applies. This is in particular number three that we are actually talking about Vermont based businesses and the impact. Go

[Herb Olson (Member)]: back to Jonathan's question, which was what would happen? Mhmm. It it's way impact would be the impact on consumer of leaving that Subdivision 3. People have different impressions of how important it is, but for me, it is, if you don't have Subdivision 3 in there, a consumer would not be able to exercise right to challenge the accuracy of that information. How important that is, that's for us to think about. But to me, because if it's not in the exclusion, it's not publicly available information, and it's therefore not personal. I hope I got that right. I don't think so. No.

[Jonathan Cooper (Member)]: But I think I know what you're getting at, though, that we'll see more and more entities relying on an assertion of its publicly available nature to mean that the request is denied or is not valid. But I think yeah. So I think I get Rob?

[Herb Olson (Member)]: I'm gonna dive with regards to that

[Michael Marcotte (Chair)]: concerning this understanding. Abbey?

[Abbey Duke (Member)]: Got a couple of things to say. One is that I will go on the record saying I use LinkedIn all the time to understand, whether it's witnesses, colleagues, their backgrounds, their qualifications, their opinions. I think that's what LinkedIn is for, and it's really appropriate for all of us to use LinkedIn to understand the perspectives that people bring and the qualifications that they bring. And number two, I think we need to keep in mind, this is not just about impact directly on the activities of specific like, for example, your point that we don't have data brokers registered in Vermont. So it's not just about that direct impact. It's the impact on the business activities of Vermont businesses in terms of transactions they make, things like that. So that is where my concern is. Know So, think we have to keep that in mind. It's not just that direct impact to businesses. It's the daily business activities of businesses and how What would be the consequences of going outside of the way this is regulated in other states?

[Anthony "Tony" Micklus (Member)]: I'll just keep coming back to this Romanette III, which seems to be the crux of hell. I'm a practical person. I like to think these things through. And one of the things that I've been pondering is if the Department of Motor Vehicles has my data wrong, I can call the Department of Motor Vehicles and request that it be corrected. But the question then becomes, if a data broker or any third party has data that they bought from me and then I, and and it's inaccurate, if I go to them and say that's inaccurate, what's gonna happen the next time they refresh their database? If the source data is still inaccurate, what am I really doing? I'm not really accomplishing anything. And I feel like there's a couple of levels, and it's specific with publicly accessible data. Because even though you have these businesses that are collecting that data, they don't necessarily have authoritative control over that data. You know, just because I change it in a database at, you know, I don't you know, Amazon or whatever, doesn't change it everywhere else. So, don't know. But the other thing that keeps coming to mind is, why is it that this one exemption, this one piece, this 44, all of a sudden eliminates your rights to request data, to request corrections, to correct deletions, when you can do that in public databases as it is now? And, you maybe not to delete it. It depends on the public database. But certainly changes. Why don't we have something that gives consumers a bill of rights, so to speak, regardless of whether it's public data or not?

[Emily Carris Duncan (Member)]: I agree with you, Tony. I feel like way back, I brought up this example of the credit freeze. I think it's a beginning that is for, I don't know, I guess it maybe has an accuracy issue there, but at the very least, there's some sort of remedy to get your information somewhat cleaned up. But I think, actually, to your point, though, you have all of these private businesses that may have these bits of inaccurate data that are making decisions about you or your life or your loved ones or whoever. And getting that whole process cleaned up is something that is a daunting task that's been put on consumers. I think going to Edye's point, I was thinking here about just the actual intended usage of the data. You have social security numbers that are used not for their intended purpose. They've gotten such an expansive use. I mean, passwords alone are, I mean, that paradigm is functionally useless, to be honest with So the push from the commercial and business sector to change the intended uses of our information is also a problem here, because it may not actually be accurate for the purpose that they're being used, but we're being asked to do the cleanup on how to keep that regulated so that people can engage in regulated business function. And one thing I will point out is that, especially for Vermont, a lot of our standard consumers are also business owners. So they're straddling the line, and then there is that issue of liability based on whether that information is accurate or not. When I think about protecting Vermont businesses, I also really think about the liability side of it, not just the business function side of it. No questions, just savings.

[Herb Olson (Member)]: Other questions?

[Michael Marcotte (Chair)]: Zai, did you want to weigh in?

[Dylan (Industry representative for LexisNexis/data broker interests)]: Well, I was going to weigh in more broadly on the bill, not specifically publicly available information. So Zai could be available tomorrow. I could go now, but if you're having a specific discussion, I don't want to derail. Unless you want to

[Jonathan Cooper (Member)]: I don't know. We get it. Well,

[Michael Marcotte (Chair)]: it's lunchtime. I don't know if we're going back on the floor at one or not. If we're not, let's be back in here. If we do, let's come back in here and recess again. Played a lot, we've talked a lot, we need to make a decision. What do we do in this section? Think Dylan has provided some other language, everyone's seen, that's a possibility, Possibility. Even alone, we'll just know what we have. Some of the items going with Connecticut, there's a lot of possibilities. Entertain. So let's think about that over the lunch hour and come back and have more discussion. We feel applied.