Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good afternoon, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Thursday, 05/21/2026 at 04:08 in the afternoon. Back from my last fourth session for today. So I think we can continue on looking at chambers' tasks. I think we are on applicability. I think we have had discussions on that, on the thresholds. We settled on 3,000 for both, or that's what the question was. Is that where people are happy to be at? I'm sorry, thresholds for birth control.

[Kirk White (Ranking Member)]: Sensitive and

[Herb Olson (Member)]: sensitive data?

[Abbey Duke (Member)]: 3,000, Yeah. Oops.

[Kirk White (Ranking Member)]: I thought it was shit

[Emily Carris Duncan (Member) [uncertain]]: or something.

[Herb Olson (Member)]: And I can't remember what I said, but I'm okay with that threshold. I am interested in, when we get to the consent section around sensitive data with page 31. Going with consent around sensitive data differently from the notice and consent kind of provision. So, can wait for there, but I just want to flag that I have that issue around how Because right now, it's not so much maybe a threshold, but it deals with sensitive data and how consumer should be able to consent to that. If right now, it's an opt out, If you disclose, you opt out of a disclosure report, 5,100 page. And I'm interested in exploring with the committee the notion of, because it's sensitive data, that should be a higher standard in terms of the consent and handle it more like we do genetic data, and have an opt in. So, maybe that's premature, but I just wanna flag that, because we were talking sensitive.

[Michael Marcotte (Chair)]: So on the sale of personal data, let's take that one first. Are we okay with 3,000 threshold? Seems low. That's the recommendation we received from. Right. They should talk to some

[Edye Graning (Vice Chair)]: Members. Members. Alright.

[Michael Marcotte (Chair)]: What

[Kirk White (Ranking Member)]: is that? Thought we were just doing an applicability threshold for, but I didn't realize we were doing it for state health. I was just curious because Connecticut has zero for both. What is Connecticut twenty twenty five sale? Personal data? Yeah.

[Rick (Legislative Counsel)]: They're both one and done. Sale, personal, or collecting sensitive?

[Michael Marcotte (Chair)]: Sell or

[Edye Graning (Vice Chair)]: collect any, you're included.

[Kirk White (Ranking Member)]: Right. And I guess since we're veering away from Connecticut 25 was already veering away from what other states are doing. I guess I just would like to look at what the like, New Hampshire. I don't remember the structure. It's, like, completely different. So just I can't remember what those thresholds are.

[Herb Olson (Member)]: And I apologize, I didn't fully understand what you're talking about with the 3,000. Been out of the room at the time, so you're suggesting 3,000 for all three categories?

[Michael Marcotte (Chair)]: Two categories. Which two? Sensitive data. Yeah. Sale versus And

[Herb Olson (Member)]: sale, got it. Well, my thoughts on sensitive data are the same. Illuminating on the sale.

[Rick (Legislative Counsel)]: Looks so so I haven't researched this. I'm just looking at the New Hampshire text for the first time in a while. 100,000 is their threshold for initial applicability, 100,000 consumers. Controller process the personal data of not okay. So this is that's passed by the seller is their standard, which is the 100,000 generally, and then 25,000. And then if you 25% of your revenue was the sale of personal data that's passed by December. That's you can just pull that up. But that's what New Hampshire has. I imagine that's what many other states that passed the bill in twenty twenty two, twenty twenty three have. So Connecticut lowered their a 100,000 to 35,000, and then they added those one and dones and removed the 25% sale of personal data from your gross revenue. Right?

[Abbey Duke (Member)]: Can I just ask?

[Kirk White (Ranking Member)]: I'm just I'm just curious, just really setting out the arbitrary number, what business is it? I guess to Abbey's point of picking the arbitrary number and Sheamus picking 3,000. I'm just curious what the numbers based on, like, how many orgs are actually caught up in that, I guess.

[Edye Graning (Vice Chair)]: Yeah. We had some testimony the other day on this. Did you wanna testify on that? We the testimony was around certain professions that are on the

[Kirk White (Ranking Member)]: I get the sensitive piece. I guess I didn't realize that I don't know. I guess I didn't think that the I didn't make the the connection that the testimony was also applying to the sale of some of data. And that because I I definitely heard that the lawyers and the accountants and stuff like that, but are those lawyers and accountants also selling p I guess, like, who's selling that data, I guess, that we're talking about? We know the accountants. Lawyers can. Right. So that's who was mentioned. So who are the entities that are selling up less 3,000 or less data points, I guess? It doesn't have to be exact names, but what are we even talking about? I don't Yeah. Looking

[Michael Marcotte (Chair)]: for trade associations or the trades, what businesses are selling.

[Kirk White (Ranking Member)]: Yeah. What category are we even talking about? Yeah.

[Herb Olson (Member)]: Mr. Chairman, do want me

[Michael Marcotte (Chair)]: to Yes, please.

[Ed Sullivan (Vermont Chamber of Commerce)]: I'm Ed Sullivan with the Vermont Chamber. So where this differs from Connecticut is the inclusion of nonprofits elector exempt in Connecticutsville. So I think that's an important distinction. So when we look, part of the conversation, when I was testifying was what is this need for nonprofits who do have to supply there to sell? And sell does not mean for monetary exchange. And so what does that nonprofit number look like? I encourage the community to hear from nonprofits about that. So it was trying to find, is there a number where those smallest nonprofits who may be exchanging information in a way that's necessary in order to get philanthropic grants? And so I can't decide that 3,000 is the right number for them. But trying to create a threshold that could say, especially organizations that are working with just Vermonters, what could be that small organization versus larger organization.

[Kirk White (Ranking Member)]: I guess for picking a number for support professionals that are handling sensitive data, I'd like 3,000 go along with that. The 3,000 on the sale, since we haven't heard testimony on that and I didn't realize nonprofits were selling data, I guess, if that's who we're protecting. Just I guess I just don't understand that one.

[Rick (Legislative Counsel)]: Right. So I can provide some, I think,

[Michael Marcotte (Chair)]: and Megan can correct me.

[Rick (Legislative Counsel)]: I think the the the concern from the sales or the definition of sale includes, obviously, for monetary or other valuable consideration. So that doesn't have to be money. I think the discussion was that a nonprofit could give its list of members, not charged for it, give a list of members email at whatever it is. Right? And that could be determined consideration. If you're doing that in response to being invited to speak for something, you're you're so that's my understanding. I don't I won't speak as to policy decision, as I say. So that but I think it's the definition of sale is the concern.

[Michael Marcotte (Chair)]: And I think some of the concern is also if a nonprofit has applied for a grant

[Kirk White (Ranking Member)]: to get

[Michael Marcotte (Chair)]: philanthropic organization that requires the non profits to disclose their membership, or it could be who else is donating, besides that it might be a requirement, they want to know who else is donating. So those are, I think, some of the examples that I heard too.

[Herb Olson (Member)]: I could see sort of crafting a change in this sale threshold around those specifics in terms of nonprofits and in terms of something other than monetary. But if it went beyond that, I'd be kind of in the boat of, I'm not sure what it means, what the impact would be.

[Edye Graning (Vice Chair)]: So just for clarification, folks would be, some folks, be more comfortable if we made more clear what sale of personal data does not Cover this rather than putting a number on.

[Herb Olson (Member)]: Well, I'm also thinking about nonprofits. I I think the concern was nonprofits. Right, but

[Edye Graning (Vice Chair)]: the way to deal with it is to make another category of what sale does not include. So for nonprofit or purpose of Nonprofit

[Herb Olson (Member)]: that is not exchanging money.

[Emily Carris Duncan (Member) [uncertain]]: Yeah. For the purposes of reporting.

[Ed Sullivan (Vermont Chamber of Commerce)]: I just wanna make sure that I'm hearing what I think I just heard.

[Edye Graning (Vice Chair)]: And if I didn't hear that, I'm looking for more information.

[Kirk White (Ranking Member)]: I guess rather than blowing up the definition, I'd rather I'm, like, fine with going with the number. I just I guess I'm I guess I've just never seen like, I I understand a trade association or somebody as a nonprofit's, 's providing the monetary value list that makes that get that. I guess I don't really necessarily understand the federal state grant type stuff as far as personal data because I feel like usually you're either anonymizing it or giving percentages or stats. Guess those bad examples concerning as far as Yeah. Yeah, it's concerning. It's concerning that way. But I guess I'd rather not blow up the definition of sale. We have to pick an arbitrary number. 3,000 sounds fine.

[Herb Olson (Member)]: The flat 3,000 without any

[Edye Graning (Vice Chair)]: Change of the definition.

[Herb Olson (Member)]: No, yeah, I think there's two ways you could draft it. Monique was saying I'm comfortable changing the definition of sale. But my question, I guess, was whether or not you'd want to limit three, to have a threshold of 3,003, but apply it to the specific evangelists that we were hearing this about, which I thought was nonprofits and non monetary value.

[Michael Marcotte (Chair)]: I'm probably making the Yes. Cut off the So

[Emily Carris Duncan (Member) [uncertain]]: now I'm confused. Are you asking to narrow it so that it's focused on nonprofits? I'm still confused. Or are we just picking a number?

[Michael Marcotte (Chair)]: Like, we're picking a number. Yeah. Think So

[Rick (Legislative Counsel)]: both at 3,000. Is that right?

[Kirk White (Ranking Member)]: Yeah. I guess one thing I I guess I'll be concerned with that. Like, I maybe this isn't the guidance piece that goes to nonprofits that are especially if they're, you know, sharing people's personal data, especially if they're donors with other people or selling those donor lists and or businesses that are selling selling to customers. Don't know. I guess with the neighboring Connecticut being, like, the regional standard now being zero for sensitive data and sale, if those entities are selling, and we have this I think we have the same definition of sale at this point as Connecticut. So if we're if any of those entities have a single Connecticut's personal data in their records, they'll be adhering at least the for profits to Connecticut. So I I guess if we're going to be providing education or guidance from the AG, we should probably give those entities a heads up that they should probably be looking out for neighboring state laws and regional laws, because otherwise they're going to get themselves in trouble. Especially ski resorts and stuff like that. I can see with biometric facial stuff and

[Herb Olson (Member)]: yeah.

[Michael Marcotte (Chair)]: Minimization. Staging is good. That we have.

[Jonathan Cooper (Member) [uncertain]]: In some way?

[Michael Marcotte (Chair)]: I

[Herb Olson (Member)]: have a real concern with the way datamization is defined in duties of the controller. The way I understand it, the way it's defined, it's got a great first standard, reasonably necessary and all that. But my understanding of by adding the phrase as disclosed to the consumer, kinda blows it up in terms of you can disclose what you're providing whatever page document. And that's okay because the consumer can then would then need to opt out of that and might not know in the 50¢ BKH document exactly what they're Well, they wouldn't even be able to find it, so they wouldn't even be able to opt in. So, Put it on the table is that I would drop the phrase as disclosed to the consumer from the vaccine.

[Edye Graning (Vice Chair)]: I'm trying to find it.

[Herb Olson (Member)]: Page thirty

[Emily Carris Duncan (Member) [uncertain]]: one? Five,

[Herb Olson (Member)]: six, seven, I think. Page

[Rick (Legislative Counsel)]: 30.

[Herb Olson (Member)]: What's that? Page

[Rick (Legislative Counsel)]: thirty, three zero.

[Emily Carris Duncan (Member) [uncertain]]: It's not Right, 31 is sensitive. So

[Herb Olson (Member)]: if know, I'm just thinking about how this all fits

[Michael Marcotte (Chair)]: together. And

[Herb Olson (Member)]: yeah. Line six. Page 30, line six. Because of that phrase, you know, maybe I'm not reading it right, but the way I'm reading it is by having that phrase as disclosed to the consumer, you're endorsing a sort of global notice. You notice it, you're okay. And maybe I'm reading around, but that was my inflection.

[Kirk White (Ranking Member)]: Yeah, definitely not. Understand, like I know it's is what the chamber put as far as being Okay, but definitely not in my mind. Going through this, it's one I guess a few things. One is we're creating a completely new standard that we were trying to get originally one, originally, we started a strict data minimization like Maryland. And then the idea was to try to come up with something that business that was more clear to businesses, which we started rolling that back, but trying to reduce ambiguity. And then we Connecticut was trying to do with their intent of copying California as the kind of leading minimization standard in the country. And I think we heard from both sides of the table, as far as witnesses go, people who deal in the business compliance piece and people who are advocates of California. California should be an option that's considered as it is the most clear standard. And in order to copy California's intent, we have to make up something new. But the version that we made up, running by people like, one, lawyers I emailed Rick and Todd that there's lawyers that are saying that potentially this standard as it is now would undermine it is weaker than and would undermine our unfair and deceptive practices from the Consumer Protection Act. There's people saying it is it is weaker than Connecticut 2023. So if we were trying to get to 2025, we're not even there. One of the leading legal scholars in the entire world said that it is flipping it from being privacy protective to an open season on exploiting the citizens of Vermont, and that it's garbage. I mean, no offense,

[Michael Marcotte (Chair)]: Kirk. And

[Kirk White (Ranking Member)]: I guess there's just lots of questions of it is saying and saying it's exploiting because it's saying that you can do whatever you want under so I agree with you, Herb. They're, saying you can do whatever you want as long as you disclose it. I think if we I agree with you that an option could be to remove that disclosure, But then we complete it create a complete ambiguity, which would then need to be rule made by the AG in order to tell that businesses would have no idea what to do. So for better or worse, I guess no idea what to do, meaning you can't do anything. Or not knowing what to do, wanting to do the right thing and then needing advice. And when the AG rule makes, I don't think that's good for businesses either way. Because one, could create a weak standard that doesn't protect consumers. Or on the other side, create a standard that businesses don't like because it's actually much stronger than anything we would put in. It actually gives us a lot more leeway to the AG than I think the business community might be intending. And yeah, I guess this is the literal part of the bill since we are taking out the private right of action. And this kind of makes or breaks whether or not this bill is even worth moving forward in

[Michael Marcotte (Chair)]: my mind.

[Herb Olson (Member)]: Yeah. So I can I just I didn't quite understand by removing those three words why it would create ambiguities, and that's maybe just I don't understand all the interplay? It seemed to me that the standard itself, not You don't collect any more than you really need. I'm not sure what additional clarification would be needed. And if it was major stuff, I could see that. If it's more, just don't understand why. There may be a good reason why it's not sufficient. I'm sure there would be need for drafting, you know, changes to make that concept consistent with the rest of

[Michael Marcotte (Chair)]: the field. But in the like, I trust.

[Kirk White (Ranking Member)]: Sure. Mike, just wanna look. Is that on the we have an unlimited collection. We separate our collection and processing, and in that, we should have limiting collection and processing on the initial e the first sentence.

[Herb Olson (Member)]: I'm sorry.

[Michael Marcotte (Chair)]: I didn't catch it.

[Kirk White (Ranking Member)]: The where it starts off, the the limit on collection should be limited collection and processing. Because otherwise, you're, like, taking in and then doing whatever you want with it and then disclosing that, whatever you disclose.

[Anthony "Tony" Micklus (Member) [uncertain]]: It seems like the hang up is the word disclosed. Do we have anything in statute that defines disclose?

[Rick (Legislative Counsel)]: That would apply to this. You need to define it if you wanna have it actually mean something.

[Herb Olson (Member)]: The way I understand, I don't know if it's fine, Tony, but I think as a fact, no matter how this how you would be disclosing it, there's a bunch of provisions around privacy notice. And I think that is the mechanism that I see in this legislation that a controller would disclose. And so by having those words as opposed to the consumer, I think that I could be totally on, but my sense is that the disclosure that the controller would want to put into their privacy notice what they're collecting that they feel is is reasonable. And the only pushback about that would be if the consumer was able to go to understand that privacy notice and opt out of it. I think that I could be gone, but that's my sense of how it would work the way it's constructed.

[Kirk White (Ranking Member)]: And somebody summarizes this. So thinking about where I'm saying it's gonna weaken, just undermines or isn't as even strong as our existing Consumer Production Act, which we're trying to add layers of protection on. In UDAP, the gist of it could be, you can't hide important terms in boilerplate text. Even if you it, you can't do it if it's too dangerous. And then this minimization standard essentially is, we encourage you to hide the most important terms no matter how terrible or harmful they are in dense and unreadable boilerplate text, or in the alternative, turn the web into an unusable I agree hell, that also doesn't protect anyone unless companies exploit people no matter how dangerous their practices are. So the unfair and deceptive practices.

[Emily Carris Duncan (Member) [uncertain]]: Isn't that where we are now?

[Kirk White (Ranking Member)]: We have nothing. Yeah. Basically, yeah.

[Emily Carris Duncan (Member) [uncertain]]: There's theoretical paradigm of infrastructure of having disclosure and opt out is where we are currently at, and we know that that doesn't work.

[Michael Marcotte (Chair)]: Yeah, exactly. Right.

[Jonathan Cooper (Member) [uncertain]]: Recommendation Herb was to remove as to what? As disclosed. Yeah.

[Herb Olson (Member)]: Yeah. As disclosed to the consumer, which I think would allow, would really give meaning to the previous two

[Michael Marcotte (Chair)]: lines. It's a limitation on what can be collected, to what is reasonable.

[Abbey Duke (Member)]: Yeah. I

[Edye Graning (Vice Chair)]: would need to understand what the actual implications of that seems like it's loaded with

[Abbey Duke (Member)]: the pages,

[Emily Carris Duncan (Member) [uncertain]]: I think it's 30.

[Herb Olson (Member)]: Yeah. No. I I hear you. My thinking, though, I think I understand what the implications of having those words are. Yeah. And I'm

[Michael Marcotte (Chair)]: not thrilled. Rutland, do you have a legal opinion or not? And

[Kirk White (Ranking Member)]: which one, Herb? Because there's two.

[Jonathan Cooper (Member) [uncertain]]: What was

[Herb Olson (Member)]: that? There's two. Oh, dear.

[Kirk White (Ranking Member)]: I think the first one and the second one, two different things. Yeah. I I mean Oh. I would suggest the first one.

[Herb Olson (Member)]: Yeah. Yeah. No. It was just it was on line six I was pointing to.

[Abbey Duke (Member)]: Excuse me. That says that would have significant

[Michael Marcotte (Chair)]: implications. Yeah. I

[Rick (Legislative Counsel)]: think they're connected. Four and eight, four and nine. The controller discloses in a privacy notice. Right? How they collect and process, which is if you look at the privacy notice on c page just humerate for a second here. Subsection c, page 33, Ultra Act 4.2. A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes a, that the categories of personal data processed by the controller, the purpose for processing personal data, and then other things maybe not related to data minimization. So my assumption is that a controller would put that disclosure in the privacy notice. Right? That that they're otherwise required in this bill to do. Yeah. That's So going back up to, you know, removing as disclosed to the consumer, you would probably remove both of them because they one refers to the other. So the controller discloses it based on what they're doing, and then they cannot process for any material new purpose that is not compatible with that disclosure they made initially. Right? So it doesn't make sense to move to remove one and not both.

[Herb Olson (Member)]: Right. Is is the other one you think that needs

[Rick (Legislative Counsel)]: So I'm looking at it on page 30. Line six. Yeah. And then line nine is the other Oh, I see.

[Herb Olson (Member)]: You you're saying you need to move up both? You'd need to yeah.

[Rick (Legislative Counsel)]: It wouldn't make sense to keep one and not the other.

[Herb Olson (Member)]: I see. And if we

[Abbey Duke (Member)]: made those changes, that would put us out of sync with other

[Rick (Legislative Counsel)]: Connecticut uses this language. I don't know how to use the

[Abbey Duke (Member)]: disclosure language. Right. Right. That's my concern is I think big picture, it's probably the right thing to do. But not, if it's putting Sure. From a law outside of regional norms. Except

[Herb Olson (Member)]: this would be different than Connecticut 2025. It's, I think, consistent with Connecticut 2027. I guess the main thing,

[Kirk White (Ranking Member)]: It's it's the image. Nobody no. Has I mean, nobody has this in general.

[Abbey Duke (Member)]: Yeah. This

[Rick (Legislative Counsel)]: would be

[Edye Graning (Vice Chair)]: its own thing. Capture?

[Kirk White (Ranking Member)]: No. Nobody has this as written exactly the way it is. Yeah. I guess I was gonna say, if you why

[Abbey Duke (Member)]: to be really careful with that.

[Herb Olson (Member)]: Understand. The the only reason why it occurred to me is because we've been looking at drafts that did not have that, and now I see it. That's why it keeps. Obviously, we need to move, you know, so, you know, whatever you think.

[Anthony "Tony" Micklus (Member) [uncertain]]: So let me get this straight. Disclosed here is based on the concept that the consumer, when they went to wherever, went and read the privacy policy. Right?

[Rick (Legislative Counsel)]: It would be up to the consumer,

[Jonathan Cooper (Member) [uncertain]]: right, to read that. Right.

[Anthony "Tony" Micklus (Member) [uncertain]]: Yeah. And we have mandated in this bill to make sure that the privacy policy is, in summary, clear and easy to understand.

[Herb Olson (Member)]: Mhmm.

[Anthony "Tony" Micklus (Member) [uncertain]]: So with that in mind, I don't see I understand what you're saying, Herb, about a 50 page EULA and them saying, well, you signed our 50 page EULA, so it's been disclosed. But if we have mandated that disclosed means the privacy policy, and we've mandated that the privacy policy is what is supposed to be easy to understand, I don't feel like it's necessary to remove this.

[Rick (Legislative Counsel)]: I think I understand the the the concern. The concern is that that phrase opens up potentially that you shall limit the collection, etcetera, etcetera, as disclosed to the consumer. So maybe you can just rephrase that and disclose such to the consumer. Mhmm. Maybe there's an easy fix. Maybe it's you still want I think you still want that disclosed with the consumer.

[Jonathan Cooper (Member) [uncertain]]: I

[Rick (Legislative Counsel)]: mean, I think legally, it makes sense to have that disclosed to the consumer what they do. Right? You don't wanna remove that piece, but maybe it's the way it's worded is the concern is that you don't wanna open up the possibility that the controller uses that language to do other things. Is that the concern? I'm trying to okay. Yeah. I think you can fix it. Mhmm. Yeah. Without totally yeah. I I just I don't see that removing that sentence that phrase really helping the consumer or the controller.

[Emily Carris Duncan (Member) [uncertain]]: So

[Herb Olson (Member)]: are you getting at that the privacy note or maybe Tony too. Are you getting at the privacy notice clearly in the clearance conspicuous manner? Disclose or show that the information that they're actually collecting is only reasonable and necessary. Right? Is what you're getting at, sir? Because if that was the issue, I'm looking for a privacy notice, and I don't, I might be missing something, but I don't see that articulated in the requirements of privacy.

[Rick (Legislative Counsel)]: I see A and B as the categories of personal data. Yes. But a controller, the purpose for processing. If you wanna add something that says there reflects one that says the

[Herb Olson (Member)]: maybe it's it's, you know, categories of personal data processing, private controller, which shall be no more than immediately necessary or or that somehow pinpoints. This is the data that we feel is no more than immediately necessary.

[Rick (Legislative Counsel)]: You can add something. Yeah. You can add something.

[Kirk White (Ranking Member)]: Rick, I'm just wondering, so a few things. One is your thoughts on how this limits any processing and then what makes Material new. Thinking about apps that either have different privacy policies on their website versus their phone app, and ones that give you an express purpose of what they're doing, but then weather apps that collect your that are giving you kind of serving you the weather, but then selling your geolocation behind the scenes. Or any number of the different apps that's LinkedIn or Meta or any of the things where Microsoft where they're like they're now just saying that they're going to hiding their privacy policy but not letting you know in general public that they are now training their data on like, that their AI systems on your personal data. A lot of these things have just been caught because privacy professionals have gone and seen the toggle buttons turned on or off. What constitutes material in that and that switch in types of processing once they have So

[Rick (Legislative Counsel)]: it's not defined. Right? So what is a material new purpose is gonna be a somewhat subjective thing that a controller gets to decide. And if they're wrong, the AG could ask them to change their behavior or pursue litigation, whatever they decide to do. So you could define the term. I can't give you examples because I I'm not in the field, but I've you know, I think there's some maybe obvious ones like you mentioned. Right? That's clearly a material new purpose. You got this weather app. You've reached their terms. And then these they do something totally different that you never thought that they would have done. And it's not reasonable and proportionate. Right? So there's some gray area. And, you know, if you wanna make that less gray, you would define what that is. But, yeah, otherwise, I can't really give you a clear line that would be crossed.

[Kirk White (Ranking Member)]: So the question is how this how you feel this version compares to Connecticut 2020, like earlier versions of Connecticut 2023 before they even had data men versus now where they have the kind of reasonable expectations outlined the way that California does and that's missing from this?

[Rick (Legislative Counsel)]: I've I've been saying from from the beginning that I I think it's helpful to have more details because, you know, this it's helpful for the consumers and for the controllers to know what is expected. Right? So that's why draft 3.3 had Connecticut's idea of explaining what is reasonably and proportionate and mixing in California's rulemaking, which went into better, thorough, phase of explaining what that is. So that's my suggestion, but, I know that's not always politically the right thing to do. So I do think it you wanna be clear and in a very complex thing. So it's it's gonna be a delicate balance. And I don't know. And this is such a new area too. So you're really trying to address a developing thing.

[Kirk White (Ranking Member)]: Yes. In your professional opinion, I'm just wondering your thoughts on how the clarity and potential ambiguity or not of this standard compares to California. In the very least, thinking about maybe the reasonable expectations, the I guess, the obligations, in essence, come Like, as far as if we're going to make a completely new standard that isn't, in substance could get at where other states are going. But words on paper, they're not the same. So we are making something up. So trying to get it based on something. If we want to be clear for both consumers to be able to understand what their rights are in paragraph, and we want businesses to know their expectations for operating a business. Yeah, I guess the standard between California where it's at and this versus, I don't know, what else?

[Rick (Legislative Counsel)]: I'm trying to remember California statute and, you know, compare that to the rulemaking because the rulemaking is where they have become very clear on what the statute means, which is what we do all the time.

[Abbey Duke (Member)]: Mhmm.

[Rick (Legislative Counsel)]: You make statutes, and you leave it up to rulemaking either intentionally or not to fill in the gaps. With the kids code law, you you called out a couple times the age assurance and the design practices of the controllers. Right? So there you you've told the AG, these two instances, we really want you to help people understand how to collect age of your users and how to design your apps to be kid friendly. Right? So I think it's gonna be difficult to match California without the rulemaking being done. Right? They've had their statute in in place for a while. The ages had time to think about it to see what is missing, what's working, what's not working, and they've supplemented the statute with rule making, which ideally you would do that here too. Right?

[Kirk White (Ranking Member)]: And I guess we were so because we were trying to base our earlier drafts on what Connecticut was trying to do with their intent of trying to make it as clear as possible and match California, I'm wondering your thoughts on like 3.3 was that essentially. And I'm wondering, I guess, your thoughts on where 3.3 was versus this.

[Rick (Legislative Counsel)]: I I I guess I don't have an opinion. I I drafted that, so I I thought it reflected a hopefully more clear understanding, but, you know, that's not what the committee wanted to go with. So, this is more of a the Connecticut model, but not because you took out the definitions that Connecticut has. Not definitions, but, you know, what is reasonably proportionate.

[Kirk White (Ranking Member)]: I just want to guess I don't know if we did the committee wanted to go versus that is what the draft was that came to us. I guess I was set on 3.3. So I know how the truth is, but I'm just No, get it. I'm just saying 3.3 was yeah.

[Emily Carris Duncan (Member) [uncertain]]: I guess I would say it seems like a path to clarity for both controllers and consumers seems right. I know that that takes us off the Connecticut 2025 path, but we also have made some adjustments that took us off that path anyway. But if it is possible to see something that is spelled out and clear, and I guess with the addition of rulemaking to make it even more mature, think that would be a good way to go.

[Michael Marcotte (Chair)]: I don't know you've had a fix for this. Sorry. What was the question?

[Herb Olson (Member)]: I'm thinking that maybe there's another way to address this. I mean, my key thing is that to make sure that that's standard for the control of you only collect what's reasonably necessary isn't diluted by the sort of notice structure. And I'm wondering if maybe you could do that in data impact or assessment study by having the controller explain that. It's an assessment of risk, harm, and that kind of thing, and impact on consumers. And maybe by putting it in there, tell us how you are implementing that standard, would help to separate the two, and actually have that data minimization standard, but not the bulk, and still bring in the concept of the notice and everything, but make sure that the AG nodes and the controllers know that you still have that independent obligation to collect more than it's reasonably necessary. I don't know if it works. Just for that.

[Anthony "Tony" Micklus (Member) [uncertain]]: I just, did you say you

[Michael Marcotte (Chair)]: had a fix for this?

[Jonathan Cooper (Member) [uncertain]]: For the What we

[Anthony "Tony" Micklus (Member) [uncertain]]: were talking about here, assume you

[Rick (Legislative Counsel)]: can't remember ten minutes ago. You said that For the data minimization? Yeah. A fix?

[Anthony "Tony" Micklus (Member) [uncertain]]: After I'd mentioned the whole thing about the disclosure, you had mentioned

[Rick (Legislative Counsel)]: Oh. Oh, no. Well, I if if if you want to sorry. That was just about the disclosed consumer. This is a different Todd. This is like they've gone on to the subdivision one in general, that entire one. Yeah. But, yeah, if you wanna keep this language as is, I think I can fix the as disclosed the consumer piece. But that's this is tangential on everything else.

[Michael Marcotte (Chair)]: I

[Kirk White (Ranking Member)]: want to minimize people's collection and processing of data, and I don't know that this actually minimizes that. I guess that's the point for me is I don't see this as a strong data minimization standard in general. And if we're removing the private right of actions we've done and we are giving solely enforcement, then I think we had discussed generally over the course of this session that we need to minimize the risk to consumers and to the risk to businesses. And in that, a way to do that is to minimize the amount of information they're collecting and then using and selling and holding on to and that kind of stuff. I don't see how this gets

[Edye Graning (Vice Chair)]: there. Yes, I'll jump in. Think it's miles better than what we have today. And I don't want to forget that in this conversation. Right now, there is collection of data without any disclosure at all in Vermont, unless it's from a business that is domiciled or does more business than other states that have data privacy. So I appreciate that this isn't as strong as we would probably like it to be, or as many people around the table would probably like it to be. If we choose not to start somewhere that is palatable, then we haven't started. And so I'm concerned about it.

[Michael Marcotte (Chair)]: Okay. I would also say that don't forget we have an eighteen month on ramp. That changes, I think, being made in Connecticut were contemplated to be made on data minimization that will be in place before the stakes back. That those of you that are here need to continue to be vigilant and paying attention to what's going on in this realm that can make those changes. But I think as the vice chair said, we have to start some. So agree it's probably not as strong as I would like it, but it's better than what we have right now.

[Herb Olson (Member)]: And I recognize that. Just thought it was important to raise because I think it's real key issue. Yep.

[Michael Marcotte (Chair)]: I think we need to talk about it. If that's the

[Herb Olson (Member)]: way we're gonna proceed, I'm gonna really focus on the impact statement to the Attorney General, so that the control has an obligation to show how they're conforming to that only was reached from the necessary standard, irregardless of what you put in the notes. So

[Rick (Legislative Counsel)]: a couple of things before we address that. Are we adding the limited collection and processing to that? I feel like that was fair. Okay. And then I'll work on the as disclosed to the consumer. Not gonna remove it, but gonna ensure it's not a you had a word for it that they used earlier. I forget the term, but I think I can propose something that you all can consider tomorrow. The data assessment is only for a heightened risk to a consumer. So they only do those if they sell data for targeted advertising sensitive so you could add something.

[Herb Olson (Member)]: Okay. So

[Rick (Legislative Counsel)]: I'm looking at page but I don't wanna totally get off the

[Michael Marcotte (Chair)]: topic here. But if that's what you wanna add

[Rick (Legislative Counsel)]: on page go past it. On page 41, a controller shall conduct and document protection assessment for each of the controllers, process and activities that presents a heightened risk of harm for the consumer, which is processing. So you would just need to we would need to expand that to Yeah.

[Herb Olson (Member)]: I mean, I think the concept still fits there, but yeah, I'll give some context. I still think it's an important piece if we're not going to change what's in the community control.

[Edye Graning (Vice Chair)]: We need language for the committee tomorrow morning. I can do

[Ed Sullivan (Vermont Chamber of Commerce)]: that. Okay.

[Edye Graning (Vice Chair)]: Again, I'm the timekeeper here.

[Herb Olson (Member)]: I just don't have it in my mind, right? I mean, I do, but it's not disclosing.

[Michael Marcotte (Chair)]: We're on board with this? Are the majority on board with it? No. Everybody knows that. No.

[Kirk White (Ranking Member)]: I know. Barb's giving me a face like he's looking for my thing, and no.

[Michael Marcotte (Chair)]: Definitely not. Yeah. K. Let's see what it was. It forced. We okay.

[Kirk White (Ranking Member)]: Same. We have an eighteen month implementation done as a cure period.

[Jonathan Cooper (Member) [uncertain]]: I'd be willing I think that's a persuasive statement for me. If we we have time to figure out if we really, really need it, and I'm inclined to think that maybe we do, but I'm also inclined to think that we don't need to do that. I don't think we need it right now, because I think we have to We're gonna learn more about this. Whoever is here is gonna learn more about this, and there'll be opportunities, I hope, for good feedback from the entities affected by the bill, and we might get a better sense of what's needed where.

[Abbey Duke (Member)]: One challenge is, eighteen months really isn't very long, especially thinking about small businesses. There's no you know, we don't have resources for technical assistance. Businesses understand how to comply. So, I mean, I think a concern is thinking about thinking about that. So I guess I I think we should at least think about it to your community. The senate talked about what an eighteen month to a period that once it goes into a check.

[Emily Carris Duncan (Member) [uncertain]]: I'm sorry. What is the

[Michael Marcotte (Chair)]: cure what?

[Abbey Duke (Member)]: Sorry. Yeah. I guess I don't fully understand how would that work.

[Michael Marcotte (Chair)]: So we would you'd have a cure period that is basically sunset. For the first year and a half, this implies goes live. Yeah. That you would have a cure period so that businesses that are trying to get up to speed, make a mistake, gives them the opportunity, tells the AG, fix it, which I believe the AG can already do that anyway.

[Abbey Duke (Member)]: It'd be a nice signal, especially for the small nonprofit, for not accepting nonprofits, it'd be a nice signal to smaller nonprofits, smaller businesses that we're trying to help them get into compliance. So I don't know if it's a cure period based on scale. But

[Herb Olson (Member)]: And I'm sorry. I didn't understand that the proposed cure period was was temporary. I think that makes a difference. Yeah. And maybe a threshold too, which makes some sense. But my initial remarks are uninformed.

[Abbey Duke (Member)]: Do you have your hand up, Dave?

[David "Dave" Bosch (Member)]: Well, I was struggling to hear and follow all of that. I'd just like some clarification. So there's a year and a half until it goes live. And at that point, it's not it's not the Indianapolis five hundred, gentlemen, start your engines. It's Lamont start, where everybody is up to speed and revved up and all that, and they take off. And we expect them to be actually implementing

[Jonathan Cooper (Member) [uncertain]]: it.

[Michael Marcotte (Chair)]: I think It all goes well. So they implement everything goes at it starts it goes live in April, 01/01/2028. Right. So this will give a cure period until July 2030. So that it's kind of a you screwed up, fix it, and you're good.

[Edye Graning (Vice Chair)]: Which is the normal AG practice, if it's not willful, harmful, like all Their of normal practice is to send a letter and say, know, did you know you made this mistake? Can you fix

[Kirk White (Ranking Member)]: Didn't Todd testify that there's no other like, when you were doing the genetic data bill, that there's no curate on any consumer production bill, and that the genetic would be the first one that we were considering? So this would be yet another conservative decade. Few years ago, we did.

[Michael Marcotte (Chair)]: Including pure periods. Sure, yeah.

[Kirk White (Ranking Member)]: Of course, that was a very different yeah.

[Michael Marcotte (Chair)]: It's not unprecedented that we thought about pure periods. I would be nice if you don't.

[Anthony "Tony" Micklus (Member) [uncertain]]: That's all right. I agree. Yeah. I mean, we're talking let's let's be real. We're talking about a thirty six month care period. And I think Abbey has a point, you know, especially when you're dealing with these nonprofits and we haven't set up any sort of infrastructure to help them along. Yeah. Well, I I can see the point, but I thought also think it bears mentioning the senate still needs to look at this and how are they going to are they we're trying to get this bill through, and I don't want to create a bill that is gonna be a nonstarter for the senate. And I think that's something we need to take into account here. I guess all that to say, I'm okay. Kirk, great.

[Herb Olson (Member)]: Do you wanna talk about any other issues around enforcement at this time?

[Michael Marcotte (Chair)]: Well, you get to it tomorrow, so. I

[Herb Olson (Member)]: mean, I've just mentioned a couple of things in the past around concern about the ability of the AG to be able to enforce this, especially as to large companies. You wanna tackle a little more? I mean, I don't know. I'm ready to stay parallel, but maybe whichever people want.

[Michael Marcotte (Chair)]: Yeah, I don't know if other people have the right way and strip the line, but-

[Herb Olson (Member)]: I wanted to raise the enforcement issue, the resource issue, and I wanted to raise an issue that I've raised before around sensitive data, and whether we should treat treating sensitive data subject to an opt in like we did with genetic testing. Those are the two issues that happened on this thing.

[Ed Sullivan (Vermont Chamber of Commerce)]: Can you say that one more time, sorry?

[Herb Olson (Member)]: Two issues that I got I think just leaving it the way the draft is right now, the AGU would be, they would have inadequate resources to deal with huge companies. Dealt with in my past lives, dealing with some humongous corporations, and they were able to bring incredible resources to oppose what a bunch of people thought were in publichood. And it was only because the office that I was in had the ability to hire, in this case, was prior approval for healthcare decisions. We were to hire skilled, independent folks around whether the insurance policies really represented good clinical decisions, that we were able to do a proper investigation and make some changes. And I'm thinking with, these are really big countries. And however good our staff is over at the agency's office, I think they'd be overmatched. Talked about in the past, giving the agency that kind of authority to, if they have reasons for an investigation, any of these big companies, that they'd be able to hire the analysts necessary to do the work, because it would be a huge amount of work. It would last a long period of time, so it's not like you could just recoup your costs because it got to an endpoint, and you could charge them for the costs of examination. It might go on for three, four years, whatever. And if they don't have the resources upfront, I'm not sure how they can start. So, I'm thinking Resources and what was the other thing?

[Edye Graning (Vice Chair)]: More resources and what was the other thing?

[Herb Olson (Member)]: Oh, treating sensitive data to an opt in provision, like we did with genetic data. And that would, in my mind, I have some language actually. And it would involve using the language that we use with genetic data around express authorization, express our consent can't be inferred by inaction, that's a typical notice thing. Can't be used dark patterns to substitute for express consent. No clear, meaningful, prominent notice. All those things that we did in the genetic data build to make sure that because this was really sensitive data, the consumer was able to make a clear authorization and permission. So that's my pitch on that.

[Michael Marcotte (Chair)]: I can read these. So on the AG enforcement, there's not a lot we can do this year. But I have asked Rick to draft some intent language that would outline the intent because absent private right of action, we're extinguishing non consumers from being able to remedy any issues that come up. Yeah. That we would need to look at resources that we can obtain for the attorney general's office in order to provide those remedies that Vermont consumers can't access on their own.

[Herb Olson (Member)]: Yeah, and I saw that language, and I think if I remember correctly, I was generally comfortable with that. I just wanna assure that however we craft that intent, that it be not simply general fund dollars that we're gonna be relied on? I think it's

[Michael Marcotte (Chair)]: Because Resources because the broad Right. Because I don't think

[Herb Olson (Member)]: it should be guaranteed for some reason.

[Michael Marcotte (Chair)]: I think, you know, I I I would like to see in nine to 10 that general assembly continues to monitor and update. I know we can't tie the hands of the next legislature, but I think we can provide advice to whoever replaces us that they continue to monitor and update our privacy laws going forward. Yeah, I hear. And

[Herb Olson (Member)]: I have circulating, what have in mind is I'm opting for sensitive data. You sent this to me. You sent this

[Rick (Legislative Counsel)]: to me. Right? Mhmm. I've seen this. Right? You sent

[Herb Olson (Member)]: this to me? I copied you. Okay. It's very similar in your Yes.

[Michael Marcotte (Chair)]: I've I've seen it. Yeah.

[Kirk White (Ranking Member)]: We do in general kind of stuff like Herb was mentioning? Or

[Michael Marcotte (Chair)]: Yeah. I just Everybody take a look at it and if we can provide this, maybe Jonathan, if you can if scan this, send it out, see everyone around the room so they have a look at it as well. So everybody that's part of this.

[Herb Olson (Member)]: But I'm really focusing just on this one because we've already covered some of those issues like the data administration. Yeah. The enforcement. Yeah. It's the sensitive data one that Right.

[Michael Marcotte (Chair)]: That one. Because so everybody knows. Maybe you I don't know if you can You have that? Do you have that, that you can email it out? Just the sensitive data piece? I could. Can't. I'll do that fine. Or I guess I

[Jonathan Cooper (Member) [uncertain]]: can do it now.

[Herb Olson (Member)]: Game of that priorities. Yep. Okay. Okay. I'll send the documents to Jonathan. Okay. Jonathan, we can

[Michael Marcotte (Chair)]: get it out. Well, we can post it on our page, and then everybody can can look at it, and we'll have that discussion forum. Okay.

[Jonathan Cooper (Member) [uncertain]]: Great.

[Michael Marcotte (Chair)]: Couple of outstanding pieces. I know that Jamie had asked, and I think I shared it with you to add the words for data. Right? So If you could put that in the document Check. Highlight it so we can talk about it. Yep. Also, I think Jessa had sent some language. If we can put that in, highlight it. So it makes sense. Was there anything else you'd I

[Herb Olson (Member)]: think there were some healthcare folks that had

[Michael Marcotte (Chair)]: We were talking to Nick about something. We have that language in

[Rick (Legislative Counsel)]: now, don't we? Health care facility language, direct providers, that's in there.

[Herb Olson (Member)]: Oh, no. I meant the final.

[Rick (Legislative Counsel)]: Last section, the consumer health data, that's also gonna be there'll be a fix or a suggested fix.

[Michael Marcotte (Chair)]: Okay. That's what I was talking about. That's right. Before anything else that I could

[Kirk White (Ranking Member)]: Yeah. Just a few things from the very beginning. Maybe just walk through was the business software alliance piece on the collect.

[Rick (Legislative Counsel)]: The definition of collect? Yeah. Adding in that Yeah. It's up to the committee.

[Kirk White (Ranking Member)]: Yeah. Just wanted to bring it up of a piece that was dropped.

[Michael Marcotte (Chair)]: Yeah.

[Rick (Legislative Counsel)]: It was in draft 3.3?

[Herb Olson (Member)]: Yeah. Okay.

[Kirk White (Ranking Member)]: And then this consumer health data is missing status from the Connecticut 2025. I've got my notes. And then I guess we never came back to discussing the agents are only allowed right now to opt out for people not to do any other requests on their behalf. Somebody would have to manually go to every single thing to exercise their rights rather than using free services to do it or paid services.

[Rick (Legislative Counsel)]: I'm looking forward.

[Kirk White (Ranking Member)]: I have it all together.

[Michael Marcotte (Chair)]: Is all to learn together.

[Kirk White (Ranking Member)]: Oh, it's I don't know what pages it is. It's under exercising consumer rights.

[Rick (Legislative Counsel)]: Page 25.

[Kirk White (Ranking Member)]: Then it's Online nine. Yeah. So this only ties to opting out, not to to being opting out to being tracked, not to being, like, being able to delete or correct or any of that stuff.

[Michael Marcotte (Chair)]: In

[Kirk White (Ranking Member)]: the very least deletion, but so Connecticut has, I think, two. I think it's outgoutin deletion, I think. California gives all of these rights.

[Rick (Legislative Counsel)]: This is based on Connecticut, so unless they updated it in 2026.

[Michael Marcotte (Chair)]: Oh, okay. Let me just update it.

[Jonathan Cooper (Member) [uncertain]]: I'm not sure.

[Herb Olson (Member)]: Have to check.

[Jonathan Cooper (Member) [uncertain]]: Well, it's to be just sec subsection a of two four one five d.

[Kirk White (Ranking Member)]: Yeah. The consumer rates in general, like, having entities be able to do it for them.

[Rick (Legislative Counsel)]: They still just have that one.

[Herb Olson (Member)]: Okay. Maybe. Okay.

[Rick (Legislative Counsel)]: 2025. Maybe in '26, they changed it.

[Kirk White (Ranking Member)]: I think they added another one 2026. And then the other piece similar to Herb was sensitive data. And, originally, we had a ban on the sale of sensitive data, and even Connecticut this year bans geolocation. New Hampshire was looking at it. Don't know if they're still moving a bill forward. Rhode Island was. Maryland bans it. Virginia did. So, that is the trend this year is to ban Yeah. Certain, if not all, sensitive data, the sale of it. Yeah.

[Michael Marcotte (Chair)]: And the sale of

[Kirk White (Ranking Member)]: Sensitive data. Like, your your fingerprints, your DNA, your consumer health data. Kinda tricky. Not personal. Sensitive data. Yeah.

[Michael Marcotte (Chair)]: Okay. Good. Good, Chris? Yes. I do. I'm good.

[Jonathan Cooper (Member) [uncertain]]: Just to confirm that I thank you. What we received today from the Coalition of Vermont Health Organizations about

[Kirk White (Ranking Member)]: the

[Jonathan Cooper (Member) [uncertain]]: section 2,426 from S71. Did I catch that's been?

[Rick (Legislative Counsel)]: Okay. It will be. Yeah.

[Jonathan Cooper (Member) [uncertain]]: Okay, thank you. That's what came from Jensen. Okay, I heard the wrong name and I misunderstood. Thank you. Alright. Yep.

[Edye Graning (Vice Chair)]: If you need to share anything about that section or something.

[Michael Marcotte (Chair)]: Yeah. We'll put it in and if you take an explanation tomorrow, that works.

[Rick (Legislative Counsel)]: So I'm in the senate committee What? From 09:15 to ten tomorrow morning.

[Michael Marcotte (Chair)]: Oh, when we get off the floor, we again, I would assume it'd be around eleven. That we'll take a look. As soon as you are able to get a draft, you can get it out, just send it. Send it to the committee, send it to the advocate.

[Rick (Legislative Counsel)]: Okay. Send it to you all, and you can send it out.

[Jonathan Cooper (Member) [uncertain]]: Send it, man. Send it. Send

[Michael Marcotte (Chair)]: it out. Any questions? K. Thanks, committee. I still go to the huge bank. So

[Emily Carris Duncan (Member) [uncertain]]: I don't know it's wrong today.

[Michael Marcotte (Chair)]: I'm I'm