Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good afternoon, everyone. This is the White House Committee on Commerce and Economic Development. It is Friday, 05/22/2026, at 03:43 in the afternoon. So we're back from another floor session to on 71. Council with us, Rick Stable. So Rick, do you wanna keep us rolling along.

[Rick Stagles (Office of Legislative Counsel)]: Sure. So Rick Stagles with the office of legislative council. We are looking at draft 5.1 of 71. I have us on page 25. The last action the committee decided on was, changing, slide 15, the authorized agent to be all of subsection a, which is every consumer right the opt out, the deletion, knowing whether or not they are x processing your data. Give me now. Great. Okay. So, the next change is going to be the data minimization, I believe, on page 30 of the draft. Okay. So I can explain maybe what I've tried to do here. And feel free to compare this to draft 4.2 to see, you know, what has been changed, what's been reorganized. What I took from the discussion yesterday was that a lot of the members of the committee found it unsatisfactory the way that I wanna use the adjectives that were used

[Jamie Feeney (Witness)]: yesterday

[Rick Stagles (Office of Legislative Counsel)]: to describe the drafting. But that it was maybe not clear. It was not helpful to control its or consumers. That's what I took away from yesterday. So, yeah, I think you have a couple options. Right? You can take literally what Connecticut 2025 has done. Right? And which is what three point three attempted to do, but also brought in California rulemaking. You can just do straight Connecticut 2025, or maybe fix what you had in 04/2002, which I am suggesting in draft 5.1. So the committee did want to add the phrase make sure I'll get this right. Limit the collection and processing. That's took that down as the committee wanted to add that to the limitation. So that's new. Limit collection and processing is new. I think I added consumer's personal data. I think it was implied what that was. But because the initial intro language does not say consumer, just to be ultra clear here, we're talking about a consumer's personal data to what is reasonably necessary and proportionate in relation to the purpose. That's all the same. Purposes. That's all the same for which the data are processed. And this is where it changes. So in the last version, you had comma as disclosed to the consumer, which some people thought that maybe allow the controller to hide things right, in their privacy policy or somewhere in their terms of service. So the suggestion is you continue on instead of a comma. So in in relation to the purposes for which the data are processed and disclose the processing that you just did or doing to the consumer and the controller's privacy policy pursuant to subsection c. And I've added something there to connect those two, which we can talk about in a second. But let me continue on to two, which combines number two is different because it combines what was in one and four point two. So a controller shall, subdivision two, shall not process a consumer's personal data for any material new purpose that was in the last draft that is neither reasonably necessary to nor compatible with the purposes for which the data were processed pursuant to one, unless the controller receives consent from the consumer. So the previous draft had after the comma as disclosed to the consumer, and unless the controller obtains the consent of the consumer, not process. So there's not really the biggest substantive difference to me is adding and processing to subdivision one. The rest of it, in my mind, at least, I don't think you're changing the substance of it, you're, I hope, clarifying what the controller, how they should limit their processing and collection, and also how they disclose such to the consumer. They do it in their privacy policy, and they cannot, process that data that they already collected for any material new purpose unless the consumer consents to that. Curious what you all think and if this addresses anything that you had concerns with last time.

[Unidentified Committee Member]: It to address my concern, I think you did that very well. I think that, separating those out into independent obligations of the controller around what's necessary, and then you gotta disclose, and then you gotta I think that's helpful to separate those out as independent obligations of the control. So I appreciate that.

[Jamie Feeney (Witness)]: Narrowly is material new purpose defined and used.

[Rick Stagles (Office of Legislative Counsel)]: So it's not defined. Something that was brought up yesterday is that you could define it. If you all want to define that, you can. I think the FTC has that term and they use it, but we cannot apply what the FTC uses. We can't assume that a controller would use the FTC definition. So, you know, the term material typically means not related. It's not something the consumer would have expected the controllers, but that's not written that way. Right? It just says material, new purpose. So it's you know, goes back to, hopefully, AG rulemaking would clarify this and provide the the AG could say, this is what we believe to be material new purposes. They could do that later on. Or you could define tariff and take that away from the AG or you know, it's up up to you all.

[Edye Graning (Vice Chair)]: You made it more clear.

[Rick Stagles (Office of Legislative Counsel)]: That's what I'm trying to do. We can disagree about policy here, but as long as you all know what this is doing, I think that's helpful. I guess I can keep going. No. Okay. Because there are some other other other that's the that's the major change. Right? Three, no changes to the administrative, technical, physical data security practices. Okay. Four, what I've done here, this is me just trying to categorize things a bit better than the way Connecticut did it, is the previous draft had a subdivision for make sure I get this right. Selling sensitive data was one subdivision, and there was a separate subdivision for just collecting and processing sensitive data. I think it should be all in the same subdivision. You can still use the same language, just organized under one number. So for regarding the sensitive data of a consumer, a, not process the sensitive data unless the consumer have provided consent. That is the same as 4.2 and unless the processing is reasonably necessary in relation to the purpose for which it was collected. The same language except organized in under one subdivision. B is also the same, not selling sensitive data unless the consumer is providing consent. So if you think about it, you cannot collect, sell, share, process sensitive data unless the consumer consents. That's and that's what 4.2 was as well. This just kinda makes it easier to understand that it's all consent. As Herb Olson would have said, I'm not gonna say opt in because I think that's maybe not the words, but the consumer has to consent.

[Unidentified Committee Member]: Yeah, let me rephrase it. I I like the way this is expected because it's my understanding that even though the words aren't identical to what was in age six or eight, the practical effect is the same. Whether we talk about I'm reading this, Rick, and you tell me if I'm wrong, that this is a permits a consumer to opt out opt in, requires that before you pass off the sale, that the consumer must opt especially opt in to the products that you can share. Correct. And even though so I'm okay with that because even though it doesn't use the exact same words as an XH six thirty nine. Okay. Or is it that it's the same legal thing?

[Rick Stagles (Office of Legislative Counsel)]: Yeah. I emailed Ripple, if I can tell you the email I sent you. I emailed you about this. So I I looked at six thirty nine express consent. It's very similar to the consent in that 71. There's a few words that are different. And I don't know the the purpose of adding express intent just for this if they're almost identical. There may be a few different ways of saying the same thing. And that's my belief. It is pretty much 99% the same. I'm okay with

[Unidentified Committee Member]: the understanding that it's the same type of consumer right to opt in as we have over in H639, however we want our expense.

[Rick Stagles (Office of Legislative Counsel)]: So still with sensitive data, four c, again, is not new language. The first part that so we're still talking about sensitive data. If the controller has actual knowledge or willfully disregards that the consumer is a child, Process has sensitive data in accordance with COPA, which is under 13 years of age. And then subdivision two, Romanette two, is new, but it's just another cross reference to the age appropriate design code. The draft 4.2 had subject to further restriction. The way I'd freight the ways I organize it didn't work that way anymore. So I figured that if it's applicable, if you're a covered business, if you are doing age assurance methods and you realize that you have a minor, then you also need to comply with the kids code. There's nothing new here. It's just a inform the control where they have to do this as well, if applicable. Subdivision five, there is no change to the discrimination language. No change to six about the mechanism to revoke consent. So seven is the same. And just to clarify, seven is about minor data if they're at least 13 under 18. So no longer COPA. But this is the same language. It's not sensitive data, it's personal data. Not process the personal data of the consumer for the purpose of targeted ads or sell their data. This is the same language, just wanna make sure that this is just minors' personal data.

[Edye Graning (Vice Chair)]: That's the same as Connecticut.

[Rick Stagles (Office of Legislative Counsel)]: Except for the subject to subdivision nine, that's a kid's code.

[Unidentified Committee Member]: Because that's one of our laws. Right. Right. So

[Rick Stagles (Office of Legislative Counsel)]: everything else, so nine is the same. This is the if you're a covered business and the consumer is a covered minor, again, just you have to comply with the age appropriate design code act. That was in the last draft, and I don't have any notes asking for a change to that language. So that's it for that section. Maybe we should stop there and see. Or you can keep going. Okay. Getting the shake and the nod. Subsection c, the privacy notice. Remember earlier I said in subdivision one of the minimization that you shall process it and disclose the processing pursuant to subsection c. So this is where we are now. Subsection c on page 34, line thirteen and fourteen. So a controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes, a is the same, the categories of personal data processed by the controller. B, starts out the same, the the purpose for processing personal data, and then adding in a dis and a description of the processing pursuant to a one.

[Unidentified Committee Member]: That's meant

[Rick Stagles (Office of Legislative Counsel)]: to that's new requirement, but I think b I don't think B reflects A1 without adding in that description of processing. I think that's what you want them to disclose. Right. That's what the

[Unidentified Committee Member]: consumer needs to know in order to be able to exercise. Right?

[Rick Stagles (Office of Legislative Counsel)]: Okay. Page 34, no change. There's not a whole lot else here. I just wanna run through it. 38, 39. So now we're in the processor's duties. The data protection impact assessments on page 42. No changes. I believe it's gonna be down here in the enforcement section, But I'm gonna scroll through all of it so we all see it at the same time. No changes. Okay. So 55, the AG enforcement. There's discussion of a cure period, which comes up here in a second. The cure period, because it is temporary, I put in session law. The Senate version had it in statute. I just think that it should be in session law because it goes away in a year and a half. 2415 ks on page 56. Can I go back to reporting? Yep.

[Unidentified Committee Member]: I think I circulated yesterday. He's adding I think it's one through five proposing to add an additional substitution to ask the AG whether they had sufficient resources to enforce the statute. It's an annual I wouldn't want them to do another report, but if they're doing a report anyway, I thought it might be helpful to keep the issue visible. Be on it all and end all, but it it it just seemed helpful. Folks think so. That's great. If not, we can do

[Unidentified Committee Member]: I'm just her advice before this in general. I'm curious if asking them whether or not they have the resources to enforce is a vulnerability versus asking them what resources are needed to enforce or something just so it's not like, woah, we can't enforce this. Free for all, go ahead. Versus like, what do you need to

[Edye Graning (Vice Chair)]: do the best job?

[Unidentified Committee Member]: Yeah, that's fine. Of course, is the sixth item Yeah.

[Unidentified Committee Member]: Any other matter the AG deems relevant purposes sufficient to Mhmm.

[Jamie Feeney (Witness)]: If it's a problem that would come up? What

[Unidentified Committee Member]: not not from my perspective because I wanna highlight this issue. I'm concerned that the agencies right now have not had social media services, and they feel like it's just not something they really wanna talk about, the matter. But from the legislature's perspective, I think it would be something that we might want to hear, at least

[Edye Graning (Vice Chair)]: I prefer to leave it as it is for them to comment on however they deem necessary.

[Unidentified Committee Member]: Okay. I

[Edye Graning (Vice Chair)]: 100% hear you, Anne.

[Rick Stagles (Office of Legislative Counsel)]: 2415, the Consumer Health Data Privacy. I think I mentioned this yesterday, but there was a question as to whether the intro language previously had some exceptions. Like except as provided in section 2415i, which is construction of duties, and subsection twenty four fifteen c b, which is a COPA exception. The subchapter is no or no no person shall. And then so the question was whether that made the exemption sections twenty four fifteen c not apply to this. And I disagree. And I think that if you're exempt, you're exempt. I said that. However, I think there is a strong request that this be cleaned up just to say a person shall not. So if you're exempt, you're exempt from the bill. If this does not change anything, you're not all of a sudden gonna be unexempt because twenty four fifteen k. It's the entire subchapter, which includes everything on this bill. I think that addresses a few concerns. It's in Connecticut, had that style, and that's why it was brought over in the center version. It was an h one twenty one. It's always had that intro, and I brought it over, but I can see how maybe some wouldn't want that in there.

[Unidentified Committee Member]: If I understood the concerns of folks, I think this language addresses it. I hope I think it addresses it because because the exemption section is still there, applies to every single section in this chat.

[Rick Stagles (Office of Legislative Counsel)]: That's why you have that section.

[Michael Marcotte (Chair)]: Right. Yep.

[Unidentified Committee Member]: I do think this strays from what Connecticut I thought Connecticut had different exemptions for this section. Far as talking to compliance people, they were giving a reminder that although Connecticut exempts nonprofits from the the majority of their bill, for instance, an example, they do not exempt them when it comes to consumer health data privacy. And so we this is very different intent than Connecticut. We are there This exists specifically to make sure that consumer health data privacy is yeah. But the exemption section in our bill has never

[Rick Stagles (Office of Legislative Counsel)]: in Connecticut, what it does is it says, in Connecticut, you're exempt from every section except this one. Right. Right. Ours has never done that. Yeah. 01/21 didn't do it. This one's never done it. And so I think nothing's changing here. As far as Vermont, the exceptions in this bill is the entire bill. So you could change it. Like, you're not exempting nonprofits, by

[Unidentified Committee Member]: the way.

[Unidentified Committee Member]: So No. I know. Just think it's an example. Like, people were

[Rick Stagles (Office of Legislative Counsel)]: If you want certain yeah. You would wanna edit your exemption section to have like what Connecticut has, which I don't think you need to do that here unless you want different applicability to this section specifically. In my mind, this changes nothing, just if that makes you comfortable. WoodRAFT 4.2.

[Unidentified Committee Member]: This is a clarifying question about three. And maybe just a quick reminder, when you define precise geolocation data as 1,750 feet, why is it eighteen fifty? Is it what's because it's

[Rick Stagles (Office of Legislative Counsel)]: a geofence. Geo but so these are the only

[Unidentified Committee Member]: two times we talk about feet in the billet. Right? Right. Right. Okay. And okay. So we we don't I'm just curious. Do you remember why that's

[Rick Stagles (Office of Legislative Counsel)]: Geolocation is not the same thing as geofence. Geofence. Right. It's like one is one is like a perimeter. Right? And the other one is tracking you or a device within a certain radius. Yes. I recognize

[Unidentified Committee Member]: that they're different things. I was just curious if we the point is to make sure that they're not conflated. Maybe

[Rick Stagles (Office of Legislative Counsel)]: Why are they why are they a 100 feet different? Is that the question? That's a great question. I have no idea.

[Jamie Feeney (Witness)]: No one knows.

[Unidentified Committee Member]: Okay. It's okay. I it's fine. Yeah. No one

[Michael Marcotte (Chair)]: knows why it's seventeen fifty.

[Unidentified Committee Member]: No. Yeah. Right. We just we just accept these things.

[Rick Stagles (Office of Legislative Counsel)]: But that's Industry standard. Industry standard. Sure. I think we'd be told if there's something wrong. Yeah. I think you'd be told by. Okay. A couple of new sections. This is there was a request to have some intent language added for the enforcement. You may remember H-one 121 as a pass had a PRA, private action. Draft 1.3 had a private action. I think it was the two point something was where it was dropped is my recollection. Okay. So this will go in session law. Through this act, general assembly makes the decision not to not provide consumers with a right to hold persons accountable in civil court for violations of the Vermont Data Privacy and Online Surveillance Act. Consequently, the office of the attorney general will bear the burden of enforcing the act and ensuring to the best of its abilities that the rights of Vermonters will be protected. In prohibiting a prior right of action, it is the intent of the general assembly that additional appropriations and resources will be brought provided in the following years to support the office of the attorney general's enforcement of this act, which may require the creation of a data privacy unit. If such appropriations or resources are not provided, the general assembly may consider adding a private right of action for consumers.

[Unidentified Committee Member]: Is that Connecticut or is that kids' code?

[Rick Stagles (Office of Legislative Counsel)]: Neither.

[Unidentified Committee Member]: Yeah. I'm It's me.

[Edye Graning (Vice Chair)]: Intently, it's session bonds. It's direction to future legislative changes.

[Michael Marcotte (Chair)]: There's no enforcement.

[Unidentified Committee Member]: I I would also say that it is a statement that reflects reality in that in that the AG. Now they have a budget of $708,100,000, I think it is. And if they're doing battle with, you know, multiples $100,000,000,000 companies, I think it's important to have this kind of statement of intent to reflect the reality of what we're asking, you know, that office to do. So I see it as it doesn't have any force and effect, but it is a statement of reality that I think is a force.

[Unidentified Committee Member]: I think what you just said here makes sense. And it it's unusual. It's not standard for us to not have the PRA. It's not and I think that we've talked about this issue a lot over the last two years, and I'm sure it was discussed more in the years prior. So I do think it makes some sense to make that known for for all of us because we may not be completely finished with any sort of legislation in this arena. So I I keep that.

[Edye Graning (Vice Chair)]: One of the things that I would really like to see in there, as we're talking about funding, is to ensure that there's technical support for businesses, also appropriated by future legislatures to ensure that businesses have the skills and resources that they need to comply with the bill. Maybe it's just

[Michael Marcotte (Chair)]: the resource. I think it's the technical education. Yeah. Education. Education

[Unidentified Committee Member]: and

[Rick Stagles (Office of Legislative Counsel)]: But wouldn't that be through the AG's office, or do you think Okay. It'd be

[Edye Graning (Vice Chair)]: The Vermont Law School would probably

[Unidentified Committee Member]: be a better and They

[Edye Graning (Vice Chair)]: would call them in Maybe

[Rick Stagles (Office of Legislative Counsel)]: not. Call them out, but just okay. Got it.

[Jamie Feeney (Witness)]: Good.

[Anthony "Tony" Micklus (Member)]: I would just say I don't have an issue with it with the exception of the last sentence. And it's not really an issue, but I think if there's a mentioning, this looks a lot like a threat. And I don't that belongs in. I think that's Rutland's problem.

[Unidentified Committee Member]: I thought miss Rutland's problem was

[Jamie Feeney (Witness)]: that it

[Unidentified Committee Member]: was new.

[Unidentified Committee Member]: Well, didn't I want to be

[Michael Marcotte (Chair)]: I don't see it as a threat. I see it as if if the administration and the general assembly can't find find it find their way to providing the resources necessary to any general's office, then the general assembly should be looking at something else. We've done by pulling the private right of action act

[Unidentified Committee Member]: as if not supporting that,

[Michael Marcotte (Chair)]: is that we've extinguished the rights of Vermonters to sue when they've been harmed. That's a fundamental right that we're taking away. So if we are, then we need to call that out, and we need to make sure that everybody understands that. In order to make sure Vermonters have say, we're giving that to the Attorney General, we need to make sure that by doing, removing the PRA, that they need resources in order to take care of the models. And then if we can't come to those terms, if we can't find those resources, then we should be thinking about reinstituting private right of action so that the monitors can have their ability to go to court again. I think that's all that this is saying. And then, of course, I like Edye's addition, was making sure that we're calling out. We're also, for the administration, for the general assembly, need to think about providing technical assistance to our business community because those smaller ones, whether they're nonprofits or for profits, that are not doing this right now, not involved in protecting and everything that comes with this, we're gonna need some education on how to do it.

[Anthony "Tony" Micklus (Member)]: I mean, I'm I've changed my vote, but

[Michael Marcotte (Chair)]: No, but I don't see it as a threat. I see it as the natural progression. If we can't, if we and the administration can't follow through with giving resources to the Attorney General's office, then we need to think about it another way, and the other way is to give Vermont back that right.

[Rick Stagles (Office of Legislative Counsel)]: Next, last new section, section three is also law. It is also enforcement related, but it's a cure period. So during 01/01/2028, which is when the law would take effect ending 06/30/2029. This is taken from the Senate, by the way, just moving the dates out a year, trying to think of the math, whatever the math is there. The attorney general shall, prior to initiating any action for a violation, issue a notice of violation to the alleged violator if the AG determines that a cure is possible. If the person fails to cure the violation within sixty days after receipt of notice, the AG may bring an action pursuant to their enforcement rights under this act. So that's a year and a half. We can change that, but that this came from the senate. I figured that would be a good starting point.

[Edye Graning (Vice Chair)]: We probably have five more minutes before they call us back. It's outstanding.

[Unidentified Committee Member]: I was wondering if you could go back up to the data min piece because because we swapped and didn't we did and didn't update definitions. I think there's a little bit of a loop going on. Rick, on so 3.3, we had separated out processing and collection. So 3.3 only allowed controllers to use the consent option to process data for new purposes. You can just ask for consents to collect whatever you wanted. 5.1 allows consent for collection or processing. Collection is under processing. We had previously removed it.

[Rick Stagles (Office of Legislative Counsel)]: So two depends on one. They've already collected it. So two can't happen unless they already have it. And if so, for some reason, that they don't have it, processing does include collect, right, as one of its definitions. So I thought about that last night, but I don't think I don't think that's a problem. Again, maybe give me some more time to think about it. But Okay. Yeah. Because I I just saw that. They didn't line up, but two depends on one. So how

[Unidentified Committee Member]: But I think since cross collection is in process, you'd also read two is not black. It's personal data. So is it Unless we take code unless we correct processing how we did before with taking our collections since we had collect separate. And it still doesn't include collect is still fixed, but process got reset.

[Rick Stagles (Office of Legislative Counsel)]: If you all want to add collect, I think it's included. So that's my here.

[Unidentified Committee Member]: But No. Saying remove it so that otherwise you're in this loop of allowing consent for collection

[Unidentified Committee Member]: None

[Michael Marcotte (Chair)]: over and

[Unidentified Committee Member]: on to, not process. So remove what? Update the definition of process. Was like, oh, remove. That's okay.

[Jamie Feeney (Witness)]: I don't

[Rick Stagles (Office of Legislative Counsel)]: know if you wanna do that either. That's that's a

[Unidentified Committee Member]: Otherwise, you're giving consent for collection. It

[Rick Stagles (Office of Legislative Counsel)]: doesn't match. Me think about that. Is

[Unidentified Committee Member]: the issue that you could, in two, collect data for a material new purpose? I'm sorry, I'm gonna hit you.

[Unidentified Committee Member]: You could. No, it's okay. I'm also struggling with this. So for the other one, it's like, if you replace the word, just say for the sake of a definitional thing of process, collect a person's a consumer's personal data for any material new purpose that is neither really necessary, blah, blah, blah, consent. So

[Unidentified Committee Member]: damn it.

[Rick Stagles (Office of Legislative Counsel)]: It includes collection.

[Unidentified Committee Member]: I know. That's what I'm

[Rick Stagles (Office of Legislative Counsel)]: So you're worried about it. That you're not worried about. It's other uses of process. No.

[Unidentified Committee Member]: I'm worried that, like, collection is in the definition of process still. It's not separated out the way that we had before. So you're giving consent for collection over and over for It allows consent. So you

[Unidentified Committee Member]: can collect if you don't process? Is that I don't know. I'm just trying

[Jamie Feeney (Witness)]: to I

[Rick Stagles (Office of Legislative Counsel)]: think you're okay. Maybe let's talk offline. Yeah. Okay. Okay. I mean, you're I I'm still trying to figure out how it's less protective. Okay. Because every every any restriction on processing here includes collecting. Right? Yeah. Was gonna say Collecting does not include processing. Right? So that's why it's important to sometimes call out collecting. But when you just use the word process, you are implying including collecting. So I think all the restrictions here, I don't see how that opens up a controller to collect something that they with the with the consent of the consumer. Right?

[Edye Graning (Vice Chair)]: Okay.

[Rick Stagles (Office of Legislative Counsel)]: But let me let me double check everything.

[Unidentified Committee Member]: Yeah.

[Unidentified Committee Member]: I'm trying to connect you to him.

[Unidentified Committee Member]: I'm just looking at you.

[Rick Stagles (Office of Legislative Counsel)]: Yeah. I'm looking at you.

[Edye Graning (Vice Chair)]: We had two things that we put in the parking lot. Yep. 20 Line 9, that's the Grammly Twiley. There you have it now, think it's the same as Connecticut points.

[Michael Marcotte (Chair)]: Outstanding with the committee's budget?

[Edye Graning (Vice Chair)]: I would just say, if we had more time, would be happy to do something else. Feels protective enough at the moment, considering We have just a few more days of session.

[Michael Marcotte (Chair)]: Yeah,

[Unidentified Committee Member]: guess we haven't heard So this is something we've gone That is a common thing we've gone back and forth, and we try to do is, is not his area, apparently, it's not his area. And so when we're opening it up to data subject two, this feels like it could incorporate all types of financial or Grammarly adjacent things, because the safeguard rule just has that it has to protect customer information. So if that's the charge, then couldn't anything be more or less customer information? And then if we're opening and we're not saying it's financial institutions, so it's financial institutions and anything they're doing, have a relationship with or whatever. And then so does that include things like Venmo and PayPal, just tracking what we're buying and who we're giving money to, or earned wage access apps tracking your behavior on those, or student loan providers tracking payments for wellness apps under insurance obligations with health providers fracking our stuff and selling those. So I guess I don't know and I haven't heard the whole universe of the data subject to that we are opening this up to. And I feel like this is a really potentially massive change that we're getting at 05:30 in the morning that we haven't had any testimony on.

[Edye Graning (Vice Chair)]: Do any states have it more restrictive than that?

[Unidentified Committee Member]: No. Had, like I said, gone through great lengths with Maria Royal to look at all the state and federal regulations to close the gaps. We had a whole chart I can forward to everybody. I think I've done it before, where she lined up all of our data privacy stuff and then the state and federal laws to make sure that we felt comfortable that those financial institutions were covered. But financial institutions isn't a part of this anymore, and neither is nonpublic information. So we have no idea what we're doing with this at the very last second.

[Unidentified Committee Member]: But other states have the same exemption.

[Unidentified Committee Member]: Other states do a lot of stuff. We've received zero testimony on this. What

[Unidentified Committee Member]: I'm also hearing is that other states do this, but it may not be offering the level of protection that it should be. I think one of my big questions is with unaffiliated partners, are they subject to the same level of protection? Does that pass through from the initial company?

[Jamie Feeney (Witness)]: Put it back in.

[Edye Graning (Vice Chair)]: Tony had his hand up. Sorry. I

[Anthony "Tony" Micklus (Member)]: could add a little perspective here, having an IT company where I deal with people's data on a regular basis, right to the level of sensitive. Anytime I have ever worked with a medical facility or financial facility, stockbrokers, nursing homes, I have always, always been required to sign a HIPAA compliance or GLPA compliance agreement before they will even talk to me or give me any data. So, bear in mind that now, obviously, I can't guarantee every company will do that, but I have in my twenty five career in IT, working with people, sensitive data, never had a situation where one of a financial or medical facility didn't give me something.

[Unidentified Committee Member]: Because you said you signed the form.

[Unidentified Committee Member]: As an affiliated.

[Anthony "Tony" Micklus (Member)]: As an affiliated contractor. Correct.

[Unidentified Committee Member]: This is for unaffiliated contractors.

[Anthony "Tony" Micklus (Member)]: Well, I'm not I mean, I guess what's the definition of affiliated? I mean, in my understanding, once I sign a contract with them, I'm affiliated with them. Is that am I wrong, man? I don't know. I'm trying to hear from

[Michael Marcotte (Chair)]: folks on that.

[Unidentified Committee Member]: Part of the difficulty is is that we're trying to deal with some new language, but I The Grammly Twiley stuff and the parameters of that is a little different than the DFI rule. Even though I don't know the exact parameters, it would give me maybe a belt and suspenders

[Jamie Feeney (Witness)]: comfort

[Unidentified Committee Member]: if some reference to DVR is regular would be in there also. But keep the data exemption as it is. But just make sure that it's subject to DFRs, right, too.

[Anthony "Tony" Micklus (Member)]: I would just add, just to throw the shell, whether I'm affiliated or unaffiliated, I just signed a contract with them obligating me not to share that information. So it really doesn't matter what my affiliation is.

[Unidentified Committee Member]: So the at the issues that what we were looking at in 4.2 was it was nonpublic personal information that is processed by a financial institution. And can I would you be able to just remind us of what the discussion was that caused the shift from it being nonpublic personal information that is processed to data subject?

[Rick Stagles (Office of Legislative Counsel)]: It's a request. I can't go into the details, but it was a request. Yeah.

[Unidentified Committee Member]: I I just can't believe where It was not

[Rick Stagles (Office of Legislative Counsel)]: on the record. Okay. Yep.

[Unidentified Committee Member]: Oh, okay. So this I was wondering. I don't recall it being something people were contesting in our committee. No. It was not.

[Jamie Feeney (Witness)]: Alright. Okay.

[Michael Marcotte (Chair)]: It came from the insurance industry.

[Unidentified Committee Member]: Jamie, you should go to it earlier. Yeah.

[Jamie Feeney (Witness)]: Was speaking this morning. Yeah.

[Unidentified Committee Member]: So that's that's it. Yeah.

[Unidentified Committee Member]: I guess so often when we're trying to use the the state and the federal regulations as basis for exemptions here, that means that those laws are offering similar, if not exact, kind of like access to consumer rights that are very similar. And in this, like, I don't think, I can't remember the full list of actions that you get out of GreenLeafBlood, but I'm pretty sure it's just opt out. I don't think it gives you the ability to ask to see what is being collected or to delete it or correct it or anything like that.

[Rick Stagles (Office of Legislative Counsel)]: Yeah. So the purpose of exempting certain things typically is because there's already some oversight or some, in this case, federal law that governs privacy. So GLBA is a privacy law, at least Title V of it, in regards to nonpublic personal that's why that phrase was used, in regards to nonpublic personal information. So financial number, Social Security number, financial institutions have a duty under federal law to protect that information by having affiliates sign contracts, even more share, whatever. Right? States can give more privacy. Right? And I don't if I've said this before. You are allowed to not exempt GLBA. Most states do, but that it's a thing you can do. It's it's the floor. The federal law is the floor. I'm sorry. The ceiling. Missing my is that a preposition? I don't know

[Jamie Feeney (Witness)]: what what I'm talking about.

[Rick Stagles (Office of Legislative Counsel)]: The state can always get more privacy. So the the reason that exemption was made, my understanding, is that is what the federal law protects consumers from. Is that specific type of information is already governed by federal law. So when you say data, that opens it up to anything. Right? That's any information. Subject to Grambling's blithely, which that's where I don't know. I don't know what type of information we're talking about.

[Jamie Feeney (Witness)]: Thank you, Mr. Chairman. Jamie Feeney again. Maybe I can take a step back. Apparently, it's really about based on financial activities. The applicability is not the primary business purpose of company, but it's the level of engagement that you are in financial activities. So

[Michael Marcotte (Chair)]: there's sort

[Jamie Feeney (Witness)]: of like a bottom line there. Yes, lease filing, is as you alluded to, it's a privacy bill and that information includes non public personal information related to financial activities. GLBA entrusts companies with that information but at a cost. The cost is the privacy securities that come with there's the notice that goes out that describes the privacy policies, there's the ability at least at the federal level to opt out. Other states like Vermont has gone further and said to opt in at least for the Vermont regulated entities. There is federal law that restricts the purpose to be that that is required of the financial institutions. So you can't use it for other purposes. Representative Prussen mentioned the safeguards in place as well. So the protections follow the data, regardless of who my work is, along the way. Part of what I believe the exemptions are intended for in this bill is to not necessarily duplicate privacy policies that are in place, but also to not create conflicts. If the data is not exempt, there are those entities that work with financial institutions that have service policies, etc. They would be subject to the overall provisions of the bill, including potentially not notices which might be in conflict with the notice that the DFR regulatory agency provides, including the potential for deletions costs, is a very significant tool, etcetera, etcetera. We've sort of gone through those potential impacts. What is in front of you, yes, is Connecticut. Connecticut in 2025 separated its GLDA exemption. Prior it was an entity level exemption. And now are doing what you're contemplating here, an ill level exemption, which is the one day entity level for those banks and insurance companies that are licensed regulated by the state. All 24, 25 or so states have some combination of entity data level, etcetera. What's in front of you is the most narrow geography data.

[Unidentified Committee Member]: Jamie, so I'm just wondering, so as examples, you think so if I we heard since we haven't had testimony, I'm trying to draw on testimony we did have. There was the example from the car presentation of all the different sensitive information, the emotions, whether or not you're looking, the biometric stuff, the audio, basically the 100 tractors that are in the car. And so would a car I don't know how this relationship again, we haven't got this the relationships, would a car insurance or, like, is there, is there a way that this, the car data goes to an application on your phone that is tracking your emotional states and that kind stuff, and is there potential that that information is now exempt under this exemption?

[Jamie Feeney (Witness)]: I would say no, and again I would zero back into the nature of GLBA, financial activities, servicing banks, insurance companies, etc. If there is data that falls out of the scope of GLBA defined data and is subject to this bill.

[Unidentified Committee Member]: But so as far as I don't know that it I guess the financial relationship piece, like the entities fall under ground lease liability for certain things. But as far as the data goes, we're not saying it's the non public anymore. So it's all data. So wouldn't if a I guess that seems to me like it would include marketing arms of banks or insurance companies or apps that are on your phone from those banks or insurance companies or FinTech apps or apps that you are like Venmo and PayPal like I said or and those apps are and the insurance apps, wellness apps that you might be using in relation to your health insurance. This just feels like, I have a real question if we're actually talking about just financial data under data subject to here.

[Jamie Feeney (Witness)]: It's still subject to GLBA. I'm sorry. Know how

[Unidentified Committee Member]: Yeah, but GLBA, we heard that car dealers and all that kind of stuff, insurance companies, they all fall under theirs. But by removing the non public health or non public information, it feels like we are saying every all data that falls under there.

[Jamie Feeney (Witness)]: Again, it's data that's defined under GLBN, which is So why didn't the original one work? Because it only was applicable to financial institutions under GLBN. There are other entities that

[Unidentified Committee Member]: We also had the non public information.

[Jamie Feeney (Witness)]: It was tied to a financial institution.

[Unidentified Committee Member]: Right, so if we did non public information subject to Grand Leishwali?

[Jamie Feeney (Witness)]: Think you stillwell, there's a possibility. Yeah, I mean, I think if it isn't necessarily limited to any particular entity handling the data. Yeah, I'd like to work with what's still data on. But again, we're striving for uniformity, we're striving for clients as well as customer, and appreciation tools, so on, fashion fusion. But yeah happy to quickly take a look.

[Rick Stagles (Office of Legislative Counsel)]: And I would also want to add Title five that's in Connecticut's.

[Jamie Feeney (Witness)]: So whatever

[Rick Stagles (Office of Legislative Counsel)]: XXX title five of the Grammys Violet, just to make sure. There's, I think, several titles in Grammys Violet. The relevant title is title five, the privacy title.

[Unidentified Committee Member]: Just throwing So that would close the loophole of, like, safeguards, somebody claiming the safeguards

[Rick Stagles (Office of Legislative Counsel)]: I don't know. I'm not saying that's it's always title five. I just left it out. Okay. Not intentionally.

[Michael Marcotte (Chair)]: K. And it

[Rick Stagles (Office of Legislative Counsel)]: gets us title five. Oh, yeah.

[Michael Marcotte (Chair)]: But we need to include that.

[Rick Stagles (Office of Legislative Counsel)]: Yes. No matter what however you started off, my recommendation would be, subject to title five of the Grand Beach Boutin. So what should I draft for 5.2?

[Jamie Feeney (Witness)]: Reference would be as is, but if I can take a look.

[Edye Graning (Vice Chair)]: Is Title V included in that publication that you have listed?

[Rick Stagles (Office of Legislative Counsel)]: I'll double check, but I think

[Unidentified Committee Member]: you should still put it in there.

[Jamie Feeney (Witness)]: I meant revising data. Final five is exactly what we're talking about.

[Michael Marcotte (Chair)]: Yeah. Think what we can do is take look at that, and it may not be okay if we move this, we need to make the change that we would have on

[Unidentified Committee Member]: the floor.

[Rick Stagles (Office of Legislative Counsel)]: So I'm sorry.

[Edye Graning (Vice Chair)]: Since we only had the one other thing in the parking lot, and that was page 11 line nine, and that was removing the information that is made available for sale.

[Rick Stagles (Office of Legislative Counsel)]: Yeah. Yeah. Okay.

[Unidentified Committee Member]: We do the collection on biometric already. Did we already?

[Edye Graning (Vice Chair)]: I think so.

[Unidentified Committee Member]: That was your suggestion. I just didn't know if we confirmed that it was.

[Rick Stagles (Office of Legislative Counsel)]: Collects. Yeah. I think about that. Okay. I I yeah. I mean, it's up to the committee. You wanna change it, then I changed it. Removing the word collect from the definition of No.

[Unidentified Committee Member]: A biometric. Edye had the thing collected on or Oh, that's that's different identity.

[Rick Stagles (Office of Legislative Counsel)]: That's a change. I Okay. Okay. Yes. That was a question. This was the one that was not decided.

[Unidentified Committee Member]: Well, I think I was someone who was turned around on this construction here. And I you know, I've read it a number of times. I think it's satisfied with my intent in terms of how it's constructed. I would basically prefer to not include information offered for sale in the exclusion of publicly available information. But if I'm okay with I had a problem with the technical way it was being expressed, and I don't have that problem anymore.

[Edye Graning (Vice Chair)]: You can live with this.

[Unidentified Committee Member]: Yes. Great. We

[Edye Graning (Vice Chair)]: just got bills and I distracted.

[Rick Stagles (Office of Legislative Counsel)]: He didn't know why.

[Edye Graning (Vice Chair)]: Can everyone else live with this? Yes.

[Rick Stagles (Office of Legislative Counsel)]: Still updating the intent language to add the technical resources. Biometric data definition will be fixed. Adding title five to Grammarly's Bliley Leash. Having the authorized agent apply to all subsections of the consumer rights.

[Michael Marcotte (Chair)]: Hey, Ruth. Tuesday morning. We'll call back.

[Unidentified Committee Member]: Just kidding.

[Rick Stagles (Office of Legislative Counsel)]: Edye got it right away.

[Michael Marcotte (Chair)]: Yes. We're back to the floor. I don't know how long we're gonna be on the floor. Think there's several stairs that we're looking at. So it could be a bit. So when we get done, we'll come back. K? Go out live.