Vermont Legislature SmartTranscripts:

[Unidentified Committee Member]: Good

[Michael Marcotte (Chair)]: afternoon, everyone. This is the Lamoille Committee on Commerce and Economic Development. It is Friday, 05/29/2026 at 02:20 in the afternoon. We're here to look at Senate proposed Board Amendment on H two eleven. We have our legislative council with us, Rick Segal. Rick, good afternoon. Thanks for joining us.

[Unidentified Committee Member]: Good afternoon.

[Rick Segal (Office of Legislative Counsel)]: Rick Segal with the office of legislative council. So H2-eleven flew across the Senate yesterday to quite the ride. I was there the whole time.

[Michael Marcotte (Chair)]: Well, you hung on to

[Rick Segal (Office of Legislative Counsel)]: here today. It flew around. So the Senate Economic Development Committee had a few amendments. They didn't do a strike all different strike all. So when I show it to you, I'm going to have to refer to the instance and then the underlying bill that you all passed back in March 2026. Senate financed and unamended. Senate appropriations had a couple of minor amendments that we'll talk about as well. And then it passed the Senate at, I think, six or so last night. So let me share my screen. There are some fairly substantive amendments, some that are not as substantive. I will clarify as best I can the extent of each one. Okay, so this is the Senate proposal of amendment. It is eight pages. There are 12 instances of amendment. The first one is substantive. The first one is a change of the definition. Maybe you all heard of this definition. It is publicly available information, that definition. So, just to put some framework around this, this is the data broker chapter, but also chapter 62, which has several types of regulations. It has the Security Breach Notice Act, that if you pass this, the Data Broker Security Breach Act. So currently that chapter, kids code as well. However, currently this chapter does not have a definition of publicly available information. You all passed a definition that matched Kitka. That was the house proposal. The senate kept what it what it is. I will go back and show you something I want.

[Michael Marcotte (Chair)]: This.

[Rick Segal (Office of Legislative Counsel)]: So this is the as passed by the house version. Okay, so definition 16A, chapter 62, publicly available information means information that is made available through federal, state or local government records or to the general public from widely distributed media or a data broker has a reasonable basis to believe that the consumer has lawfully made available to the general public. So that part has not been amended. That part stayed the same in the House proposal. The Sorry, the Senate proposal. The senate proposal strikes out b, which you have basically matching the kids code definition of PAI. It does not match 71, which passed earlier in the senate because you made that one, the information for sale. If it's only if it's if the consumer wants access to it, if they want a copy of it, not to delete it. Right? Remember that? Okay. So what the senate did is take, and this was one of the options you had for 71, was to take those four kind of non as controversial elements of what PAI is not. That is what has made it into the Senate proposal. So publicly available information does not include biometric data, any obscene visual depiction, genetic data, or intimate images. So kind of granted, what we're looking at here, this does not affect Kids Code. Kids Code has their own definition of this. What this affects is the rest of '62, which is mostly just data brokers. That's what this is affecting. So you may wanna know how does this affect the data broker regulations? Remember, data brokers under current law just had to register with the state and pay a $100 fee. This bill increases the fee to $900 add some penalties if they don't register or if they file incorrect information. The house version had a deletion authority which was removed. I'll get to that here in a second by the senate. So really what this definition is doing is changing what brokered personal information is. Brokered personal information is very similar to personal data. You can think of it as pretty similar. There are some I've heard discussions that this changes what a data broker is. That is not correct. Okay. The the senate version has not changed the definition of data broker. It has not changed the definition of brokered personal information. What it does affect, and let me know if I'm losing you all here, is the definition of brokered personal information, which was not affected by the Senate version. Says, and go up to it. So this is what it is not. It is not publicly available information. That's kind of the crux of this. And that's the same thing with personal data. Remember personal data does not include publicly available information in '71. So it's the same thing that occasionally, if a data broker has brokered personal information that is publicly available, well, that's not broker personal information. Right? But because there's no deletion authority in this bill, it's not as critical to the data broker as it would have been if that was in the bill, if that makes sense. I see some confused faces. I'm trying my best to explain the effect the of this definition. It matters a lot more if you have a deletion authority, which you do not have. The senate removed that. They removed the what? The deletion authority. So the cons I'll get to that in a second. But the consumer under the house version had the right to ask for their data purpose data to be deleted. That was struck by the senate. So at this point, the bill is now changing the definitions of many things, including data brokers, including broker personal information. And that was not changed by the senate. Just the definition of per publicly available information was amended. Let me continue. The second and third instance were grammatical, technical, I don't want to spend time, they're just, they were the words were not in the right order. So correcting that no substance changes to the second or the third. Again, I think the letter v was missing in one of these, so it's easier just to replace the entire subdivision. Okay. The fourth instance of amendment is reflecting the fact that the senate removed the deletion authority. So there was a portion of the bill that referred to that deletion authority because subsection c is being struck. Instead, it is if the data broker permits deletion. So what this language is referring to, when the data broker registers with the state, they have to supply a bunch of information, right, that the house added. The senate didn't change that. They still have to provide I'll show you. They still have to give you quite a bit of information. Okay. So we're in, this is sub chapter five. This is the data broker sub chapter. This is the house version. So they still have to do the fee, the bond. And then when they submit all this information, right? Whether they collect precise geolocation, reproductive healthcare data, all of these kinds of sensitive data pieces. They have to let you know that they collect that. So one of those was subdivision I, a URL on the page of the data broker's website that allows consumer to delete their data. Well, that was removed. Right? So instead, the language is if the data broker permits deletion. Some of some of them do. You can go into a data broker website today. Some of them will let you delete your data. Even without the authority in Vermont. Some just do that because they're required in California or some other state.

[Michael Marcotte (Chair)]: That's the fourth instance. Yes. Where are you I'm trying to find it in the original house.

[Rick Segal (Office of Legislative Counsel)]: So it is on page 32, lines ten and eleven of the as passed by the house. You're looking at the calendar?

[Michael Marcotte (Chair)]: No. I Okay. Kinda take I went back to the March. So I Okay.

[Rick Segal (Office of Legislative Counsel)]: Oh, I got it. Got it. So pursuing so this here has been replaced by if the data broker permits deletion. Okay. The fifth instance is deleting that subsection c, which is the deletion authority, which was a large portion of the bill. It started on page where are the penalties, which have not been changed. So at the bottom of page 34, this is the deleting brokered personal information. You may remember that the data broker had to maintain a webpage on their website where you could request that it be deleted. The webpage should be accessible. All these things were in subsection c. There was also some exemptions, which no longer matter because the authority has been removed from the bill. All the way down to page 39, where you have the consumer rights web page that the Secretary of State has to provide. So this was also amended because that webpage had mentioned that you must provide a URL to all the deletion webpages. So because they're no longer required to provide a deletion opt out deletion. Right? That was just reframed as if the spreadsheet is still there. So the secretary of state still must provide that spreadsheet of data broker information that they collect from those data brokers and then any additional information that they wanna give to consumers about their data broker rights. Okay. The seventh instance was an addition of the term consumer in the data broker subchapter. So this was a kind of a later request from the senate committee to align the consumer definition with the s 71 consumer definition. And it affects just that sub chapter, does not affect the definition of what a data broker is. It just would affect in their registration information, what they deem to be a consumer. So it's not a really impactful change. Now, if you ever were to put the deletion mechanism back in the sub chapter, that could make a difference. But for now, that this definition consumer aligns with the s 71 definition consumer. The current definition of consumer in this chapter is an individual residing in the state. That's the current definition of consumer that would have applied otherwise. I'll keep going on. The eighth instance is new material that you all didn't take up. There was a request to add in new members to the Cybersecurity Advisory Council. This was a request from members of the IT committees that the bill they had a bill on the wall that would have done something like this, but couldn't get the bill to move. So it made it to this bill. And, the Cybersecurity Advisory Council was created, I think, five or six years ago to obviously advise the state on various cybersecurity topics. And the bill would add two legislators. Currently, there are no legislators on the council. So it would add those two chairs of those two IT committees, the chair of house energy and digital infrastructure and the chair of senate institutions. And then also a member from the judiciary would be added to the council.

[Michael Marcotte (Chair)]: Any questions about that?

[Unidentified Committee Member]: When we have commissions like this, is it normal, is it usual to list the member of the body in that way, or is it done in other places, or is it normally, you know, committee on committees and the speaker

[Rick Segal (Office of Legislative Counsel)]: That's usually what's done.

[Unidentified Committee Member]: But this is done in other places?

[Rick Segal (Office of Legislative Counsel)]: This was the request, and there's nothing legally wrong about this. It's just not typically the way it's done.

[Unidentified Committee Member]: Yep. Thank you.

[Michael Marcotte (Chair)]: We have a joint fiscal committee.

[Unidentified Committee Member]: That has specific people that are assigned to

[Rick Segal (Office of Legislative Counsel)]: Ex officio is typically yeah. Because they have they're the chair of appropriations or they're chair of ways and means. But

[Michael Marcotte (Chair)]: the

[Rick Segal (Office of Legislative Counsel)]: ninth section is also the cybersecurity council. It is set to sunset in June 2028. There was a request that it be pushed back to 2033. So that sunset would be extended by five years. The tenth instance is language that you might be familiar with. It's from h six fifty. That's the EdTech bill that you all passed out of here. So that bill kinda got stuck on the senate side. So the senate economic development committee put it into this bill, but just the registration piece. That bill, as it came out of this committee, had the registration piece. It also had a study from AOE that would review the certification process of EdTech products. So this that was stripped out of this language, and it mostly reflects what was in your registration language. There's a couple of changes I'll point out here. So, the definition of EdTech product mostly stayed the same except student facing software was used. So, it would apply to any software. So, it could also be teacher, administrator. If it's used for teaching and learning, that part stated in the definition.

[Unidentified Committee Member]: Please say again, this applies to student amendment applies to student pacing software.

[Rick Segal (Office of Legislative Counsel)]: Other way, right?

[Unidentified Committee Member]: Other way.

[Rick Segal (Office of Legislative Counsel)]: Yeah,

[Unidentified Committee Member]: okay. Applies to all of the software.

[Michael Marcotte (Chair)]: Yes. Yep.

[Rick Segal (Office of Legislative Counsel)]: But it was also narrowed. So subdivision B is new. Educational technology product and product does not include hardware or other physical devices or a product that is being used in a school without the knowledge of the provider. So that would allow a provider if they just don't know that their product is being a website is being used in a random school in Vermont, and they would say, well, we didn't know that. So there is a fear that companies would be called to register and they wouldn't know if they have to register.

[Unidentified Committee Member]: Okay. I'm just a Chromebook is technically hardware, but the software would be registered, correct?

[Rick Segal (Office of Legislative Counsel)]: So the iOS, the

[Unidentified Committee Member]: iOS would have to be from the phone book. Right.

[Rick Segal (Office of Legislative Counsel)]: Right. The company that makes it. So Google, in that case, right, or Alphabet?

[Unidentified Committee Member]: Yeah. So any type of device would basically have to be bricked in order for it not to be registered. Correct?

[Rick Segal (Office of Legislative Counsel)]: I don't if I put it that way.

[Unidentified Committee Member]: I mean, the way I I read this is the physical device. I mean, I'm sitting in front of a Windows 11 PC, but the fact of the matter is I can wipe the drive and put Linux on it or or not. The Linux would have to be. The Linux, that would make Yeah.

[Unidentified Committee Member]: It would be

[Rick Segal (Office of Legislative Counsel)]: If it's being used for teaching and learning purposes. Right? I'm not sure if an OS would be used for teaching and learning.

[Unidentified Committee Member]: I remember learning a DOS.

[Michael Marcotte (Chair)]: So why? Or

[Unidentified Committee Member]: it's a subpart b where it does not include enrollment to a product that was being used in school without the knowledge of the provider. If the provider is then made aware of it, does this still govern or does everything else kick in and they then have to register?

[Rick Segal (Office of Legislative Counsel)]: So if they're told that your product is being used, that would be knowledge. And they would be, if they meet the definition otherwise, would need to

[Michael Marcotte (Chair)]: register with the state. So it's

[Unidentified Committee Member]: not a carte blanche, get out of jail. No, no.

[Rick Segal (Office of Legislative Counsel)]: Okay, the definition of filing stayed the same. So, is the same as the franchisor bill that you passed out a few months ago that if this business is doing business in Vermont, they should already be registered as a foreign entity And they would register once a year, file a report. So if filing gets any filing with the secretary of state. The provider definition did not change. It is a person, which includes businesses, that provides a net tech product that is in use at the school. School means a public or independent school approved in Vermont law.

[Unidentified Committee Member]: If I'm a rogue school and I purchase a bunch of ed tech without notifying, am I misunderstanding that issue something that would not be covered?

[Rick Segal (Office of Legislative Counsel)]: If you're a rogue school person at Tech without knowledge

[Unidentified Committee Member]: Without knowledge of the provider, it means a person that provides an education oh, never mind.

[Rick Segal (Office of Legislative Counsel)]: Okay, and if they didn't have knowledge that was being used that would go along with that, that they weren't aware that school was It's meant to apply to websites where you don't actually sell the product to a school without knowing. So the rest of the bill and the EdTech language stayed most of the same is that when they do that filing, they must supply the name of their provider, a link to their privacy policy, the name of each school in which they have a paid contract, the name and a brief description of each product at the provider or a URL that provides the same information that's a little bit different. The or was added by the Senate. I think some companies like Alphabet that have multiple products just wanted to submit one link instead of describing each product that they offer. Five, these were both in the house pass version, which products may be used in any school and attestation that it meets your privacy laws and federal privacy laws. The eleventh instance is just updating the effective dates because you are adding several different sections. So sections one and four, that is the data broker sub chapter. Secretary of State wanted more time to update their system to allow for the fields that will be required. And four is the EdTech language also. They wanted more time to update their systems to allow for those fields to be added. That'll be January 1. Everything else is July 1 of this year. Finally, the Senate Appropriations Committee stripped out the money that was in the study. So because the budget was already done. If you go down to the as passed version, you may remember you have the study that the Secretary of State is going to look at creating a deletion mechanism that California has already done. And part of this study included a $50,000 subsection C appropriation to hire consultants. So the study stays in, the appropriation was stripped out. And they would have until still 2028, 12/01/2028 to do the study. And those were in the 12 changes the Senate has proposed.

[Michael Marcotte (Chair)]: Trying to get my head wrapped around the differences. You

[Rick Segal (Office of Legislative Counsel)]: know,

[Michael Marcotte (Chair)]: the data broker bill and the data privacy bill that last year, but China has been we delete, the Senate deleted the deletion provisions in the data broker available. Trying to understand how that impacts, what practical effect that has in terms of,

[Rick Segal (Office of Legislative Counsel)]: I mean, know

[Michael Marcotte (Chair)]: that controllers and processors are different than data brokers, but they might have some overlap,

[Rick Segal (Office of Legislative Counsel)]: I think. Every data broker is gonna be a controller. I'm seeing a shaking head. Yeah, I know. I don't know which controller would data broker not be a controller.

[Michael Marcotte (Chair)]: I'll just just

[Rick Segal (Office of Legislative Counsel)]: A data broker is deciding how how how data is being processed. Yeah. And the the terms of data. So I would consider, I would say 99% of data brokers controllers. Maybe there's one that's not.

[Michael Marcotte (Chair)]: Yeah. Just for my the purpose of my question, you know, I think there's some of the lab at least. Yes. Yes. And I'm trying to understand, the senate took out the consumer right to delete, but then over on s 71, the consumer has some rights over their personal data, especially the sensitive data in terms of the demand stuff. And so I'm trying to understand what the, I guess, practical effect of the change in the data broker is with taking out that deletion. Right?

[Rick Segal (Office of Legislative Counsel)]: I think the exemptions is a big part of it. So a data broker could be exempt under s 71. Right? If they need one of those exemptions that's

[Unidentified Committee Member]: in that Yeah.

[Rick Segal (Office of Legislative Counsel)]: Part of the bill. Sure. Yep. In in 02/11, there were some exemptions, but they were very limited. There was a GLBA exemption. I think you all put that

[Unidentified Committee Member]: in Those are removed. Right? Because the delete they were on the deletion

[Rick Segal (Office of Legislative Counsel)]: Right. Okay. Yeah. But in the as it passed the house, when you passed the deletion, like, deletion authority, there were a handful of fair credit reporting act. There were

[Unidentified Committee Member]: some have any? There were

[Rick Segal (Office of Legislative Counsel)]: some exemptions to deletion in that. Oh, yeah. I guess for yeah.

[Unidentified Committee Member]: Yeah. They were a couple. Yeah.

[Rick Segal (Office of Legislative Counsel)]: I mean, I was fixing this bill for hours.

[Unidentified Committee Member]: Yeah. Yeah. Yeah. But not that not what they did in the senate, though, before they deleted. Right.

[Rick Segal (Office of Legislative Counsel)]: Right. That's right. No. But I know the bill pretty well. So happy to answer questions about it at this point. Daddy, I'm my brain is full of debt. Thank you. I'll forget it by next week, but right now

[Michael Marcotte (Chair)]: Well, what I'm try I guess I'm getting at is to some extent, does s 71 contain similar protections for consumers that are no longer in h two eleven.

[Rick Segal (Office of Legislative Counsel)]: Does 71 contain protections that were moved to two eleven? Is that of the question? Yeah. So, yeah, the right to delete is in 71. Again, a data broker may be exempt under 71. That would not have been exempt under two eleven. But the right to opt out, those were not in 02/11. Right? So 02/11 well, as it came to the Senate, was not an authority to opt out for consumers when it comes to data brokers. In 'seventy one, is. So, it really depends upon if a data broker is controller, which I'm going to say they mostly are. And if that's the case, if they're not exempt, then consumers do have those personal data rights that you all went through. The right to access the data, right to delete their data, the right to opt out of the sale of your data. So there are several things

[Michael Marcotte (Chair)]: And the need to express consent for accessing and collecting checks of data. Right. Right. Okay. Thank you.

[Unidentified Committee Member]: Questions?

[Unidentified Committee Member]: I know you've said it. No, I'm not seeing it on here. Just to confirm, the definition of data broker is the same as it left this chamber. Do

[Rick Segal (Office of Legislative Counsel)]: you want to see it? Just to Okay.

[Unidentified Committee Member]: I've been doing my own little

[Rick Segal (Office of Legislative Counsel)]: It's just not a strike all, which makes it difficult. But it was such a long bill, the strike all was going to be, I think, more confusing.

[Unidentified Committee Member]: It's a long bill, and it's a long amendment. Oh,

[Unidentified Committee Member]: yeah.

[Michael Marcotte (Chair)]: Questions for Rick? What is your pleasure? I think so

[Unidentified Committee Member]: the EdTech, obviously, I supported that coming out of here. And I think that it's pretty important to get that piece at least over the finish line. It's certainly not as robust as I think we wanted it, but of course what we had when we left here wasn't as robust as what we wanted. So, I mean, I think that's such an important part that I would move this forward.

[Unidentified Committee Member]: Are you making a motion to this?

[Unidentified Committee Member]: I'll make a motion. Well, do we wanna talk or? I make a motion to approve. We approve. We would report favorably on Senate proposal of amendment. To h two eleven. To h two eleven. Because that came directly from me. I second

[Unidentified Committee Member]: that motion.

[Michael Marcotte (Chair)]: Any further discussion? Not, all in favor, Reginean. Opposed? Carried. So

[Unidentified Committee Member]: I'm

[Unidentified Committee Member]: gonna say I think I think EdTech is an important thing that needs to be brought up in next session. And anyone that's left here after the elections, please bring it up.

[Michael Marcotte (Chair)]: Yeah. You need to do a lot of tweaking. I'd say 71 and this one. Our children need it. Yeah. Anything