Vermont Legislature SmartTranscripts:

[Senator Alison Clarkson (Chair)]: Conversation. We are live. Great. Welcome, everybody, to the senate economic development housing and general affairs. Today, we are Wednesday, so we're looking at economic development and consumer protection. And we are beginning with our date of broker bill. The house has given us h two eleven. And to kick us off, and we have some perfect witnesses on this with representing a range of views. And to we're gonna kick it off with the attorney general's office, and we welcome Todd Phyllodes to the witness. Dan. Least comfortable chair in the room.

[Todd Davis, Assistant Attorney General]: We need better chair for. Feels more uncomfortable today, but I guess Counseling. Internally.

[Senator Alison Clarkson (Chair)]: We have failed to do questions or anything come up to Oh. Oh, jeez.

[Todd Davis, Assistant Attorney General]: So good morning for the record. Todd Davis, assistant attorney general. Thanks for having me here. Thanks for taking out Reach two eleven. Mhmm. I wanna take a step back and give a little context to this bill. Know you've walked through it. Vermont was a nationwide leader a handful of years ago, maybe a decade ago, in passing a data breach notification act, really leading the way and ensuring that there was public understanding when private information of individuals was unintentionally, maliciously disclosed, and requiring holders of that data to inform the attorney general's office and make consumer disclosure. It's a core part of the consumer protection work of the state of Vermont, I would say, sits with our office, but I want to state that Vermont really led the way in a lot of ways around that data breach notification. Of the key elements of H2-eleven is expanding that data breach notification to include data brokers, which we understand now if you imagine, well, committee knows well what a broker instead, and if we imagine the world of data privacy, we've talked quite a bit about it already this session, You certainly talked about it last session as well. The brokers are really the hub of transfer of personal data. They aggregate, they analyze, and they sell product around consumer data. They have essentially commodified consumer data. That's not all bad, and that's not maybe the thing you would expect the attorney general's office to say. It's not all bad. We all understand that data brokering has gone on long before the Internet existed, that companies existed to help business processes run faster. There are certain areas, core areas, fair credit reporting would be one among them, where that aggregation of data helps ensure that credit reports are accurate and then consumers can rely on that credit report. Lenders can rely on that credit report. It's a real opportunity for an exchange of information that ensures the flow of the marketplace and access to credit. That's awesome. We also think this has blossomed beyond what I think anyone or any consumer would really imagine or understand. We are growing to understand it. It continues to evolve, but I think anytime that ad pops up on your email account, on your pick your immediate source of choice. All of that is being run-in the background through data brokers. But there's a lot more to it, and I think I'll have other witnesses who'll talk about some of the real dangerous practices that come out of data brokers.

[Senator Alison Clarkson (Chair)]: And There's a chair behind me. And

[Todd Davis, Assistant Attorney General]: we certainly would suggest that that you hear a lot of the data around both the damages that can be done, the harms that can be caused. Where we sit on this, where the attorney general's office sits, is obviously in our one of our core rules of consumer protection. We believe very strongly that we need to empower consumers. We need to give consumers informed, options to understand what's going on. And I think one of the other core elements is still beyond the data breach notification element is the ability for consumers to have data brokers delete information. And that becomes very important because unlike to call back to H-six 39, which is sitting with you all, right, that bill, the Genetic Data Privacy Act, that's a one to one relationship. I, as a consumer, am gonna engage with the products, and a lot of what that bill says is that product just has to give me information, tell me what they're gonna do, allow me to consent expressly to various services or uses of my data. Data brokers are a third party in that relationship. They're aggregating data to other places. There isn't a direct consumer relationship. The consumer is not choosing necessarily to engage with the data broker. They're usually engaging in a second party relationship, and the data broker is a third party who's either providing additional information to that second party or harvesting information, purchasing information, receiving information from that second party, and the consumer has not necessarily any knowledge of that interaction, any knowledge of what's being held there. So what this bill does to address that inequality, that imbalance, and that lack of transparency, I

[Senator Randy Brock (Vice Chair)]: would say,

[Todd Davis, Assistant Attorney General]: is one, require that notification if there are breaches of data by data brokers. Two, require registration, advanced and expanded registration around that. So consumers can see who are the data brokers out there. We really anticipate with some of the changes in this bill understanding a lot more. We know we do not have all the data brokers that hold Vermonters' data registered in Vermont today, and I think partnering with the secretary of state's office, do anticipate pushing harder to ensure that more Vermonters have more access to who's holding their data and, importantly, as I said, the opportunity and the appropriate circumstances to delete that data. So I don't think you need me to walk through the bill. I think the bill came out of the house with a lot of good elements to it. We support where h two eleven is right now. I'm sure there are areas that you'll be interested in that you're gonna wanna dig into and and ask other witnesses, and we are happy to remain in that conversation, provide our perspective on it, any recommendations we may have, and I'm happy to answer questions, I'm happy to come back, but that's Thank certainly

[Senator Alison Clarkson (Chair)]: you, Randy. There are

[Senator Randy Brock (Vice Chair)]: a lot of obvious disclosure requirements to the public about what data brokers do relative to their data and our alarm, other privacy issues. These disclosures are often extremely detailed and extremely long. Do they effectively protect the public, should we do, we or others do something else other than pages and pages and pages of disclosures that nobody reads?

[Todd Davis, Assistant Attorney General]: It's a great question. Having just used a product to file my taxes, I might say this morning, that's still intense.

[Senator Alison Clarkson (Chair)]: You still have all that. I you haven't

[Todd Davis, Assistant Attorney General]: I do.

[Senator Alison Clarkson (Chair)]: There was minute where I

[Todd Davis, Assistant Attorney General]: was like, got 17.

[Senator Randy Brock (Vice Chair)]: Now I feel sly rubbing. I'm touching my change. There

[Todd Davis, Assistant Attorney General]: was a ton of disclosure than that. And as a lawyer, I actually did sit down. This is why

[Senator Thomas Chittenden]: I took a while.

[Todd Davis, Assistant Attorney General]: And I read a lot of this disclosure. I actually found some fees that I'm interested following up on or referring to our consumer unit because I was lucky to find them in section five of the 17 page document. But I I would agree. I don't think that's meaningful for a lot of consumers. I think that that's that's an important conversation. I would say we're making strides in that direction, and I don't think we've figured out exactly how to provide meaningful consumer understanding, but a bill like six thirty nine does break it down, and I think that's a helpful step. But I want to take a step back to answer what you asked about data brokers. I don't think many data brokers disclose much to the consumers whose data they hold, because as I was saying, you know, the two party relationship, me to the service I'm purchasing, I should have an understanding, I should read the privacy practices, I should engage in that conversation, but if the data broker's purchasing data, I don't have any relationship with the data broker, and so there's not gonna be a host of disclosures, and part of the reason and part of the work that this bill does is at least let me know that Randy Brock holds consumer data, and I can ask him to delete it. So is there requiring that disclosure, I couldn't imagine, but I would, you know, turn to some other more expert mind in the room. I couldn't imagine a world in which every data broker had to send every person who poll who's whose day they hold a notice. I want you to imagine what email would look like if you got emails from all

[Senator Randy Brock (Vice Chair)]: From my imagination, it would be a single database somewhere that reports and reports all of that from every holder of personal information. That's a federal issue, and that the consumer, rather than receiving a footnote that is five paragraphs long, can go through another document that's 96 paragraphs long.

[Senator Alison Clarkson (Chair)]: That can

[Todd Davis, Assistant Attorney General]: change any time.

[Senator Randy Brock (Vice Chair)]: Right. There are easier ways to do this with modern technology what I suggested here. And my question is is is what

[Dylan Zwicky, Leonine Public Affairs (for LexisNexis Risk Solutions)]: we have now is working.

[Todd Davis, Assistant Attorney General]: Well

[Senator Alison Clarkson (Chair)]: Well, can I just put a pin in this, which is I think isn't this what the work of the secretary of state is doing in looking at sort of you heard the reference to cal privacy last week? This is the work of, I think, aggregating all of this so that it makes it simpler for people to go. And this is the study that we're hoping that will happen and be brought back to us and the ongoing work. And you correct me if I'm wrong, Rick, and you, Brian, and everybody else in the room, but I think this is and and Lawrence here. I believe this is the work that we're asking the secretary of state to do.

[Senator Randy Brock (Vice Chair)]: This is that right? All I'm asking is I'm asking the office if they have a perspective on this.

[Todd Davis, Assistant Attorney General]: So I was about to punt to the deputy secretary of state

[Senator Thomas Chittenden]: on this one,

[Senator Randy Brock (Vice Chair)]: who I know will Yeah.

[Todd Davis, Assistant Attorney General]: Provide you that. We support we we've been in conversation with them Okay. Since last

[Senator Alison Clarkson (Chair)]: year Mhmm.

[Todd Davis, Assistant Attorney General]: And have had quite a bit of conversation this year as well working with legislature and working with the house on how we our offices will work together around creation enforcement and and

[Senator Alison Clarkson (Chair)]: And and simplify. I mean, I think the one of the objectives, think, is a simpler consumer, just to your point, Randy, consumer facing ability, you know, ability to actually delete in some sort of straightforward way.

[Todd Davis, Assistant Attorney General]: And and I think what we're gonna see, and I think we will see this more in the data privacy space, is my assumption that in the absence of federal action because I completely agree a federal solution would make the

[Senator Thomas Chittenden]: most sense. We're gonna

[Todd Davis, Assistant Attorney General]: see a small f federal solution with states essentially beginning to adopt overlapping or congruent data registration, broker, privacy bills. I think, you know, the laboratory democracy concept each state is gonna make little iterative changes, and we're gonna begin to see. And I think Vermont's bill does expand and improve on the existing mean, call it the status quo, but, we're not identical to another state, and I think there's a lot of positive to that. But in this instance, I think we are looking at more conversation with California as an example to to try and work with them to provide.

[Senator Alison Clarkson (Chair)]: Right. It's gonna be two emails for today.

[Senator David Weeks (Clerk)]: Sure. Can you give me a scenario on how you would utilize this database of brokers? As a consumer? As a consumer and and with the tie in with the Without. Sector stated. So

[Todd Davis, Assistant Attorney General]: assuming that right now I can go and download an Excel spreadsheet of all the data brokers that registered for a partner, presumably I could contact all of them and ask them what information I hold on. I I don't know how successful I'd be in getting information. Under two eleven, I'd have a lot more, I'd have a better leverage to get the information. And if it's to have written that, the ability to request the deletion of of data almost across the board from each of those. So that's the inner player. Right? If you go and say, you've got my data. Please leave my data. Don't worry. There are there are some use case carve outs in 02/11 for business processes and and places where federal law covers the waterfront. And and, you

[Senator Thomas Chittenden]: know, I would flag for you, and I

[Todd Davis, Assistant Attorney General]: think I've heard from others, In those use cases where I can't, you know

[Senator Alison Clarkson (Chair)]: We're talking about the exemption section.

[Todd Davis, Assistant Attorney General]: The exemptions. Yes.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Thank you.

[Todd Davis, Assistant Attorney General]: But when I went bankrupt, when I skipped out on a bill, those things that would impact my credit score, I can't say, hey. Forget about those. But I also think it's appropriate that the data companies that hold that information can't also sell that data for non credit reporting purposes. So that's the way one might interact. The way the AG's office would interact with this as well, I mean, we'd be the enforcer to say, you know, Clarkson's data warehouse didn't register. They've got Vermonter's data. We're gonna go after them for failure to register. We're gonna and there's a longer process to that. It's not a you miss the deadline. We're gonna hammer. There are steps laid out in the bill, but that's mainly our role there. And I think we will be that will give us information if there are data breaches or otherwise to ensure that we've got the you know, there's there's some language in here about having a bond. It's a simple method of ensuring the state get recoups costs, get recoups penalties more easily than full full blown litigation, assuming, you know, the penalties cost you with the.

[Senator Alison Clarkson (Chair)]: Good. So thank you. So follow-up on that, do you currently have the capacity to deal with the enforcement the the initial enforcement that all these consumer protection bills that are are requiring?

[Senator Thomas Chittenden]: All of them?

[Senator Alison Clarkson (Chair)]: Well, we have quite a few. We have three data bills alone that are looking into the AG as and for enforcement, particularly if the if if the depending what private right of action in the data privacy bill. So I guess my question to you and something we all have to take on board is what is your capacity and is your capacity to enforce this? Does this is it sufficient at the moment?

[Todd Davis, Assistant Attorney General]: Yeah. So I will say top level, attorney general is herself is probably one of the biggest data privacy advocates out there. And I'm sure it is a top top priority.

[Senator Randy Brock (Vice Chair)]: Yeah.

[Todd Davis, Assistant Attorney General]: Course, it's still a limited pool of eight or nine attorneys who run the gamut from, you know

[Senator Alison Clarkson (Chair)]: In a division? Eight or nine?

[Dylan Zwicky, Leonine Public Affairs (for LexisNexis Risk Solutions)]: Eight or nine. I can't remember how many

[Todd Davis, Assistant Attorney General]: it is right now. And two or three two, I think, investigators who who are looking at everything from home improvement cases to, you know, social media to data privacy. So we always are prioritizing what we enforce. That said, I think six thirty nine, we're not too concerned about having the capacity to enforce the the likely infrequent circumstances where we need to stop somebody from sharing genetic data. This bill, I think, remains to be seen what it takes to enforce. Part of the reason we wanted that bond in there is to kind of make the low level administrative enforcement easier, we hope. But I think it does remain to be seen how much we're gonna have to push on that. The broader data privacy question, I mean, happy to kind of give you the pitch. Part of the reason we support a consumer's right to their own remedy, is thrown around as a private right of action, is because it means that the limited research to the AG's office, the taxpayer funded research to the AG's office are not responsible for every infringement that happens to an individual and can basically empower the individuals to take their own action on it. And and so some of what's in two eleven, I think, provides that in a non litigious posture. Right? You can delete your data. You can request your data to be deleted. You can find out what it is. There's more consumer empowerment short of necessarily suing, and I think that's a positive for our office. But the consumer protection angles in here, we think are really important in tool and and whatever s nine nine seventy one, I guess, is what it still is in the broader data protection area. We really do believe that we want consumers to have an access to Remedy, and if it were to follow-up solely to the AG's office, then to finally answer your question, we certainly need more resources because we believe almost any level of data protection, data privacy law, we would need to really make sure that it's getting the most to fullest, and if there's no right of action, and it's only us who

[Dylan Zwicky, Leonine Public Affairs (for LexisNexis Risk Solutions)]: are gonna be While you're here, and I don't

[Senator Alison Clarkson (Chair)]: know if you or Rick or the or maybe the two of you talk to us about the bond, because the bond is it's on page 29 in the whole section on the annual registration piece. And I think my understanding of this is that it does it does work to help us avoid going to court, and it's a hope to recoup things that are out of state that we cannot don't have the necessary authority to collect or be but so so it protects us to just talk to us a little bit about the bond so we can appreciate it more. Yeah.

[Todd Davis, Assistant Attorney General]: I think you've you've so it is drawn from an existing Vermont law. Right. It is drawn from it's funny because it used to be a hot consumer issue, and I think some ones have largely gone away with it. Paid fundraisers paid fundraisers just still absolutely exist, but we used to all get a lot of phone calls from a lot of charities raising funds, and some portion of those calls didn't come from the nonprofit organization as well.

[Senator Alison Clarkson (Chair)]: Like the police league. You know that?

[Senator Randy Brock (Vice Chair)]: Huge number of those. And

[Todd Davis, Assistant Attorney General]: not naming any of them. There were some that were not real nonprofits or charities that were named like I wanna be careful not to name one that's Yeah. I didn't it, but a name that sounded very similar. Like, maybe it was not a five zero one c three, maybe it was registered as a nonprofit in Arizona, but you'd be getting a call from a for profit company that was raising funds. That for profit company was keeping 85, 90% of every dollar that people gave. So we have a register registering for monitor requires those companies that do paid fundraisers to register, and it requires them to pay a fee every time they run a campaign. Right. They also have to file a bond. And what we found is when folks weren't registering for whatever reason, it was very easy for the agency office to say, hey. You gotta register. And if they didn't register within thirty days, so they were past the deadline. They got a thirty day extension, as I recall. And then we would just go to the bond company and say, here's the cost. Right. They're in violation. If it was if it was multiple violations, sometimes we went beyond just the registration cost and would say that's a $10,000 violation of our Protection It's a way of our legitimizing registrants. It's just a way of without filing a lawsuit. Right.

[Senator Alison Clarkson (Chair)]: It it avoids yeah. It's a way to avoid it. It can. It can.

[Todd Davis, Assistant Attorney General]: Okay. Great. Importantly, that just runs to the attorney general's office, or it runs to the state, but the AG is the one to And enforce it doesn't change our ability to file litigation otherwise, but it does simplify some of these, as I would say, registration administrative as you know, if we got companies unlawfully selling data under the law, we're gonna take a different Yeah. No.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: You you raised it,

[Senator Alison Clarkson (Chair)]: so I just thought it was worth our appreciating and understanding why it is there. Great. Any other questions for Todd? Todd happily is reasonably close by so we can Happy

[Todd Davis, Assistant Attorney General]: to come back. Happy we also have folks who I can bring in the folks who, you know, enforce the current data breach law if you want. So Oh, interesting. I mean, more technical. Right. Perfect.

[Senator Alison Clarkson (Chair)]: Thank you very much. We're going to turn to our secretary of state's office who are charged with doing a lot of this work in developing our Good morning. Good morning, Lauren. Welcome back.

[Lauren Hibbert, Deputy Secretary of State]: Thank you so much. Two days in a row and my first two days of the session in this room, so that's

[Senator Alison Clarkson (Chair)]: a treat. Which it's always a treat to have you. So welcome. And as as everybody may know, David Hall is responsible for this and has done a lot of the work in this area, and he's out of country. And so Lauren is halfway testifying on his behalf and on behalf of the.

[Lauren Hibbert, Deputy Secretary of State]: For the record, Lauren Hibbard, deputy secretary of state. It's a pleasure to pitch it to David, but you are missing out on his deep expertise, then you're have me instead. So we worked really hard, as the Attorney General just said, on this bill with lunch counsel, with the sponsor, and with the Attorney General's office. We think that this bill is a substantial step forward, an important step forward, And from the secretary of state's office perspective, it's doing a couple of things. One, and probably most importantly, is the previous law required registration in the following year after activity. So that's a very weird statutory construct. Right? You're gonna tell us that you you're required to register. We care that you register with us, but you have a whole year until after you do the activity to register. That was always something that sort of was gritty to us. It didn't make a ton of sense.

[Senator Alison Clarkson (Chair)]: To register after the fact. After the activity. Yeah.

[Lauren Hibbert, Deputy Secretary of State]: It would be like if someone said, you need a registration to drive on the road, but you have a year to do it. You know? Like, that's it's just kind of an odd construct. And I think there's some reasons for that in this space because people data's moving very fast, and you may not know that you were taking Vermonters data and you need time to catch up. But we really appreciate that on page 29, it now says not more than thirty days after meeting the definition. That's gonna get Vermonters a more clear picture faster of who's touching their data, who's using their data for profit, and where that data is being stored. So that is a significant thing that we like. And then we are setting a set time. An important factor of that too is now there's a deadline for renewal every year. It's not Right. Sort of sporadic throughout the

[Senator Alison Clarkson (Chair)]: For everybody. Right.

[Lauren Hibbert, Deputy Secretary of State]: For everybody. Once you meet the definition, you have thirty days to register, and then you have to renew that registration July 1 of every year. And that's just a great chalk line. We'll get a sense on July 2, who's in, who's out, and we we really like that. We like that clarity. The second big thing is we are increasing the registration fee. It was a $100, which is almost laughable, and it is now 900. This is in line with the registration fees in other states. These are businesses that, for the most part, are making a lot of money off of all of our data, and there's increased requirements on the Secretary of State's office and the Attorney General's office in this bill that really the fees for data brokers should cover, and we think this is a good estimation at this point of what the fees should be. Do you

[Senator Alison Clarkson (Chair)]: have a notion of some of the other states' fees?

[Lauren Hibbert, Deputy Secretary of State]: Some of the other states' fees are 2,000. Some of them

[Senator Alison Clarkson (Chair)]: are I think California is at something oh, well over $6,000.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yes.

[Senator Alison Clarkson (Chair)]: So, I mean, just to put in perspective, this

[Lauren Hibbert, Deputy Secretary of State]: is I don't have that in front of me, but can No. That would be helpful, I think,

[Senator Alison Clarkson (Chair)]: for us to look at it in perspective. Population. Right. Right. So this factors in population.

[Lauren Hibbert, Deputy Secretary of State]: Well, so I'll just say that, you know, I think population is always an interesting thing when we're talking about Vermont because the requirements on Vermont to to ensure that that that our Vermonters data is not misused are the same as California's. But California has so many more citizens, so enforcement is more. But the requirements of our system are the same. The requirements of our, you know, staff time, creating answers to questions, and all of those things are the same. So there are some things that scale with population growth, but there are some things that remain consistent. And really, when we're talking about infrastructure, those things have this we have the same cost as California to build the systems. And I So we benefit from our scale and we have harm from our scale. So that's moving the registration requirement, the fee, that's one and two. The second is the bond. Way that I think of a bond is it's somebody promising to cover your liability, that's what a bond company does. And this means that we'll have a much more streamlined process with the attorney general on failure to register. And that and so as mister Gaylo said, you know, he explained that the process very well. I think that would become more streamlined. The fourth important piece of this bill from the Secretary of State's office perspective is the increased data that we are going to get from data brokers. That's on page 30, line 14. We are going to have a lot more information on what data points data brokers are gathering on Vermonters. And practically on the ground, and this probably allows a little sensitive about the infrastructure, we are going to need to build in the secretary of state's business portal a lot more data collection around data brokers. So this is an IT build. What this build represents to our office is an IT build and infrastructure change on our side because not only will the data broker need to provide a lot more data points to us than they currently do, we also will need to expose that to the consumer. And so there there's two pieces of that. I think we have an estimate for this. It's about a $120,000 for us to do. We are not asking for an appropriation for that because we are getting the increased fees. So that is why the fees are increasing in part. And that's that cost of that change request is for the initial build, but we'll have to maintain it, so it has an ongoing maintenance cost as well.

[Senator Alison Clarkson (Chair)]: So, and this is

[Todd Davis, Assistant Attorney General]: the

[Senator Alison Clarkson (Chair)]: list on page 30 is sort of the highly sensitive data That's right. That we wanna know if that represent pieces of our of Vermonters that are being sold by the data brokers. We're wanting to know the highly sensitive material that they're collecting and selling. That's correct.

[Lauren Hibbert, Deputy Secretary of State]: Another really important piece of this bill, I think we're now at five, is information

[Senator Alison Clarkson (Chair)]: I'll be sure it's six or seven. Oh, okay. Sorry. I left. Six. I'm at six.

[Lauren Hibbert, Deputy Secretary of State]: Okay. Great. Six. Is information that, again, the Secretary of State will need to provide to the consumers on each data broker how you can opt out. The website where somebody can opt out, that is a new requirement on the data brokers, but it's also a new requirement on the Secretary of State to provide that information to the consumer. We think that's very important.

[Senator Alison Clarkson (Chair)]: And then So that goes to Randy's question, think, which is how do we make it simple and and and easy for consumers instead of being hit with cod 17 pages where it got to the, you know Yeah. Of information, how that's part of what is being undertaken in this work of building this IT system. Right? Yeah. Kind of make it simpler for Vermonters to be able to even figure out how to delete their data.

[Lauren Hibbert, Deputy Secretary of State]: Think there's two things there. One is the disclosures within systems about the sale of data to data brokers, which Right. This bill, frankly, doesn't address too much because I think as a nation, have to have a reckoning about the fact that we all read 17 pages or fail to read 17 pages. I I applaud those of you who do read 17 pages, but I do not. And I'm also a lawyer, and I don't all the time. Sometimes I do, sometimes I don't. But that has to become simpler somehow. This bill doesn't address that.

[Senator Alison Clarkson (Chair)]: Well, but it addresses it in that you're gonna be creating the IT interface. Easier? Yes.

[Lauren Hibbert, Deputy Secretary of State]: So there's a two step process in this bill. One is the requirement that data brokers do provide an option to consumers to opt out and a requirement that they provide that information to the Secretary of State's office and a requirement that we provide that to consumers. That is going to be on the consumer to go into those data brokers and use their websites individually. That could be quite a bit of time. The original iteration of this bill had us create a delete me, universal delete me feature. We are not able to take that on without a lot more investigation and understanding. And one part, the easiest way that I have been thinking about this as the problem for the Secretary of State's office is then we become Vermont's first data broker. We're gonna be getting all the sensitive peppant from all the Vermonters with all of those factors that data brokers are using, and then we would be communicating to data brokers to say, you need to delete this person. So there's a lot of security around that endeavor, a very good endeavor, one that we should really step towards and move towards. But I wanna make sure that we do it in a way that's very well, I like to to under promise and over perform. So I wanna do it in a way that makes sure that we are protecting Vermont's data as we're communicating with data brokers, that we are have effective ways of communicating with data brokers, that that believe me, and that we have a response back from data brokers if they actually have done it. So those would be the three things that I would be looking for in any system that we built. The other thing and you folks mentioned CalProtacy. CalProtacy is in the process of building a delete me functionality in their system, and our team did talk with them. And They are about a year out from building it, which is another reason why we said, woah, don't put a deadline for the creation of this system into this bill for us, because if California state sometimes California shouldn't be used as a model of excellence, but Cal privacy does have a lot of intention and resources behind it. So, if they're gonna take a year more than the year that they've already had to create this, we wanna make sure that we have enough runway as well. And we wanna make sure that we're doing it in the right way. So I think I'm on seven. And seven is the the important feature of this bill is the report that the Secretary of State is responsive, responsible for shepherding, and we are asking for a $50,000 allocation for that report. We would like to hire a consultant for that report, and that is a resource issue for us.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: So

[Lauren Hibbert, Deputy Secretary of State]: we do think that that report will be very informative for us on what is possible in this delete functionality. Honestly, my hope is that, and I said this to Ralph Ramsey, that they figure out some sort of subscription model where states can buy in. We're not going to have a federal solution for quite some time. This really should be a federal solution. California is on the forefront of this. They're building state of the art technology. If they could figure out how to sell a subscription to Vermont that Vermonters could just go to and enter their data, and it's all the same data. So it would be just make a ton of sense to me, but I'm not California. I'm not

[Senator Alison Clarkson (Chair)]: Alternate for opportunity for an income opportunity for me.

[Lauren Hibbert, Deputy Secretary of State]: It certainly could be. And if if we had to pay, you know, $300,000 a year for that subscription, that would be reasonable and would make sense and would be far better than taking on the liability, quite frankly, and the responsibility of upkeep of that system. So, that is something that I'm hopeful for. I don't know whether it's gonna be possible, And but other than that, we'll also keep looking at what would it take for us to build this system. I think it could be a component of our business registration system, but it would dramatically change our business registration system. We would have to which does not hold any confidential data. Everything that's entered in our business registration system is public information and frankly is exposed to the public right now. So it would be a dramatic shift in just the IT infrastructure around our business services system. Now that's not foreign to the secretary of state office. We have a ton of PHI in our office of professional regulations, IT system, but it would it would dramatically change how we are handling the data in business services. Those are our seven most important factors of this bill, and we also are very happy with where this bill has landed, and I'm happy to answer questions.

[Senator Alison Clarkson (Chair)]: Collins, David, Randy.

[Lauren Hibbert, Deputy Secretary of State]: Thank you

[Senator Alison Clarkson (Chair)]: so much. And the report back, remind me, is next for next session so that I believe some of our piece I can't remember. Rick, is it I I'm trying to find it at the moment. I just stopped by.

[Rick Segal, Office of Legislative Counsel]: Rick Segal with the office of Blitz of Council, 12/01/2028.

[Senator Alison Clarkson (Chair)]: '28. Okay. So oh, I see. It's at the end. It's at near the end.

[Todd Davis, Assistant Attorney General]: It's page 42.

[Senator Alison Clarkson (Chair)]: So that's near the end.

[Lauren Hibbert, Deputy Secretary of State]: You have eighteen months with a check-in at April or check-in in six months.

[Senator Alison Clarkson (Chair)]: Got it. Right. Okay. Yes. There it is. It's supposed to be in with the probations. Perfect. Nice. No. That sounds like work that needs to happen. We're excited to dig into it Perfect. A little Thank you very much. Thank you so much. Thank you for pinch hitting. Nice work. We appreciate. Thank you. So, I think we are next on with Sean McLaughlin, who is on the screen. Sean, welcome. Thank you for your patience. We appreciate. I take it this is your time. Jamie's in the room?

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: No,

[Senator Alison Clarkson (Chair)]: not different, Sean, welcome. You probably don't know any of us, we're gonna quickly introduce ourselves. We're the Senate Economic Development Committee here in Vermont, and you are Zooming in from where?

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: I'm in Hoboken, New Jersey.

[Senator Alison Clarkson (Chair)]: Oh, beautiful Hoboken. We're at close to 80 today.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yeah.

[Senator Alison Clarkson (Chair)]: We're just gonna introduce ourselves quickly. Dave, if you wanna start.

[Senator David Weeks (Clerk)]: Sure. Good morning. Senator David Weeks representing Rutland County.

[Senator Randy Brock (Vice Chair)]: Senator Randy Brock, Bradford County and Northern Grand Island County.

[Senator Alison Clarkson (Chair)]: Alison Clarkson, Windsor District on the East Side Of Vermont.

[Senator Thomas Chittenden]: Thomas Chittenden representing the Southeast area of Chittenden County.

[Senator Alison Clarkson (Chair)]: Great. Sean, welcome. Thank you for joining us. We appreciate your patience as you listen to the rest and share with us your thoughts on this bill.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Yeah, well, thank you, Madam Chair, thank you members of the committee. Appreciate the warm welcome. I apologize for not being able to be up there today. Was planning on it, I have some family commitments down here that I have to attend to. So I appreciate the opportunity to testify via Zoom. And I represent the National Association of Mutual Insurance Companies or NAMIC for short. And NAMIC is a leading trade association representing the property and casualty insurance industry. And we serve more than 1,300 member companies, including local and regional insurers, a few Vermont domestics that you'll be familiar with, as well as some of the nation's largest carriers. And we collectively write $467,000,000,000 in annual premiums representing 61% of the homeowners and 53% of the automobile insurance markets. And for more than one hundred and thirty years NAMC has been the leading voice advocating for advancing public policy solutions and regulatory frameworks that promote a strong competitive market and protect our members and policyholders. So now that I got the intro out of the way, So my ask here is fairly simple. We don't have a ton in terms of strong opposition to this bill. We do have some concerns that I'd like to discuss today, and that's mainly just how this bill affects insurance and kind of the interplay with existing federal laws that I'm sure you'll probably be familiar with. So just introduce it by saying different industries use data in different ways. And this is why historically The US has developed different privacy or data use regimes for different sectors of the economy. So where financial services, including insurance is concerned, the Gramm Leach Bliley Act or GLBA establishes a data privacy regime that is specific to the nature of our sectors, relationships, products, services provided to consumers. Specifically Title V is part of the

[Senator Alison Clarkson (Chair)]: I believe that GLBA it addresses information that links the social security with any financial information. Is that correct?

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yes, correct. Correct.

[Senator Alison Clarkson (Chair)]: So that's just for our committee. We don't deal with GLBA on a regular basis, so we just be reminded by our legislature council what GLDA does.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Sure. And I can talk Sorry, go ahead.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yeah. How

[Senator Randy Brock (Vice Chair)]: much time do you

[Senator Alison Clarkson (Chair)]: have? Okay.

[Todd Davis, Assistant Attorney General]: Thank you

[Senator Alison Clarkson (Chair)]: so much, John. We'll just keep listening.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Yeah, and GLBA oftentimes I hear from state legislators, it can be the bane of their existence. Only Well, it

[Senator Alison Clarkson (Chair)]: can be interpreted very broadly, we Yes, which we're trying to narrow.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Right, so Title V of GLBA recognizes the state based system of regulation for insurers and preserves their enforcement. States have implemented GLBA provisions in their jurisdictions as well as Vermont through the NAIC model law six seventy two which has duties that go beyond

[Senator Alison Clarkson (Chair)]: the acronyms we don't know. So share with us what is

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: That's the the National Association of Insurance Commissioners and that model law basically has duties that go beyond the requirements in GLBA and appropriately tailors regulations to the insurance and increased functions. State insurance departments also have industry specific data breach laws and requirements as does Vermont. And to include in scope entities that are subject to the GLBA in this bill would result in overlapping data and privacy rights, which would create, we believe an inefficient costly and layered regulatory system. And there's strong privacy and data use infrastructure in place for insurers. So it's critical not needlessly complicate requirements for those already subject to comprehensive oversight. That's NAMIC's view on it. I'll talk a little bit just in closing about mandatory deletion in insurance and why it's a little different. So to best understand and assess risk, the insurance industry engages in analysis and study of both general and policyholder specific data to predict risk with actuarial soundness. We want to match rate to risk. That's generate how premiums and how to understand price insurance. And we're subject to robust insurance laws and state regulatory oversight on that front. Insurance is not a one time transaction. Insurers take on risk and promise future payment if a loss covered under an insurance policy occurs. That's how insurance works. So some insurance products have longer tailed claims that could span years if not decades. For example, a policyholder is later sued for something that occurred during their policy period, which has since expired. So separately compliance requirements, market conduct examinations by insurance regulators, claims payments and potential litigation are additional reasons why information about policyholder is maintained after no longer have active coverage with an insurance company. So for those reasons, we do think that a carve out for insurance is appropriate in this bill. It's covered federally, it's covered by insurance regulators, and the nature of insurance as established by GLBA is simply specific, especially considering the longer tailed relationships that insurance have with their consumers. So that's NAMIC's view. I'm happy to answer any questions you may have. Again, I appreciate the time.

[Senator Alison Clarkson (Chair)]: No, we appreciate yours as well. Committee, any questions?

[Todd Davis, Assistant Attorney General]: Can I

[Senator David Weeks (Clerk)]: summarize what I think I heard?

[Senator Alison Clarkson (Chair)]: Yes. That's the best way of having heard it is, eating it back. This

[Senator David Weeks (Clerk)]: organization does not support the majority of bill, the regulation.

[Senator Alison Clarkson (Chair)]: No, I think just the exemptions issues. I think you're focused just on the exemptions. Is that Yep,

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: that's correct. Yeah,

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: we would just like to see an amendment.

[Senator Alison Clarkson (Chair)]: Do you have an amendment to propose?

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Well, just carve out, and I'm happy to work with you on language, but just basically exempting insurance from the bill.

[Senator Alison Clarkson (Chair)]: Right, that was my takeaway, is carve out for insurance.

[Todd Davis, Assistant Attorney General]: Correct. Would

[Senator Thomas Chittenden]: it be exempting insurance companies or would it be exempting any entity regulated by Grant Leach Bliley?

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: So our preference would be insurance companies. Happy to talk about, I can't speak for other industries generally and that are covered by Gramm Leach Bliley, but the same reasoning would apply, but our concern is for insurance carriers and how this bill affects them.

[Senator Thomas Chittenden]: Then the follow-up question I'll have, probably ledge counsel is if there was an exemption for entities regulated by Grant Leach Byley Fair Credit Reporting Act and the Driver Privacy Protection Act, Would those entities, so they were entity level exemptions, would the activities that they did with that data, they, could they still sell it to other people or would that activity then be restricted by this? I'm assuming if they sold it to another entity that isn't regulated by those things, they would still be governed. But I have questions about that that boundary of what that exemption would cover and would cover at an entity level. Maybe that's for a later discussion.

[Todd Davis, Assistant Attorney General]: I can okay. So, office of council. The big question is, if they were exempted, exempted things at any level through the ECP level sanctions, how long would they be to sell the data? So even if they were not exempt, this does not prevent this move. It does not prevent any institution from selling data. This is really deleting data. So a data broker that is exempt from this bill would be able to sell whatever they want. Let me clarify with or without being sent. The question is, can they delete? Do they have to delete the consumer's data? If they're exempt, then no. If they're not exempt, then probably yes, unless there's another exemption that they meet in this bill. Deletion Act. Yes. Okay. That helps.

[Senator Alison Clarkson (Chair)]: So, it would, you know, insurance companies don't need to know what my favorite color is. I mean, is certain information that is broadly collected that you don't really need, I assume. Mean, that you don't need to know everything about us. You've been insuring us for centuries, and we somehow have managed without you knowing a lot of the stuff that's now collected about all of us individually. So I guess one of the questions I'd have for you is, might the insurance companies articulate what data is most critically important to them to remain examined?

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Yeah, I think we're happy to. And it's gonna be data points that have been naturally proven to reflect future risk, which is driving obviously all the way down

[Senator Randy Brock (Vice Chair)]: to But

[Lauren Hibbert, Deputy Secretary of State]: if you

[Senator Alison Clarkson (Chair)]: could send us those key areas, that would be helpful because I think as we all know so much, you don't need to know that I'm a size eight or that I I love blue. I'm wearing blue today, red. But I mean, you don't need to know all those things. You don't need to know all the things that are gonna prompt all these advertisements on our internet. You but you do need to know some specific things that do help our future indicators for risk.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Right.

[Senator Alison Clarkson (Chair)]: I get that. And I think we all appreciate that. So if you would be kind enough to actually identify the data pieces that you consider critically important, that would be helpful for us.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Okay. Happy to do so, madam chair.

[Senator Alison Clarkson (Chair)]: Quite honestly, the GLBA covers everything from payday loaners, the payday loan people, to car dealers, to I mean, it's a whole range of debt collectors. I mean, anybody the GLBA covers anybody that somehow has links in the course of business, the social security number with financial information. So it's a whole range of businesses. I'm just saying to go to that concern. So I'm not sure we'd want to exclude all of those.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yeah, that's fair. I will

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: point out in the California Delete Act, the definition of data broker does exclude GLBA covered entities. I appreciate

[Senator Alison Clarkson (Chair)]: that this is one option that we're facing.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: Thomas?

[Senator Thomas Chittenden]: No, I'm good.

[Senator Alison Clarkson (Chair)]: Okay, great. Thank you, Sean. Terrific. And if you could get us that information, that would be helpful.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: I will do so, Asa. Thank you so much. I appreciate it.

[Senator Alison Clarkson (Chair)]: Thank you so much. Good luck in Hoboken.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Thank you. Thank you.

[Senator Alison Clarkson (Chair)]: Appreciate it. Get to look at look at Manhattan.

[Sean McLaughlin, National Association of Mutual Insurance Companies (NAMIC)]: That's right, and hopefully Montpelier soon.

[Senator Alison Clarkson (Chair)]: And the Stacks Of Liberty, lucky you. Enjoy, thank you.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Take care.

[Senator Alison Clarkson (Chair)]: I think we have Zach next and then Dylan. Feel like, Peter, who's on base? So Dylan, you're I'm done. You're on deck.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Good morning. For the record, my name is Zachary Palminelli. I'm the consumer protection advocate for VPERG. We're not public interest research group. For more than fifty years, VPERG, we've advocated for the public interest in debates concerning the environment, health care, democracy, and consumer protection, and it's in that function that I'm here today. Appreciate the opportunity to share a thought on two eleven. I'll just start off saying, we support h two eleven as it passed the house. Ultimately, we would like to see state move more rapidly toward establishing this universal opt out mechanism that's actually gonna be a study, you know, in this bill. But we understand and appreciate what the secretary of state has expressed in terms of that is not gonna be a simple path. They wanna take time to understand and maybe see if they can leverage California's existing work and do that frankly cheaper and saves some money. So we think that that's, you know, this is a meaningful and useful interim step for consumers, giving them the right to request deletion and seeing if the Secretary of State can determine is there a way to do that miricorilant mechanism. So just a little bit of background on, you know, vPerry and our our work on this. So back in 2018, we were one of the leading proponents of act one seventy one. This is the ground beef

[Senator Randy Brock (Vice Chair)]: Ground.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Groundbreaking data broker registry that you've heard about. This. Yes. Exactly. If they come out of this committee, some of the same people were in this room then.

[Senator Alison Clarkson (Chair)]: I think just me. Maybe senator Brock. I don't know. I think I think you were was it '17 or '18?

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: It was 2018. Yeah.

[Senator Alison Clarkson (Chair)]: I don't Ryan's here. Ryan was. Anyway, two or three of us out of a room full of people. And that's us here.

[Todd Davis, Assistant Attorney General]: Yes. That's true.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: And at that time, we advocated for giving consumers delete rights, opt out rights with respect to data brokers. The committees, the legislature took the frankly prudent approach because no state had done anything with data brokers at that point saying, we're gonna establish registry. We're gonna collect information. We're gonna understand a little bit more how the industry operates. Fast forward now. We are eight years later. Several other states have gone in our stead. They established data broker registries, and California has taken that additional step, giving consumers the right to request, that their data be deleted with data brokers. And they've even gone even further, and they have established the California drop portal, that one stop shop where a consumer can, within five minutes, put in a little bit of information, state verifies that you're a resident, and then they work with your their entire list of registered data brokers to request an opt out. This works like almost like a do not call lesson. This is what we ultimately want to see Vermont moving forward. This bill moves us in

[Senator Alison Clarkson (Chair)]: that direction. Something as simple as a do not call us.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Exactly. And so we think that that's great. And, you know, just a few words on why we see this bill as being necessary. You've heard this before, but I think it bears repeating. Recognizing and I think it bears repeating, especially because this is coming in the context that I know in this legislature, you know, we're debating a comprehensive data privacy bill. You know? Oh, well, maybe we're gonna do that. Is this really necessary? How is this different? And it all comes back to the unique position that data brokers, hold within the marketplace. This idea that they are third parties that consumers have no direct relationship with. So what do I mean by that? Well, typically, and we see this bill as essentially creating, correcting a market failure. Typically, consumers' power in the marketplace comes from the ability to vote vote with their wallet. Right? I can decide what retailers to visit and, you know, if they you know, share my values and I wanna, you know, buy their product. I can decide what websites to visit, what organizations to give my information to. I can make those decisions as a consumer. I don't have that decision with data brokers. They are a third party. They are collecting information, my information, and selling it and profiting off it without interacting with me at all. So I I currently can't say, I don't like how that business that data broker is, operating or or using my data. I have no power, no ability to stop them from using my data, my information. That's what's essential, and that is essentially what this bill does is it gives consumers it corrects that market imbalance. It gives consumers that power to request that a data broker delete their data. It then also additionally, and this is where we get into the question of exemptions, and I think the word exemption is a little confusing. It, I think, correctly lays out several areas where a data broker can deny that deletion request because, we've decided that it's important that that data may be maintained and be used for, you know, purposes of commerce, you know, for fraud prevention or

[Senator Alison Clarkson (Chair)]: For health care. I mean, there's tons of ways.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Tons of legitimate Deductively important to share. Important uses. Right. So when we get into the question of exemptions, I think that's almost like kind of a misnomer. We're saying, what are the legitimate reasons that a data broker can deny a deletion plus? And I think the ones that are included in here work. I think that when you think about the exemptions in that context, it helps why we would say something like a broad, for instance, GLDA level exemption becomes becomes a problem. And I'll I'll kinda come back to that in a sec. I just wanted to then finally get to the point of the the exact harms that this bill will prevent because often when we talk about data privacy, you know, we kinda get very caught up in the the details and sometimes losing the forest for the trees. Like, what exactly are we trying to stop? What are the kind of harms that we're trying to fix? You know? And I you know, this is in my written testimony, and you can kind of look at some of the cases. But just within the last decade, real world harms that have resulted from the overcollection and the misuse of consumer information by data brokers. So in 2014, the FTC, brought a complaint that the data broker Leap Lab bought payday loan applications from financially strapped consumers and then sold that information to marketers that it knew it had no legitimate need or use for. And at least one marketer, Ideal Financial Solutions, used that information to directly withdraw millions of dollars from consumer accounts without their authorization. In twenty twenty twenty and 2021, the Department of Justice charged three data brokers, Epsilon, Macro Market, KBM, the conspiracy to commit mail and wire fraud for knowingly selling for roughly a decade lists of what they said were vulnerable Americans, including elderly Americans, people with Alzheimer's, directly to criminal scammers. And the scammers then use that data that broker data to steal millions of dollars from those people. And then in 2022, the FTC sued the data broker, Kochava, for selling exact geolocation data from hundreds of millions of mobile devices that could be used to track individuals for sensitive locations, including reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities. So you may be saying, well, the government brought action against all of these bad actors. And, yes, that's true. But that all happened after all these harms and the frauds and all that occurred. These are all data brokers doing these things. Had consumers had a delete right prior to it and exercised that, at least some of these consumers, how they exercise that and how these data brokers honor that deletion request, one could submit that. These data brokers might not be the type that would actually honor that request, but they would be legally obligated to. Had they done that, we could have saved some of these consumers some of these these harms that we we just laid out because their information would have been deleted, would not have been sold to, you know, the criminal fraudsters.

[Senator Alison Clarkson (Chair)]: Yeah. And just to tie this all together, I mean, we have given we have not acted on surveillance pricing this session. Sure. But we have, given it to our agency of agriculture who, in their weights and measures division, is doing a comprehensive look at at the at this and the impact on our consumers. And this all feeds into exactly that. I mean, just just to remind ourselves that all a lot of this is tied together. And so we're wanting very much to appreciate and understand all of that data that could be being fed in real time Absolutely. To to places that could then be seen real time, changing prices for things depending on our our our personal profiles. Kesha, you're welcome.

[Senator Kesha Ram Hinsdale]: Thank you. Sorry sorry I missed some of this, but I I feel like you're maybe this was already covered, but you're touching on one of the questions I I've had, which is, you know, who tends to take advantage of registries to remove their information? Right? You've had the do not call list in the past. So what what are some of the trends you see about the kind of person who has the time and wherewithal and Internet access, etcetera, to remove their own?

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Data. Absolutely. So that's why and I did mention at the start of this. I would call this bill an interim step. It is recognizing that consumers should have the right to delete. But until we get to the point where we actually set up that one stop shop, I think it is not likely or practical that I'll I'll just state this quite frankly. I think if you pass this bill as it was and we came in two years from now and you will try to get some data on how many consumers actually exercise deletion requests, it would be very, very low. It would be very it's

[Senator Kesha Ram Hinsdale]: And that's what's based out in the research and the

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: the data on Well, I I'm just basing that on practicality. There's almost 300 data brokers registered. Right.

[Senator Alison Clarkson (Chair)]: And there are many, many more times that that are actually doing business. Correct.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: So if you gave consumers the right to know the and even if you provided this information via the secretary of state's office, I could go and download that list, I would still need to go to 300 individual data broker websites That's weird. And request a deletion.

[Senator Kesha Ram Hinsdale]: So you have And they're not even, like, criminal actors. No. Right? Like, the criminal actors are kinda who want them to delete.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Right. But but because Yeah. But also to that point, even, you know, if they're not the criminal actors, this data gets shared, shared, and shared again. So if I can request deletion even Yeah. At that level, again, that helps. Right. But who's going to take advantage of this? I would think very little people. I might because I'm a consumer protection advocate who's different involved in this, but that's would be very time consuming. Right. Now if I were to if we were to eventually get to point where we set up this this one stop Which is what

[Senator Alison Clarkson (Chair)]: the bill also is working toward Board. It would study. I did a lot more with it.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: And, you know, California, they can tell you. I mean, I think when they came in and testified and that this has only been live since January 1. I think testified in February over on the house side with Cal privacy. Yeah. No. And and I think something like 600, 700,000 people had already, you know, made deletion requests. Now that is, I'll admit it, a small percentage of even the state of California. It's like

[Senator Kesha Ram Hinsdale]: maybe a little less than 2%.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: But that's still 700,000 people. And, you know, and and it is it's an easy process. And I'm not saying that consumer education does not need to be, you know, part and parcel, you know, to this. And that's a role, frankly, that, you know, the deeper, like, we would play. I mean, if there was a a deletion portal and that that's something that people could do, I would be moving heaven and earth to make sure that many people knew that they could do this as possible and and get there. So that's why I do think it's,

[Senator Randy Brock (Vice Chair)]: you know, it's worth moving toward.

[Senator Alison Clarkson (Chair)]: I would and that's And that's what this bill does.

[Senator Kesha Ram Hinsdale]: Well, what's what's interesting is how we might know the data of the people asking to be deleted. Have to be Right? Because I I actually think the people who don't wanna come up on any radar right are really not putting their email and residence Well etcetera in another's

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: I mean, I think that's probably the right instinct that they might be reluctant. That being said, that's why incredibly important that this sort of deletion system is set up through a trusted party through a state. California has set this up. They they manage and maintain that. You heard from the secretary of state why they wanna take time and understand this because they wanna be able to know we are now being taken in and entrusted with enough information to execute these deletion requests, and we wanna do this right. And, you know, there are ways to do this, and California is doing this with people giving very minimal information. Know? Oh, I might not know. Yeah. Exactly. You need to, you know, verify that you're

[Senator Randy Brock (Vice Chair)]: a resident because you need to do that

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: so you have those rights. And then you can decide what additional information you want to provide that is then used. Okay. Here's my email address. Hell, data brokers. This is the email address I want you to search on to essentially delete delete my information. Right? So there's levels of control there. So I yeah. I hear what you're saying. I think there's ways to do this, though, to make it so that people feel comfortable and secure using using this deletion option, for sure.

[Senator Kesha Ram Hinsdale]: We just don't know if they just started it in January.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: They it went live in January. Yeah. So I yeah. I don't know if they had if they even attempted to, you know I know they know the broad numbers of, you know, how many deletion requests, but I don't know if they don't try to do any kind of analysis on who, you know

[Senator Kesha Ram Hinsdale]: Or how successful it ultimately is.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yeah. Well and and part of that is that the the data broker end of it, the data brokers now getting the information and and exercising that deletion. I don't believe that has to begin until August. I had to double check. So right now, merely essentially collecting the deletion request from consumers. Right. And they already have a notion of

[Senator Alison Clarkson (Chair)]: how many people have adapted.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Like I said, it's hundreds of thousands. It's probably, you know, what we're doing at this point.

[Senator Alison Clarkson (Chair)]: So sorry, Tim.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Yeah. No. Yeah. I I actually I think that was basically yeah. I think that was basically all I'm

[Senator Alison Clarkson (Chair)]: talking about. This your opinion is in the oh, sorry, Thomas. Did you have a

[Senator Thomas Chittenden]: I was gonna bring it back to something you said in your testimony. Yeah. So you're gonna come back to, so you think you recognize that there are circumstances where we don't want to allow people to delete their opinion. It's federally regulated in the Fair Reporting Act so that, you know, you can track whether or we pay the bills, they're at least blithely acts so they have an idea of their worthiness, what accounts were owned when because there's a reason to keep that paper trail and drivers privacy protections so you know who owned what cars went and what driving incidents occurred over time for that. You raised some concern with exemption for each of these carve outs. Could you elaborate more on that?

[Senator Alison Clarkson (Chair)]: Yes. Because they were just about.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Thank you. Appreciate it. Pivoted down to Well, the reason why I wanted to wait is because so I gave the example, for instance, of this data broker lead lab that bought payday loan applications. Payday loan applications are If you created an exemption and said, a data broker does not need to honor a delete request if the data in question is brand reach, app, regulated data, if that was the I I can see the exact proposal for me, but that's essentially a data level exemption, the ability to reject that deletion request. Payday loan applications

[Senator Alison Clarkson (Chair)]: Fit that.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: Fit that definition. So if you have that exemption in place and I submitted a delete request to LeapLab to this this this this data broker that was self updating loan applications, I'd say, oh, I want you to delete my data. It's like, no. I don't want to delete your data. Update a loan application. It's grandiose. Why we act that? So that's that's so I'm good. I'm gonna I'm gonna maintain that. So so that's why, as it is in the bill currently, why we support these use case exemptions, you need to have not just what the data is, but how is it being used. If it's being used for fraud prevention, which is, again, in the bill, then you could say, yeah. I'm not going to depend Data Broker X. I'm not gonna delete your data. It is this kind of data, and

[Senator Alison Clarkson (Chair)]: it is being used for fraud prevention. Or risk or or risk reduction with insurance.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: I mean, again, that's why use case it's it's how you're using the data and why that should be a legitimate reason to reject a deletion request, not just what the data is, because what the data is can be know, again, I don't think that the intention is to prevent a company like LeapLab from rejecting a deletion request just because the nature of the data happens to be financial.

[Dylan Zwicky, Leonine Public Affairs (for LexisNexis Risk Solutions)]: Right. Because there are

[Senator Alison Clarkson (Chair)]: a of companies that brought in under the GLBA, which is it covered a lot

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: of data. So Future. So, you know, it's saying that that saying that it is GLBA data and therefore we are not going to delete it, in my estimation, is not a sufficient reason to to to deny the lead chart question. You need to attach that to how are you using that data, and is it a legitimate use that's advancing commerce or keeping people safe or or what whatever the case Rich,

[Senator Alison Clarkson (Chair)]: this bill at the moment has. That's what I

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: and I would say it does. Well, but that's just a

[Senator Alison Clarkson (Chair)]: little bit of change.

[Lauren Hibbert, Deputy Secretary of State]: Oh, yeah. And that's that's the problem is I think some of some of these bills would keep saying, our intent is this, and we would expect this to happen.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: And look, I'm not saying that I have necessarily contemplated every single legitimate use case that but that doesn't we can add more use cases, but those use cases that I would just submit should be articulated. Like, how am I using the data? As opposed to saying Mhmm. I'm gonna reject a deletion based solely on what the data is. Right.

[Lauren Hibbert, Deputy Secretary of State]: So we've often right. Right. You you you started by listing some harms with the AG's Office of Getting Better at. You know? How many of those harms would have been remedied with a bit like this?

[Senator Alison Clarkson (Chair)]: I don't like I

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: said, it would have been remedied for the people who would have taken the action of having their data deleted. So this bill this bill alone, I'm not trying to say, you know, solves all all ills related to the misuse and over collection of data. And that's why this body is contemplating a comprehensive data privacy bill. That's why I think things like a strong data minimization standard like that get us a lot closer. That doesn't negate the the the need or or the the benefit of of this bill. And that I started by saying, especially because, again, this focus is specifically on data brokers who do not have that direct relationship with consumers. We're just saying right now, I as a consumer have no power, no ability to kind of say what the data broker does or does not do with my data, and we're trying to return some of that power back back to the consumer in in a situation where they currently have no relationship.

[Senator Alison Clarkson (Chair)]: So this moves us towards a universal delete me. Well, yeah. It's it's

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: it says we believe consumers should have the right to request deletion, and it recognizes that without the universal, not many people will exercise it, but it says, secretary of state, go and go and find out Right. How we might get there. And how we might get there in a way that it again, I I I I support that because, I mean, if there was a way, California's done a lot of legwork on this. I'm not opposed to a subscription service if that was something else available. Hell, if

[Senator Alison Clarkson (Chair)]: that Right. We have other protection. Other things. So, yeah, absolutely. So Zach, thank you. Any other questions for Zach? We're happily here close by and so we can pull you in if we need to have additional questions. Absolutely. But just in the interest of time, we're gonna turn to Dylan's wiki and welcome Dylan to the witness chair. And then on deck is Crittenden. And Matt Schwartz, you're on deck after Crittenden. Thank you, Dylan.

[Dylan Zwicky, Leonine Public Affairs (for LexisNexis Risk Solutions)]: Good morning. Welcome. Good to have you.

[Senator Randy Brock (Vice Chair)]: Good to have you. For record bill is working with Leonhart Affairs. Your day on behalf of Lexus Nexus of Thank you for your help.

[Senator Alison Clarkson (Chair)]: And thank you also, Jack. You both have sent this electronically, which is great. Absolutely. Know. And we would encourage everyone to send their their pepperoni electronically to Kiara our.

[Senator Randy Brock (Vice Chair)]: So thank you, madam chair. LexisNexis, is it David Broker? Who are I'm dealing with what David Weeks here for LexusNexus, a Relix company. LexusNexus is a data broker and it's been registered as a data broker in Vermont since the state enacted the registry in twenty eighteen, twenty nineteen. Also registered in California, Oregon, Texas, the other states with state and local registration requirements. There's been quite a bit of discussion about California, how it relates to H2A11, and I wanna dig into that. I think it's important to remind the committee that the California Act was passed after California had enacted and implemented the California Consumer Protection Act, CCPA, that's their omnibus consumer privacy bill. Last year, the Senate passed S-seventy one, which is a similar omnibus bill, and that bill does include a deletion. Right. Unlike California, though, however, the California law, and I pulled this up, really does, I think, leave some uncertainty because it allows a deletion mechanism for information that is collected from the consumer. And so could be argued, right, that that may not apply to data that's sold by a data broker because they haven't collected it directly from the consumer and they've gotten it from another source. SMB one, however, is different because it it allows information a consumer to request information that's deleted, first of all, for any company, not just a data broker. It could be for the local hardware store, a big box store, or for a data broker. And it's information that those businesses hold about the consumer. So first of all, we've kind of in s 71 solved for some of that ambiguity.

[Senator Alison Clarkson (Chair)]: But that is a separate bill. So let's just go if we can Understood.

[Senator Randy Brock (Vice Chair)]: I'm just ordering operations here. That is that's why California We

[Senator Alison Clarkson (Chair)]: don't know what's happening.

[Senator Randy Brock (Vice Chair)]: We need to wait on that

[Senator Alison Clarkson (Chair)]: bill as we And and my client is supportive of

[Senator Randy Brock (Vice Chair)]: that 71 status by the senate and and including We appreciate it. Of that ration. Yeah. Also on California, don't know if the committee has any plans to hear from Cal privacy, but I do wanna quote from the Cal privacy attorney who testified in house as it relates to some of the exemption language in the federal privacy of language. And and and this is California's attorney Elizabeth Allen.

[Senator Alison Clarkson (Chair)]: So I was GLBA exemptions here.

[Senator Randy Brock (Vice Chair)]: Yeah. Essentially, my client is comfortable with the California Delete Act because it cross references all the exemptions that exist in the underlying system for GLBA, PPPA, and HIPAA. And we primarily operate in the identity verification, fraud prevention space. Our clients are financial institutions, banks, insurance companies used to support their operations. So if you've logged into a financial institution, you've gotten a pop up that says, hey. We wanna make sure it's actually Alison Clarkson logging in. What address have you lived at when you were four and five years old? That's a Lexus, you know, it's a product. Of course,

[Senator Alison Clarkson (Chair)]: one has to then remember. Where are

[Senator Randy Brock (Vice Chair)]: you living? You have to remember, yes. But it's really critical that they that that information is there. We also act as the intermediary between the Vermont DMV and the auto insurer. So when you're going to underwrite an insurance policy, that insurer is gonna wanna know what your motor vehicle history is. They pull that report from a data broker like Lexus Nexus to make sure that we know whether or not you have 10 speed tickets, couple of accidents. And it's important that information is not deleted for the accuracy and appropriate pricing of those policies as well as the underlying insurance, pool as the previous witness had indicated. And so that is the sort of what That's data for good. Yeah. If we're good. Exactly.

[Senator Alison Clarkson (Chair)]: We're Like, I'm members of the conference. It's Stanford this weekend. AI for good.

[Senator Randy Brock (Vice Chair)]: Yes.

[Senator Alison Clarkson (Chair)]: Good. Data for good.

[Senator Randy Brock (Vice Chair)]: And so just going back to the the privacy attorney, what she had said in the house was to the extent that the data is covered by GLP, it is not covered by us, us being meaning Cal Privacy and the Delete Act. So it will forever not be able to be deleted under the Delete Act for good reason, because you need a credit check. You need an IV check. So they have contemplated this, and they have acknowledged that there are long term uses of data. And I know that there was some discussion about payday lenders. I just want to remind the committee that payday lenders have actually been in the State of Vermont since 2001, so A plus. You have solved that. Yeah.

[Senator Alison Clarkson (Chair)]: We did that way before my time. Not actually, not way before.

[Senator Randy Brock (Vice Chair)]: Much of the data that last census relies on is publicly available information, and held in a robust client's framework that includes contractual controls, technical restrictions, credentialing, and ongoing audits. So anytime there's a new customer for LexisNexis, they go through a credentialing process. We wanna make sure that they are we understand what they're gonna be using that data for, and and we have audit functions to make sure that that is actually what is happening. We will cut customers off if they are not utilizing it for the municipal purposes. GLVA, DPPA all have permissible uses.

[Senator Alison Clarkson (Chair)]: And DPPA is behind me. Driver's Privacy

[Senator Randy Brock (Vice Chair)]: and Protection Act. And so that's Right. That's what governs when Yeah. Lexus goes to the Vermont DMV and wants to get those motor vehicle history reports. They have to sign a contract. It is a very robust document. It inflicts a litany of different requirements about what that data is used for, who it can be shared with, and what can't be used for cybersecurity insurance requirements. It is pretty intensely regulated. And we and that flows through to our our customers, the insurance companies, for example. And so it is limited in terms of how that how and where that information can be used. And so that would be why we would argue for a TPPA. It's data regulated by TPPA, by extension, by the Vermont DMV contract for TPPA data, but that would not be subject to deletion request. Because as much as I would love to delete the speeding ticket on my history when I go to reapply for my auto insurance, I don't think that's actually appropriate and nor would

[Senator Alison Clarkson (Chair)]: it Well, it's a transposed to the risk to risk reduction that Sean Exactly.

[Senator Randy Brock (Vice Chair)]: It's not accounted for in this bill. And I I just wanna talk a little bit about the sort of use case structure that's included here. This would be a novel approach. First of all, California is the only state that has passed the Stored Pollution Mechanisms for ASL. Specifically, they have utilized the data level, not entity level exemption. So data covered by GLPA, not entities covered by GLPA. That's policy to serve previously. Well, And it's not turning up here. You're on the The the nature of the use case exemptions, which we haven't seen anywhere else, is that it is a static Right? So these are It's right. It's a a static use at risk. Right? So we argue that there are many valuable exemptions in that use case framework here. The challenge is even the House Congress Committee is they were contemplating what should be involved in those that use case. Within the last twenty four hours of before the bill moved out of committee, there was there was at least one use case that was added. You know, how many other use cases are out there that we aren't necessarily taking out in this committee process kind of challenge, as was Sean Nellen did? You can always come back and add that, but that will translate into consequences. So when a data broker receives Oh, our bill. Yes. Understood. And I appreciate that balancing act. Right? We're trying to figure out where how are we not disrupting the legitimate use of data as the AG's office spoke to that are driving and protecting consumers when they are going to transact in the marketplace. And we feel like this bill does not strike that balance by sort of limiting it to use cases who are anticipating the future that you may wanna come back and add those at a later date rather than sort of

[Senator Alison Clarkson (Chair)]: going You have a proposal.

[Senator Randy Brock (Vice Chair)]: Yes, having shared What is your proposal? I have sort of two proposals. First, think, would be the simplest would be to align this with California, but provide those data level exemptions, GLPA, DPPA, and CAVA. That would create a compliance understanding. And the second would be, I think, the changes that are made earlier in the development changed to the definition of data broker, the reporting requirements, that data brokers are required to register sooner than a year after they've been in business. All of that makes sense. It's during breach notification, and it's pages. All of that's fine. Our our real issue You're really exceptions. Yeah. Case approach. We do have some concerns with the segregation language. Just doesn't quite fit with how GLBA and our clients' infrastructure And that's in also in the exemption. Also, well, it's just below the exemptions. I'm happy to follow-up with specific language. But yeah. So I think you could move forward with amending that definition before On the whole,

[Senator Alison Clarkson (Chair)]: you support this bill with us reviewing and looking at the exemptions with with data level exemptions and GLPA. Disaggregation exemptions, and there's

[Senator Randy Brock (Vice Chair)]: I think we have a concern, and you may wanna hear it from an organization called Coalition for Census Public Records Access. What? Coalition for Census Public Records Access. I don't know if they reached out, but the definition publicly

[Senator Alison Clarkson (Chair)]: available information reached out, but if you wanted, you know, that's what The

[Senator Randy Brock (Vice Chair)]: definition of publicly available information available is kind of it lays out what publicly available information is. That is Right. A good definition, but then it does a whole bunch of, well, but it's not this, this, and this, and including when an inference is made, if there are person management concerns, gets back to IMS and Sarelle, and would be much better positioned to talk about this. But the large what I would really like to focus on today are those exemptions. So yes, if you're able to align the exemption from the deletion request with what's in place in California, we would be much more comfortable with this. Alternatively, I think it would be better to get started with anomalous consumer privacy, understand that that is somewhat up in the air, but that does, as I mentioned, again, provide that solution mechanism, just not for data brokers for everyone, and it would be more appropriate to certainly forward with anomalous privacy. You could take the amended definition of data brokers, the reporting requirements, security or adjudication, and move forward with that. I think it's a little bit of putting in the cart before the horse with respect to getting report back in the state looking forward to a sort of universal dilution mechanism, as previous reps said in the data. It's fairly small universal folks that are probably gonna go to every one of the 100 or so Does that

[Senator Alison Clarkson (Chair)]: it allows them to do it,

[Senator Randy Brock (Vice Chair)]: at least. It does. Question sort of And and more sense to look at California and when that we've been piggyback on them and take advantage of the good work that they have done in this space versus Right.

[Senator Alison Clarkson (Chair)]: For governor Thomas.

[Senator Thomas Chittenden]: Well, your testimony is really helpful. One thing that I see in it that I don't recall you saying that just is compelling for me to continue to support looking at these exemptions is that you state every one of the 19 states that enacted a comprehensive omnibus privacy statute include exemptions for data regulation or FCRA, JLPA, NDA, NDA, that I would not want an outlier in that regard. That's quite compelling. And last piece, your third one, I don't see what change you're asking for for fraud prevention, but you raise a point of view that if we allow for this deletion of this data that's protected under these federal lights or even like carve out, as I think a term was used, my concern is the people that might most often take advantage of this would be fraudsters, the ones that would wanna mask or hide or otherwise conceal activities that they have so that entities like Lexus Nexus could then reveal the fact that they had already operated in in malicious or bad ways. So I don't know how that translates to changes you're asking for in the bill, but I see the concern that you're raising in item

[Senator Randy Brock (Vice Chair)]: number three. Yeah. Think one would have essentially tried moving forward with that GOP level extension. It would allow us to maintain the data to protect against such types of the various activities. So the other services that provides is preventing track down poaching international factors you are involved in. You might be on the anti money laundering list, a foreign actor that is trying to conduct international transactions. All of that is prevented by the products and services that LexisNexis offers. And we really don't wanna make sure that there's a obvious summits and a consequence if if you go to apply for a a new mortgage, right, and your data is annotationally deleted the data that the financial institution may want to move into and make sure you're a good candidate for that.

[Senator Alison Clarkson (Chair)]: You can always then provide it, but you're right. That is where we need for data.

[Senator Randy Brock (Vice Chair)]: Yeah, but the, you know, terms

[Todd Davis, Assistant Attorney General]: of, right, from the studio, I'll talk

[Senator Randy Brock (Vice Chair)]: about that, but banks are gonna want to rely on third parties and not just on any individual walking across a couple of country, walking out the street and say, Here's my information. They're gonna rely on services to provide information. And the key The challenge with the deletion mechanism, if it's not routed appropriately, is we're all familiar with credit freezes. We wanna make sure that someone else is going directly. That's pretty easy to turn off. You can understand that all the different credit reporting agencies and and turn it off. But once you unfreeze it, the information's still there.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: If you

[Senator Randy Brock (Vice Chair)]: have deleted the information, the provider, whether it's LexisNexis or another institution in that space, it's not like you just go and pull it out of the trash or the heat

[Senator Alison Clarkson (Chair)]: our time, you wanna say thank you to Dylan. Dylan is here. We can have Dylan back on it and go to the thank you very much for this. Very helpful. Chris, we're gonna hear from you, and then we're gonna hear from Matt, and then we're gonna take a break. So Chris and Matt, welcome. Chris, welcome for

[Chris D’Elia, President, Vermont Bankers Association]: Good morning, madam chair. Any members for the record? Christina, you're pressing it for my bank.

[Senator Alison Clarkson (Chair)]: Your testimony that we we

[Chris D’Elia, President, Vermont Bankers Association]: I I am care, please. From bullets, but I could break those bullets into If

[Senator Alison Clarkson (Chair)]: you would send them to care, that'd be great.

[Chris D’Elia, President, Vermont Bankers Association]: So my testimony will be a bit shorter because Dylan would great job of paraphrasing some of what I would have said. Let me get right to the point is that we support a comprehensive privacy bill. We supported it since 2018 when discussions began, and we support a bill that would, if you will, address or modernize the date birth statute in Vermont. Right. That's pretty much

[Senator Alison Clarkson (Chair)]: what this does. Well, however,

[Chris D’Elia, President, Vermont Bankers Association]: we don't believe there's some provisions in 02/11 that we do have some concerns. I will say under the definition of date of birth, it does not include a bank. We're not selling, we're not leasing information. You've heard a lot about brand lease liability, but one thing we've not heard about is the fact that Vermont has one of the strictest comprehensive privacy regulations in the country, aside from California, and that was promulgated by the Department of Financial Regulation back in 2000 That and not only impacts your state chartered banks, but every bank that does business in the State of Vermont, as well as other entities that would be department regulars. That's an opt in provision, so we can't do a thing with your data unless you consent to us to be able to do something with it. That said, we do rely on third party providers to do our work, to do that level of due diligence when you can access a product or a service. And the concern that we have is if those third party providers don't have the data on Thomas Chittenden, and he comes in to try and access financial services, Thomas doesn't exist with that data broker, we can't do our job in order to serve Thomas. That's a reality that I think is present under this bill. While the committee upstairs tried to come up with the use case scenarios, I agree 100% with the owner stat them. And they are going to evolve over time with new products, new services, and new technologies, which means we're gonna have to come back here on a regular basis to try and update statutes for new use case scenarios that have developed in the marketplace. It doesn't sound very practical, and knowing the legislative process at times is not very timely to be able to respond to what's happening in the marketplace. So what we would ask you to do is we would ask you to pass a bill that deals with the definition of data broker as developed by the House Commerce Agency, that deals with the issues of the registry and the information that would be collected, deals with security breach, language that's in there, deals with the study on data deletion or minimization. But that deletion section, we, any other definition, we believe needs to be done within S-seventy one with a competent, the private label.

[Senator Alison Clarkson (Chair)]: We're gonna have to function separately from S-seventy one. I mean, we have no idea if and how it's gonna. I appreciate that, Matt. It's always really, we're dealing with what we're dealing with right in

[Chris D’Elia, President, Vermont Bankers Association]: this book. Then I think you're taking a very small step that has potential for creating confusion in the marketplace with only addressing data brokers for the deletion mechanism. The deletion mechanism should be across the board for anybody who's dealing with it, with the collection of the data that's out there, our consumers. And it feels like we're gonna be piecemealing it, and I respect and understand what you just said about F71. And I would hope we could get ahold of the finish line.

[Senator Alison Clarkson (Chair)]: I am hoping this will all be hand and glove. All three data bills will be hand and glove to work together. But until we get to that moment, I think we really have to deal with each one, each bill on its own.

[Chris D’Elia, President, Vermont Bankers Association]: So, again, we would say those two, three provisions that are in this bill, we would not support going forward with this. But the other sections, we would see no problem with those advancing into. Happy to answer questions or come back at any point. Right. Leave me in the hallway.

[Senator Thomas Chittenden]: Written testimony would be fabulous.

[Senator Alison Clarkson (Chair)]: Yeah. I think I would appreciate you sending that. Thank you, Chris. No problem. Any questions for Chris? Right. Matt, we're gonna shift to you, and you We welcome you. You are testifying. You are a Consumer Reports person.

[Matt Schwartz, Consumer Reports]: That's correct. Can you hear me okay?

[Senator Alison Clarkson (Chair)]: We can. We can even see you. And where are you testifying to us from?

[Matt Schwartz, Consumer Reports]: Washington, DC.

[Senator Alison Clarkson (Chair)]: You're in D. C. Great.

[Todd Davis, Assistant Attorney General]: Yeah.

[Senator Alison Clarkson (Chair)]: Welcome.

[Matt Schwartz, Consumer Reports]: Thank you. So Chair Clarkson, members of the committee, thanks for inviting me to testify today. My name is Matt Schwartz. I'm a policy analyst with Consumer Reports based in D. C. CR strongly supports H2-eleven. Consumer Reports is an independent nonprofit and nonpartisan organization. We work with consumers to create a fair and just marketplace, and we have members spread across every state, including in Vermont. So for years, CR has advocated at the federal and state levels for the passage of data privacy legislation that is as workable and protective as consumers as possible. Data privacy is a top concern for CR members. It's becoming even more so as more of the products that we review become connected to the digital world. And before I discuss kind of elements of the bill itself, I think it's important to understand why this legislation is so important to begin with and why an organization like Consumer Reports cares so deeply about it. And it really comes down to this. Data brokers are increasingly weaponizing personal data against consumers in ways that are impossible to anticipate and leave consumers with very little recourse once they realize it. As you've heard, data brokers are entities that aggregate extensive dossiers about virtually every American. They include thousands of data points, including extremely granular information about our behavior, as well as data brokers' inferences about us based off of this information. This information sold and resold often for marketing, but for a variety of other purposes as well, eroding our basic expectation of privacy in the process. And I have three quick stories to illustrate the types of harms that make this legislation so important to pass in the first place. The first story comes from The New York Times' reporting around a year ago or so. Major car companies like GM and Ford were caught secretly collecting and sharing people's driving behavior, which included how hard they braked, how fast they accelerate, and their precise geolocation information with data brokers. The data brokers then shared this information with insurance companies, who in some cases raised people's premiums based off of this information that consumers never knew that they had allowed their car company to share with data brokers in the first place. Nobody should have to pay more because a third party secretly collected and shared their information, but that's exactly what happened. The second story is about the ubiquitous sale of our location data. Zach touched on this a little bit, but there's a whole marketplace of data brokers that specialize in collecting and selling our every move, collected primarily from the GPS trackers on our screen, which can reveal our visits to sensitive locations, like reproductive health facilities, political rallies, religious facilities, and more. This information is collected and shared as often as every three seconds, and it doesn't take a huge leap to understand how this information being available to anyone with a credit card can put people at risk and enable stalkers, law enforcement, or others to track people down. And when this information is leaked, it can cause huge financial losses for consumers. Recently, Congress's Joint Economic Committee released a report that revealed that consumers lost an estimated $20,000,000,000 from just four recent data broker breaches. And the reality is that there have been far more breaches than just those. Third, it's important to understand how even more run of the mill data broker activities can put consumers at risk. Data brokers use their digital dossiers on consumers to make incredibly invasive inferences about them. They sell lists of consumers sorted into categories like, quote, rural and barely making it, or, quote, credit crunched, city families. As Zach touched on, another data broker was selling lists of people battling Alzheimer's disease. These lists are a gold mine for payday lenders, scammers, and other third parties who wish to target particularly susceptible consumers for scammy financial products. That's why we're glad to see the committee consider H2-eleven, which would provide Vermonters more transparency and more control over how their personal information is used by data brokers, including the ability to delete it. Obviously, this bill started off a little stronger in that it included a universal deletion mechanism that would have created that one stop shop mechanism for consumers to delete their personal information from data brokers. That was removed in the House side due to concerns from the Secretary of State, as you heard today, about the short term feasibility of that. Totally understandable from our perspective, though we are hopeful that there's still a path to this in the near future. And it's probably also worth knowing that Vermont is not out on an island in consideration of this type of legislation. In fact, a very similar effort in Connecticut led by Senator Barone, who was the original author of the much cited Connecticut Data Privacy Act, which is the one that S-seventy one was based off of, has already made it to the Senate floor

[Senator Alison Clarkson (Chair)]: and

[Matt Schwartz, Consumer Reports]: has a very good chance of passing. In New York, Governor Hochul included a similar Delete Act style proposal in her budget request, and Rhode Island is considering similar legislation as well. So then in terms of the kind of text of the bill itself, the main thing I wanted to cover is this discussion of entity or data level exemptions versus the use case based exemptions that are currently in the legislation, and particularly how those things relate to financial institutions, which you've already heard about today. So, you know, from the consumer perspective, would say that giving people the choice to erase their personal information collected by data brokers that can be used to make important financial decisions about their lives is actually one of the strongest overall arguments in favor of this bill. If a financial institution wants to pull credit report information from a data broker to help underwrite a loan, of course, that should be no problem. The bill already currently exempts credit reporting agencies who furnish credit reports to others, including financial institutions. But that's recognizing the fact that there's already strong consumer rights available under FCRA. Nobody thinks that consumers should be able to erase their credit report, and that's not really what's at stake with this bill. But data broker data that isn't credit reporting information is almost entirely unregulated. That means there's none of the consumer rights that are associated with FCRA, including the right to access this data broker data, the right to notice when you receive an adverse financial decision against you, and the right to dispute inaccurate information. And it was for these very reasons that during the last administration, the Consumer Financial Protection Bureau had actually begun a rulemaking to bring data brokers entirely under the auspices of FCRA and provide folks with these consumer rights. But that rulemaking has since been abandoned, and it doesn't appear that data brokers are going to be regulated in a comprehensive way, at least at the federal level, anytime soon. And that is a problem because data broker information, unlike FCRA data, is of wildly varying quality and can come from just about anywhere social media posts that are scraped from the internet, outdated public records info. And like I mentioned before, oftentimes this data is just inferred, or in other words, guessed by data brokers. As one witness on the House side shared, this can often lead to junk data profiles about people. In one recent study, data brokers only correctly predicted an individual's gender 26.5% of the time, which is obviously far worse than the benchmark of simply guessing. That

[Senator Alison Clarkson (Chair)]: is pretty bad.

[Matt Schwartz, Consumer Reports]: So by definition, as Zach mentioned, consumers had no say over this information being collected in the first place. And so it only seems reasonable that they should, at bare minimum, have the ability to delete it. And that's especially true if it's then going to influence important financial decisions that are being made about them. Of course, that's not to say that all uses of data brokers by financial institutions should be prohibited. Like we've talked about already, there's broad exemptions for fraud prevention, identity verification, and to comply with legal requirements. One thing that hasn't been mentioned yet today is that this bill also completely exempts data brokers who act as processors or service providers for other businesses, including financial institutions. And so the fact is that a lot of ways that financial institutions currently use data brokers have already been contemplated and exempted in this bill. But what the bill would not do is provide an entity level exemption to financial institutions, which would allow them to use data brokers without restriction. Instead, the bill has those fairly broad use case based exemptions. They would allow data brokers to retain information for a wide variety of purposes, but it would least ensure that that data that's retained for an exemption can't then be sold behind consumer facts for unrelated purposes. And that seems like a fair trade off to me. So, I'll wrap it up there. Thanks again for inviting me, and I welcome any questions.

[Senator Alison Clarkson (Chair)]: Matt, thank you very much. I appreciate you sticking around. You be kind of, because I don't have your testimony printed out, so would you be kind of just send your testimony to Kierra Mead, our committee assistant? That would be great so that we can post it. Any questions for Matt? David? Go ahead. Great. Thank you. Thank you very much. We really appreciate you weighing in as we do for everybody because it's giving us a fairly balanced view of this and and the concerns people have. So thank you. We're gonna take a break. We'll be back in about ten minutes. We're gonna start in about ten or eleven. Is that okay, Thomas? Yeah. Good. Does that that give us a moment to stand up and stretch? Thank you.

[Todd Davis, Assistant Attorney General]: Thank you.

[Senator Alison Clarkson (Chair)]: Okay. So alright. Thank you. Thank you for sticking. Brian, thank you for sticking. Offline, please.