Vermont Legislature SmartTranscripts:

[Sen. Alison Clarkson (Chair)]: Hello, everybody. We're gonna start well, welcome to the Senate Economic Development, Housing, and General Affairs. It's good to have you all with us. Lots of new faces. So it is oh, what day is it? It is Wednesday, April 22. And today we're turning our attention to consumer protection bills, our data broker bill, and our ticket resellers bill. So I think given all the new faces we have in the room and, Rick, I keep feeling like I've seen you who we've met before. I think with me, but, anyway, you're just such a familiar face. Let's introduce ourselves, and then we'll start.

[Sen. David Weeks (Clerk)]: Good morning. Dave Weeks, representative of Butler County.

[Sen. Alison Clarkson (Chair)]: Randy Brock, Franklin County in Northern Grand Isle. Alison Clarkson, Windsor District.

[Sen. Thomas Chittenden (Member)]: I'm Tom Chittenden. I represent the Southeast Area Chittenden County in Kesha Ram Hinsdale from the same district.

[Unidentified committee interjections (overlap/misattribution)]: And

[Sen. Alison Clarkson (Chair)]: she should be joining us at some point. And we welcome everybody online as well. And Tracy, we're going to start with Tracy Laughlin, who we have online. Welcome, it's good to have you.

[Tracy Laughlin]: Thank you. Yes, it's good to be here. Can you all hear me okay?

[Sen. Alison Clarkson (Chair)]: We can hear you, we can even see you.

[Tracy Laughlin]: Excellent,

[Sen. Alison Clarkson (Chair)]: great. I know, astonishing. Welcome, introduce yourself and go for the doctor.

[Tracy Laughlin]: Okay, my name is Tracy Laughlin. I'm managing director of privacy and government relations at the National Student Clearing House. I really appreciate this opportunity to speak to the committee today about H211, the data broker bill. Should I go ahead and dive in?

[Sen. Alison Clarkson (Chair)]: Dive in.

[Tracy Laughlin]: Okay, great.

[Unidentified committee interjections (overlap/misattribution)]: Tell us what

[Sen. Alison Clarkson (Chair)]: you do. Does national student? What do what do what do you do? What does your company do?

[Tracy Laughlin]: Yes, yes. Well, that is where I was going to start. So the National Student Clearinghouse, we've been serving the education and workforce communities as a nonprofit organization for thirty three years. Thirty three years this month actually. Our mission statement is to serve the education and workforce communities and all learners with access to trusted data related services and insights. So we're a data services nonprofit company serving the education community and also employers as well, which I'll get into. We were started in 1993 to solve a very particular problem in the student loan industry. At that time, you may know, probably do, that in the federal student loan programs, a borrower does not have to begin repaying their loans until they are out of school. So if they're in school they get what's called an in school deferment. Well back thirty three years ago in the guaranteed student loan days there were hundreds of lenders in the federal student loan programs and thousands of institutions of higher education and it was very cumbersome for all those thousands of institutions to report their enrollment to hundreds of lenders and cumbersome for the lenders to receive that data from thousands of institutions. So they created what was then called the National Student Loan Clearinghouse. We changed our name a few years later, but they created the clearinghouse to solve that problem. And we still do this today, even though new student loans for the last sixteen or so years have been originated by the US Department of Education as direct loans, but we still receive enrollment data on a regular cadence.

[Unidentified committee interjections (overlap/misattribution)]: Right,

[Sen. Alison Clarkson (Chair)]: Tracy, I just interrupt to ask the Yes.

[Unidentified committee interjections (overlap/misattribution)]: What's

[Sen. Alison Clarkson (Chair)]: the length a student loan takes to repay? Sixteen? You just mentioned that, so I'm just curious.

[Tracy Laughlin]: Yeah, I don't actually know the answer to that. It's over ten years, I know. I mean, the standard used to be ten years. I don't actually know what the standard is, but the service we provide is we receive that enrollment data from institutions and then report it to the Department of Education. And we still have some legacy federal student loan and we serve also private student lenders as well, should say. The Vermont Student Assistance Corporation is partner of ours, an entity that we serve in this way. So I could certainly find out that information for you if you'd like.

[Sen. Alison Clarkson (Chair)]: Just be interesting. Sorry, keep going. You said sixteen years and I thought, really? Is it only sixteen years?

[Tracy Laughlin]: Yeah, I think it was the legislation in 2010, I believe, or 2009 or 2010, where it was moved to 100% direct lending. But there's still legacy guaranteed student loans out there, so we still do serve that and private loans as well. But since then, we've expanded to many other services. We do degree verifications is a big one so that, for example, if Jane Doe, who's a graduate of the University of Vermont, is applying for a job and that employer wants to just verify that Jane Doe actually does have a degree from the University of Vermont, so University of Vermont doesn't have to respond every time an employer asks that question. They send us their degree data and we respond on their behalf. That's free to the institution. We do charge the requester. So I should say, just to give you an idea of the scope of our enterprise, if you summed up all the degree granting Title IV institutions in The United States summed up all their student enrollment, we have over 95% of the enrollment data on those students and over 95% of the degree data on those students. So, the vast majority of institutions of higher education in The United States use the Clearinghouse, including the vast majority in Vermont. We also do enrollment verifications, so if a business, for example, wants to give a discount to a student, but they want to make sure that individual actually is a student, they can use our service to do that. We also have a research collaborative, so about fifteen years or so ago, Clearinghouse realized that all this data that we have has research utility. So we publish aggregate reports. They're available on our website. They're cited in the press quite a bit about student enrollment and trends in student enrollment and completion and persistence and those sorts of metrics. We also have a service called Student Tracker where a high school or community college or any institution that wants to know what was the subsequent educational pathways of their graduates. Did a high school graduate go on to get a bachelor's degree? Did a community college graduate go on to get a bachelor's degree, for example, or even enroll in further education? They can find out that information. We provide that consistent with FERPA. I should say this is all governed by the Family Educational Rights and Privacy Act. We are a school official under FERPA, and that's important for the purposes of H2 11, which I'll get to in a moment. But we received this data under FERPA, education records can only be disclosed with consent of the student or if an exception applies. One of the largest exceptions is the school official exception where the institution can send us data and we perform a service they would otherwise use employees for, but the data has to be under their direct control. Their use and maintenance has to be under their direct control. So we charge for the verifications and the student tracker reports. And for that reason, we fall under the definition of a data broker in Vermont. We don't qualify as a data broker in any other state, and I should say the vast our business model is not the buying and selling of consumer data without consumer knowledge or meaningful accountability. And we're not a for profit entity, we're a five zero one(three) nonprofit, we're mission driven and we're a service provider to the education and workforce communities. And our use of data in these services is very transparent. You can find out about what our services are and how we use data in those services on our website. So we're very upfront about it. For these reasons, we believe the clearinghouse should be exempt from the definition of data broker in Vermont. However, we realize that that's not something that's on the table at this time. What we're asking for is a more modest request, and we've been working with Representative Priestley and Legislative Council, Rick Segal on developing an exemption. I think we've landed on some mutually agreeable language, which of course I'm happy to share with the committee. I wanted to share these concerns so you'll understand the background.

[Sen. Alison Clarkson (Chair)]: We appreciate it and we don't yet have much counsel here. I'm not clear if he's coming or not. Okay, we're finding out where he is. We're Okay. As we funnel towards the end of session, our modest legislative council staff, as you all know, we have no personal staff here, and we share

[Sen. Randy Brock (Vice Chair)]: Right.

[Sen. Alison Clarkson (Chair)]: Council staff and joint fiscal staff, and they're spread very thin at this time of year. So we, he will have language, have you worked with him on language?

[Unidentified committee interjections (overlap/misattribution)]: Yes, yes. Okay,

[Tracy Laughlin]: he And will if I could just discuss the two reasons for the language, it's essentially expanding the data processor exemption so when a consumer requests deletion, there are some exemptions in the law that data brokers can retain the data. And the reason for us expanding on that exemption is we don't want there to be a conflict with FERPA. Because as I mentioned, FERPA, the school official exception under FERPA requires that the institutional data provider still be under, that the data be under their direct control, the use and maintenance of their data be under direct control, their direct control. And if a consumer can come along regardless of the institution's wishes and require us to delete their data, then the question is, is that institution still in control of that use and maintenance of that data? The second reason is it would negatively impact the institutions and students we serve if an individual comes along, they don't really take the time to understand what the clearinghouse is about. They just say, Oh, data brokers, I want to delete all the data that's held by all data brokers. And then we don't have their data when it comes time for them to get a loan deferment or a degree verification. Those services would be disrupted, delayed or even denied perhaps if that data is deleted from the clearinghouse. So those are the reasons we've asked for the exemption and we've worked with Rick Sagal and Representative Priestley as well. And I think we've landed on some, in a good place that's mutually satisfactory.

[Sen. Alison Clarkson (Chair)]: Great, terrific. Thank you. He's headed over and we will look at any new language that's been developed by anybody here in the moment. We'll look at at the end of testimony. We'll go through that. Thank you. Any questions? Anything else, Tracy, before we ask questions?

[Tracy Laughlin]: No, I don't think so.

[Sen. Alison Clarkson (Chair)]: Where are you headquartered?

[Tracy Laughlin]: Yes, we are headquartered in Herndon, Virginia, near in the DC area.

[Sen. Alison Clarkson (Chair)]: Got it. Great, thank you. Randy, you have a question? I do. Just talking

[Sen. Randy Brock (Vice Chair)]: about the business model that you have, you mentioned that if someone wants a degree verification, you provide it for a fee for the institutions, is that right?

[Tracy Laughlin]: Not for the institutions, for the requester.

[Rick Gardner (LexisNexis Risk Solutions)]: It's free

[Tracy Laughlin]: to the institution, if a background screener that's working on behalf of an employer or we an employer do charge there. That is a part of our revenue.

[Sen. Randy Brock (Vice Chair)]: What do you charge?

[Tracy Laughlin]: It's a modest fee. I would have to go back and look, I want to say it's, I should know that, but it's less than $20 I believe per verification.

[Sen. Randy Brock (Vice Chair)]: Did the institution refer the person to you?

[Tracy Laughlin]: No, no. We do it on their behalf. So the screener or the employer comes to us and we

[Sen. Randy Brock (Vice Chair)]: How would they know to come to you?

[Tracy Laughlin]: Well, I mean, institution will, in the first instance, they will let the big background screeners know to come to us. The employer, they would refer, they may contact the institution, but the institution would refer them to us

[Unidentified committee interjections (overlap/misattribution)]: and then we would change.

[Rick Gardner (LexisNexis Risk Solutions)]: To you. Yeah.

[Sen. Randy Brock (Vice Chair)]: Just curious in terms of institutions in Vermont, do you represent most or many of the colleges in Vermont?

[Tracy Laughlin]: I would say the most definitely. I could certainly get you the exact list of which institutions, but the majority, would even venture to say the vast majority are gonna use the clearinghouse for both the enrollment reporting and the degree verifications. And in fact, the Vermont Agency of Education has used our student tracker. I believe they're still active. Student tracker service I mentioned. One thing I didn't mention is diploma verification. So that's a relatively newer product. We've had it for a little over five years, I believe now. And some school districts in Vermont will use, and private schools and individual schools will use the Clearinghouse for employers to use, employers will come to the Clearinghouse to verify the diplomas, high school diplomas as well for employment purposes.

[Sen. Alison Clarkson (Chair)]: As workforce, as we re embrace career and technical education and have more certificates and apprenticeship certificates, are you also recognizing those which are like diplomas, but not technically?

[Tracy Laughlin]: Yes, if they're offered by institutions of higher education, most of those are in our system to be verified as well. Yeah. Of the, we have a small program, we're hoping to enlarge it, but we do have a small program for workforce credentials or industry credentials, non traditional credentials, so we're certainly aware that

[Sen. Alison Clarkson (Chair)]: That would be great to build, Thomas.

[Tracy Laughlin]: Yes, yes, yes, that is something we've been looking at and

[Sen. Alison Clarkson (Chair)]: Great, we encourage you to expand that. Thomas, that's

[Sen. Thomas Chittenden (Member)]: a Trace, I'm fully supportive of this language. One note I'd add, I currently represent the Vermont State Senate on the New England Board of Higher Education, and I don't know if you're familiar with that organization, but there are about seven of them that regionally coordinate education advocacy and policy aspects. So if you haven't connected with them, it might be useful to do so as other states look at these same laws. A lot of legislation coming from NEBBI can be a very useful thing. So maybe that's already on your radar, but might save you some time down the road and get more of these states to adopt the same type of language that meets your needs for this purpose.

[Tracy Laughlin]: Yes, thank you. I am familiar with Nebby. In an earlier life, I worked for a New England Senator, US Senator, and actually interacted with Nebbe a few times in that capacity. So that's a good suggestion, I appreciate that.

[Sen. Alison Clarkson (Chair)]: Great, terrific. Thank you very much, any other questions? Thank you, Tracy. We'll have Rick in a bit.

[Tracy Laughlin]: Okay, excellent.

[Sen. Alison Clarkson (Chair)]: I take it from Sarah. I am. Well done.

[Tracy Laughlin]: You have a good day, bye bye.

[Sen. Alison Clarkson (Chair)]: Yes, thank you. Stay with us if you want to continue with the conversation. We're happy to have you.

[Tracy Laughlin]: Okay, I'm afraid I have a previous

[Sen. Alison Clarkson (Chair)]: You might actually have other things to do, we get that.

[Tracy Laughlin]: Yeah, but I Thank appreciate

[Sen. Alison Clarkson (Chair)]: you so much.

[Tracy Laughlin]: Yeah, thank you, bye bye.

[Sarah Odes (Consumer Data Industry Association)]: Sarah, welcome. Thank you, good morning, my name is Sarah Odes and I'm Vice President of Government Relations for the Consumer Data Industry Association. We are the trade association that represent the credit bureaus and background screening companies, And I appreciate the opportunity to speak with you today regarding H2 11 as it's currently drafted. At the outset, I'd like to address what I believe is a fundamental misconception underlying this bill, and that's that the term data broker has a negative connotation. There are lots of different types of companies and data uses that are captured under Vermont's definition of data broker, and companies that are registered as data brokers in Vermont play critical everyday roles protecting consumers and enabling essential services. And these are not abstract functions, they are things Vermonters rely on every day, often without realizing it. So let me give you a few concrete examples. Fraud prevention and identity verification. Every time a Vermonter opens a bank account, applies for a loan or sets up insurance policy, the institution must confirm that the person is who they say they are. That process depends on historical identity data, data that allows institutions to detect when a stolen social security number is being used or a synthetic identity is being created. That information comes from a data broker. Compliance with federal anti money laundering laws, banks, credit unions, and money service businesses are required by federal law to screen customers against terrorism and sanction lists. Those screening tools on aggregated and verified data are maintained by registered data brokers. Public safety and consumer protection functions, when a vehicle manufacturer identifies a dangerous defect and needs to locate a vehicle owner, they rely on aggregated data and data brokers to reach the right customer quickly and accurately. So a large part of what data brokers actually do is unglamorous, but essential. They're standardizing addresses, they're correcting errors in names and records, they're matching data across systems. And this is the infrastructure that makes everything else work. It's what allows hospitals to match patients to the correct medical records, credit reports to be accurate and complete, government benefits to reach the right individual. And these are just a few of everyday benefits and protections the data brokers provide. To Vermonters. H211's broad deletion framework would have real immediate consequences for consumers by degrading the accuracy, availability, and functionality of these types of services that they rely on every day. That's why it's important that this legislation include vital exemptions like those included in every comprehensive law in the country. Use based exemptions like those in this bill create gaps and uncertainty and are not the approach that are used in the other state. Comprehensive privacy laws consistently include entity and data level exemptions for the Fair Credit Reporting Act, the Grant L. H. Bliley Act, the Driver's Privacy Protection Act, fraud prevention, identity verification uses, public records. And these exemptions exist for a reason, to ensure that data systems already governed by strict federal privacy and use limitations can continue to function as needed. It's also important to note that no state has a data broker deletion right that is specific only to data brokers. California is the only state that has adopted a data broker deletion framework that has centralized the consumer's ability to request deletion. However, the California Delete Act was intentionally designed to operate alongside their comprehensive privacy statutes, the CCPA and CPRA. It explicitly preserves underlying definitions, exemptions, and consumer rights within the broader framework. Vermont is not similarly situated. Without a comprehensive privacy law in place, H211 attempts to create a standalone deletion regime without the necessary legal and operation guardrails. A more effective approach would be to establish a comprehensive privacy framework that applies consistently across all entity and data uses, including both directly collected and third party data. Finally, the requirement that data brokers maintain a $20,000 bond appears punitive and is premised on the assumption of non compliance. A blanket annual bonding requirement benefits third party sureties while imposing additional costs on compliant businesses. A more appropriate approach would be to require bonding only in cases where a registered data broker has previously failed to satisfy assessed penalties. Additionally, this bill provides a private right of action and we would request that it be consistent with the Senate position in S-seventy one that says yes to enforcement under the consumer protection law, but specifically carved out the private right of action. I appreciate the opportunity to share our perspective on two eleven and I respectfully encourage the committee to consider addressing consumer privacy protections within a comprehensive legislative framework that provides consistent, well defined exemptions and clear operational standards. Such an approach would enable consumers to exercise meaningful privacy rights across the full ecosystem of data users rather than a narrow subset of data aggregators defined in current Vermont law. So for these reasons outlined above, we respectfully ask the committee to oppose the bill. Thank you for your time and happy to answer any questions. Thank you.

[Unidentified committee interjections (overlap/misattribution)]: Betty, any questions?

[Sen. Thomas Chittenden (Member)]: Irredeemable. There's no changes to this bill that could get you to support it.

[Sarah Odes (Consumer Data Industry Association)]: There are definitely changes that could take Like

[Sen. Thomas Chittenden (Member)]: exemptions to DPPS.

[Sarah Odes (Consumer Data Industry Association)]: Exemptions that would allow, you know, FCRA, GLPA, those types of things.

[Sen. Thomas Chittenden (Member)]: Those are things that I definitely support doing. That's what that part of the conversation. So if those exemptions were in there, you wouldn't necessarily be a.

[Sarah Odes (Consumer Data Industry Association)]: It all comes down to the details, but, yes, that would that would certainly put us in a better a better light.

[Sen. Alison Clarkson (Chair)]: And our our comprehensive data privacy bill is being worked on and will be done, we hope, by the end of this legislation. So we're we're on track to do both. So thank you very much. Thank you. Yeah.

[Unidentified committee interjections (overlap/misattribution)]: Do you have a question?

[Sen. Randy Brock (Vice Chair)]: Just overall, as you look at the landscape of death privacy law, does this whole thing make sense, or is this really something that is a federal responsibility and ultimately will be, and if it is, what will happen to what we can do in the meantime?

[Sarah Odes (Consumer Data Industry Association)]: We believe comprehensive privacy is a federal issue. Fortunately, states have moved faster than federal regulations have. Well, perhaps for federal, it just will be so Correct, either way. We've always believed it's a federal issue because to have a patchwork of state laws obviously impacts commerce. And so we would prefer it to be that way, we have 21, I believe, comprehensive laws in the books right now, soon to be 23 or '24. And so that's out of the gate. But what's consistent about all the comprehensive privacy laws, that every single one of them have all the exemptions that I've noted, and they're all very similar that have been worked on with consumer advocates to ensure that the language provides most of the consumer protections as well as the continuity of operations for the companies that have to abide

[Sen. Randy Brock (Vice Chair)]: What with see about what we're proposing here with this bill and the other privacy statute as being directed? Do you see any point other than what you've described or talked to us about so far that makes us an outlier, makes it difficult for what we're proposing to be enacted without conflict with other states.

[Sarah Odes (Consumer Data Industry Association)]: I think that data deletion is in conflict and is an outlier. Your comprehensive privacy law at 71 is more in line with what is happening and I think it's the better approach to take. Data deletion, focusing on a subset, comprehensive privacy applies to all data sets, all companies that are using data and giving consumers the rights to correct, delete, be aware of what's happening and it makes a data deletion, a data broker bill sort of obsolete because there's nothing inherent about how you define data broker that wouldn't apply to a data user under comprehensive privacy law. Right.

[Sen. Alison Clarkson (Chair)]: Thank you very much. Thank you. I think we will move to Rick. Rick, welcome.

[Rick Gardner (LexisNexis Risk Solutions)]: Thank you so much. I appreciate the chair and members of the committee.

[Unidentified committee interjections (overlap/misattribution)]: Thank you for the time this morning. Good to have you. Welcome. Introduce yourself.

[Rick Gardner (LexisNexis Risk Solutions)]: Thank you, Martin. Rick Gardner, global data protection officer for Lexis Nexis Resolutions. We are a duly registered data broker in the state of Vermont and have been Appreciate that. Yes. Absolutely. And have been since the inception of the requirement. You know, what we do, you know, our bread and butter is identity verification, fraud prevention, and insurance underwriting. We got that as part of those services, you know, we fit into the, you know, the definition of data broker, which because of the way it's defined, you know, captures in a number of different types of companies. So the things I'd like to discuss with you today are, you know, just kind of some thoughts on, you know, two eleven in particular, but also just serve as a resource. Like, you know, how does this work, you know, operationally?

[Sen. Randy Brock (Vice Chair)]: I'm happy to answer

[Rick Gardner (LexisNexis Risk Solutions)]: any questions that they're based on that front. And if I may, it's kind of a a point of personal privilege. I actually spent the first ten years of my career in state government in the state of Georgia, so it's good to be back in the state house. So so that's I that. A little bit a little bit of a little little playing in there. Yes. But but in terms of some of the specific items I wanted to discuss or some of the things that have been touched on already, you know, one is, you know, right now today, you know, there are over 20 states that have, you know, comprehensive privacy legislation. In every case, you know, those those states include exemptions for these regulated datasets that we've been talking about. So FCRA, GLPA, PPPA, you know, publicly available data. You know, even the California Act includes exemptions for those particular datasets. The second component is just from a compliance standpoint. Right? If this bill were to pass at this, we would still have, say, you know, GLBA compliance obligations. So it's kinda having to to do those things, you know, kind of in tandem. And then also, and and thirdly, I think this is really the most important, the impact on everyday Vermonters, Right? So if someone were to delete their data and it was a complete deletion or removal of FCRA data, you know, GLPA data, etcetera, as a practical matter, the issues they're gonna have is when they go and open up a bank account, they go get an insurance policy, they're gonna have a really hard time doing it. I'm not gonna say it's impossible, but it's not gonna be a very smooth process because the data is not gonna be there in order to to effectuate that transaction. The other thing I wanted to discuss, again, just kinda going to as a matter, you know, how does this work from a role standpoint? So speaking for LexisNexis, some of the controls that we have in place, you know, kind of honing in on GLBA data, we require all of our customers who are utilizing GLBA data to certify to a permissible purpose, right? The data is only being used for that purpose. That's also backed up by the contracts. Right? They will say in the contract, this is the only thing that it could be used for. The services are credentialed. Right? So it is a an appropriate party and an appropriate individual at that company that's utilizing that data. And then lastly, we have an audit function. Right? So if they have said, we're using it for x, then on the back end, we're making sure that they're using the data, you know, for that particular purposeful purpose in order to ensure that that data is used appropriately. We're certainly supportive of, you know, good and comprehensive, thoughtful privacy legislation. But I think, you know, in this case, it's just the devil's in the details around some of those, in particular, you know, federal privacy laws and the exemptions of those. With that being said, I'm more than happy to address any questions that there may be. Again, how does this work? Know, kind of from an operational standpoint, happy to

[Sen. Alison Clarkson (Chair)]: be a resource on that front. So I'm just curious on your verifying permissible purpose. Is that an additional service that you offer, or is that something people subscribe to?

[Rick Gardner (LexisNexis Risk Solutions)]: So if someone is using a regulated data set, so for instance, if we're providing a service that utilizes

[Sen. Alison Clarkson (Chair)]: And and so are there regulated data sets and unregulated data sets?

[Rick Gardner (LexisNexis Risk Solutions)]: Well, yeah. Just to to clarify, when I say regulated data sets, I'm really talking about, yeah, those those federal regulations or or state regulations. Right? So I I'll be more precise. So if someone is using a federally regulated data set, which all of them may have a a state analog. Right? So such Vermont, right, the the specific laws around GLBA data. We will ensure that that data is certified to a a use

[Sen. Alison Clarkson (Chair)]: So that is with your the data you provide is that it's all been screened and is verified.

[Rick Gardner (LexisNexis Risk Solutions)]: Right, and that our customer is utilizing that data, has told us we are only using this data for a use case specifically allowed under one of these federally regulated laws.

[Sen. Alison Clarkson (Chair)]: So you already are complying with

[Unidentified committee interjections (overlap/misattribution)]: the use cases of this bill, right? To

[Rick Gardner (LexisNexis Risk Solutions)]: the extent that that use case, yes, but also to the extent that the use cases are covered under GLPA. So for instance, this bill has a an exclusion for fraud prevention, which we think makes sense and we support, is also consistent with other state privacy laws. GLVA includes a a permissible use of fraud prevention, so this is consistent from that standpoint. But there are other uses under GLBA that are not necessarily covered by the bill. So for instance, effectuating a transaction, requests by the consumer, you know, compliance with law, you know, usage of the data for, you know, internal risk assessment, you know, things of that nature. So on on the one hand, you can look at GLB data as kind of a a use case, if you will, you know, kind of base regime, but it is you have to be used consistently. So you can only use GLB data for those purposes. You can't use it for a non GLBA permissible purpose, and speaking for LexisNexis, any GLBA data that we have will only be used for a GLBA permissible purpose, and we flow that down to our customers as well, and we support that through an audit program to ensure that that's how it's being utilized.

[Sen. Alison Clarkson (Chair)]: Great. Thank you. Any questions?

[Sen. Randy Brock (Vice Chair)]: Mr. Randy? Just a basic question. You've looked at the law. You were sitting in our seats, would you vote for

[Rick Gardner (LexisNexis Risk Solutions)]: would Senator, I appreciate the question. Would say if it were appropriately amended, then yes, right?

[Sen. Alison Clarkson (Chair)]: And have you sent your have you been in dialogue at all with Rick Sagal, our legislative counsel on suggested language? Sorry.

[Unidentified committee interjections (overlap/misattribution)]: I take that.

[Sen. Randy Brock (Vice Chair)]: This is Ricky with Leon. I'm just on that with LexisNexis. We I think we'd need direction from more members of the committee to speak with the council. We we typically are not Right. Well, I'm glad you're gonna answer, so I'm just trying

[Rick Gardner (LexisNexis Risk Solutions)]: to Yeah. More than happy

[Sen. Randy Brock (Vice Chair)]: to to do that. Well, I would be interested in knowing that if there are what you consider to be flaws, unacceptable forces to know what they are. Yeah.

[Rick Gardner (LexisNexis Risk Solutions)]: Am I?

[Sen. Alison Clarkson (Chair)]: I think the GLBA piece is an exemption that you if that was addressed, you'd be willing to you you think that this might move.

[Rick Gardner (LexisNexis Risk Solutions)]: So I I would say that That's my understanding. Yeah. So the the GLBA exemption is is one of the the critical components. Also, a consistent exclusion for publicly available data lawfully obtained under Vermont public records law. Right? That's that's consistent with definition, again, under other states. For us, use a Georgia ism, it kinda all boils down to, yeah, I think kind of those three things. One is consistency across the state laws. Two, even within Vermont, we will still have know, GLBN data that we will the need to comply with and to come alongside, you know, what this law may require. And then thirdly and most importantly, you know, the impact on everyday Vermonters who fully respect and appreciate and support them having rights over their data, but it's kind of the unintended consequence. If somebody says, take a lead on my data, they may not know the practical impact of that when they go to

[Sen. Alison Clarkson (Chair)]: Well, I think that's one of the reasons we're having the secretary of state do the work they're doing. Mhmm. And not wanting to reinvent the wheel, but looking at California's data deletion portal and see how we can work with that. And, yes, because we so there is lots of data for good. We're all clear on that.

[Sen. Randy Brock (Vice Chair)]: Yes.

[Sen. Alison Clarkson (Chair)]: And I I I like your I love love your interest, though, because we are all indebted to data for good Yes. To enable our lives in many ways. Absolutely. And on the other hand, we also know of the harms that have happened as a result of some of that. So and we also have to be clear on the data that we're asking to delete. I think this is critically important. Public education on this is so important. Absolutely. Because you don't want to delete data that is gonna benefit you when you wanna buy a house or when you wanna buy a car or when you wanna do whatever you wanna do that requires a verification of who you are and why you need it. Right. Exactly. We're we're clear on that. I so my clarity is your GLBA exemption and the exclusion for publicly obtained data. Is that correct?

[Rick Gardner (LexisNexis Risk Solutions)]: Yeah. Yeah. So, again, just to be very specific. So

[Sen. Alison Clarkson (Chair)]: Be very specific. We're at the specific point Yeah. In the election.

[Rick Gardner (LexisNexis Risk Solutions)]: Absolutely. Yes. I very much appreciate that. So I know we've, you know, kinda honed in on the the GLBA exemption in particular, but so the GLBA, FCRA, Fair Credit Reporting Act, and then Drivers for Efficacy Protection Act, and publicly available thing would but, again, falling under those those same three buckets I mentioned, you know, consistency, you know, internal, you know, Vermont compliance with the Vermont law and the DOE, and then Right. Consumer impact.

[Sen. Alison Clarkson (Chair)]: Thanks. Just so Yeah. Clear. Yes.

[Sarah Odes (Consumer Data Industry Association)]: As we don't have any time to waste.

[Sen. Alison Clarkson (Chair)]: Everybody has now been so constrained on its time.

[Unidentified committee interjections (overlap/misattribution)]: Yes.

[Sen. Alison Clarkson (Chair)]: It's gonna be a challenge.

[Rick Gardner (LexisNexis Risk Solutions)]: Yeah. I truly appreciate that.

[Sen. Alison Clarkson (Chair)]: Right. Any other questions, anybody?

[Unidentified committee interjections (overlap/misattribution)]: Okay, great.

[Sen. Alison Clarkson (Chair)]: Thank so much. Thank you and Karen both Of course, for yeah. We appreciate, and I hope you can stay for the rest of the morning here. We have Ryan and Emory. Ryan, are you wanting to go next? We welcome you back. As you all may remember, Ryan helped us craft our first date of Brookerville many years ago. Oh, you can't see it, but you're getting applause from Emory in the background. Thank you, Emory. We are appreciating it. Brian can't see it, but thanks.

[Unidentified committee interjections (overlap/misattribution)]: My name is Ryan Krueger. I am a resident of Moppelin in Vermont. I have over twenty years of experience. I've been a attorney in specializing in consumer protection, privacy, data security. I work for the Vermont attorney general of the Federal Trade Commission's Division of Privacy and Identity Protection, and I'm currently the deputy chief of the Massachusetts Attorney General's Privacy and Responsible Technology Division.

[Ryan Krueger]: I also teach about privacy, consumer protection, public policy, administrative ethics at the University of Vermont. I testify today in my personal capacity as a citizen of Vermont. My testimony does not reflect the positions of the Massachusetts attorney general, Robert Blackburn's office. I was just noting on the agenda, I enlisted as former FTC commissioner. I appreciate the Oh, no.

[Sarah Odes (Consumer Data Industry Association)]: You're not. Even I know that.

[Ryan Krueger]: And if anybody wants to make a recommendation, I'm happy to take it, but no.

[Sen. Alison Clarkson (Chair)]: I think your current title in Massachusetts is just great. Right. Okay.

[Ryan Krueger]: I'd like to start with some big picture observations about the industry, and then try to address some of the specific concerns that have been raised. The data broker industry has been around for decades, but didn't really experience public scrutiny until around 2014. They had over a decade to address the many concerns that had been raised about value fraud, but it appears that rather than try to reform their industry, they have instead decided to dig in their heels and oppose efforts at reform. There are likely over a thousand and potentially many more data brokers out there. Some data brokers are very large and sophisticated, like what was Nexus. Others appear to be very small, like National Public Data, a data broker that had a massive data breach of almost 3,000,000,000 rows of data in 2024, likely about 100 to 200,000,000 consumers affected. What that shows is there's not necessarily a correlation between the size and sophistication of a data broker and how much data they are able to unmerse. K? Many data brokers don't seem to have any scruples about who they'll sell their data to. Congress had to pass a federal law in 2024 to stop data brokers from selling our data to foreign adversaries. LexisNexis has been sued for selling immigrants' data to ICE. Note, were that was in 2024. They were able to get that case dismissed. But in their motions to dismiss, they did not deny that they were selling data to ICE. They merely said they emphasized that despite plaintiff's claim to a right to privacy, quote, no such right exists. And I would posit that that is kind of the business model of data brokers. No such right exists.

[Sarah Odes (Consumer Data Industry Association)]: Do you know what data

[Ryan Krueger]: they were selling to Actually

[Sarah Odes (Consumer Data Industry Association)]: And it was directly to ICE?

[Ryan Krueger]: They had a contract with well, was Homeland Security, and I believe it was also ICE Contracts. Okay. And it was data to help them identify people to, I can get you a copy of the insurance panel, basically. Yeah, that will be helpful. In 2006, the Federal Trade Commission actually levied the largest penalty that ever implemented, 10,000,000, against a company called ChoicePoint for selling people's social security numbers, birth dates, credit histories directly to identity thieves, causing the actual compromise of over 163,000 consumers' financial data. ChoiceBoy was then required for about 4,100,000,000 actually by LexisNexis. But even if the data brokers are not affirmatively trying to sell your data to foreign nationalists or to identity thieves or anything like that, the very fact of their having the data puts us at risk. And that is because data breaches exist. It is impossible to guarantee that any company can keep our data safe. The Equifax data breach in 2017, that turned out to be China. And if China wants to get your data, they're gonna get Russia, North Korea wanna get your data, they're gonna get your data. This is one of the reasons why we've seen in all the privacy laws, and thankfully, the comprehensive one we're looking at, this notion of data minimizations. Right. A data minimization requirement, if there is a silver bullet in the privacy and security world, it's data minimization. The idea being, don't collect more data than you need. Okay? Sure, you're probably gonna get breached, but if when you get breached, you've deleted old data and you haven't collected too much data, at least you'll minimize the harm to consumers. And what's also great about data minimization is it doesn't require consumers to opt in or opt out. It just says to the business, don't collect more data than you need. The obligation is on the business, not the consumer. So data and by the way, that's also a best practice within the industry. Before law started implementing it, a lot of businesses were already going to a humanization. Here's the thing. The data minimization doesn't make any sense for the data broker industry. The data broker industry's business model is data maximization. They want to collect as much data as possible. So any section that says don't collect more data than you need, as it applies to brokers, it's a disconnect. So if data brokers are gonna be committed to collecting as much data as they possibly can about us, then the only way we can protect ourselves is by saying, look, I'd like you personally to delete my data. K? Unless you absolutely need it for, say, Fair Reporting Act, which, by the way, this law has an exemption. It's saying any data used for Fair Credit Reporting Act is is exempted. If someone goes through a data reference, please delete this data, they can deny it under this law. So I'm not sure what the Objective on Fair Credit Reporting Act is, so I'm even positive. I heard, by the way, last week, a representative of the insurance industry came in and said that they were concerned that they would have to delete data, older data, which is related to investigations under this law. I didn't understand that because insurance companies are not data brokers. This is something that's really important to understand. This law only applies to data brokers. So banks are covered by Greenwich Wiley. They're not covered by this law. So exempting Greenwich Wiley isn't gonna do anything specifically to banks. They're already outside the law. It might limit some of the data that they have access to. Not Fair Credit Reporting Act data. If it's data being used to implement loans or anything like that, they still have full access to that data. The same thing you have to remember is that any time a company comes in and says, Well, I have this very specific use case that I need this data for, or I might need this data in the future for some amorphous use case I can't define, they're saying, and that means you need to let thousands of opaque, some very shady companies have as much of your data as you want to, expose it to theft by fraudsters, by foreign governments, by whatever, because the two are coupled. Either either everybody gets to have our data and do whatever they want with it, basically, with certain exemptions in order for them to have those outs. Now my understanding is that there is discussion about certain carve outs, making amendments. I think that's great. I I I trust Senator Clarkson. I I trust her her counterparts in the house committee to be having those conversations and making those discussions. All I ask on that is that if we're talking about exemptions, try to keep them within section 24.2 four four six (three), which is where the exemptions are. If you see an attempt to, say, amend the definition of consumer or amend the definition of data broker, that's just a backdoor way of trying to kind of duck the bill with language. Okay? We don't handle on legal rights to privacy because every time a state tries to get a legal right to privacy implemented, the industry shows up and is able to convince the committee why they need to just tweak the language here or tweak the language there in order to give them kind of loopholes they can private track for. I'm very comforted by the level of sophistication of the committees in Vermont that have been working on this, which is why I feel very trusting that you guys are gonna be able to get the language right. I know that, especially on the house side, so much consultations happens with data science industry members and computer science professors. There's just been a lot of thought that is going through this. Could additional exemption be carved out? Sure. And I'm sure that conversation is happening, I think that that conversation should happen. So I did wanna just kind of mention that. I also just want to say that, you know, well, I don't know, over to that point. We do go through a guideline key in slide 14. Oh, in terms of the Gray Rutland's Wiley Act and broad assumptions, I did want to note that the Consumer Financial Protection Bureau, I'll be providing this report, in November 2024, actually issued a report about state privacy laws exempting GLBA, and they said, Don't. Now this is CFPB. They're the ones who enforce GLBA. They basically said, It's a good law, but it has a lot of lacking protections, and if states give this kind of big, broad carve out, they're actually not gonna be protecting people as much as possible. Now they were talking about comprehensive laws in that case. I encourage folks to look at that

[Sen. Alison Clarkson (Chair)]: law at that Can you email that so to that we can have a chance?

[Ryan Krueger]: Absolutely. I'm also gonna be including this report that just came out this February from the Joint Economic Committee about practices of registered data brokers and the multibillion dollar cost of breaches that they've been asked. Because, again, just the fact that they have so much of our data exposes it to all of these potential breaches. And no one will sit here and say, We can guarantee that we'll keep it safe, because everyone knows at this point that that's just any cause of this to make me. And again, Federal Office of Personal Management has been breached. The NSA has been breached. This isn't saying companies are being negligent. It's just saying, this guy's really good. Yeah. Right? We just can't be protected.

[Sen. Alison Clarkson (Chair)]: And then cleaning, I mean, what we found in 2017 is that that cleaning up, that closing the door after it's been opened is just very challenging for people. Oh, absolutely. Once your data Yeah. It was very Yeah. So once your data's

[Ryan Krueger]: out there, fixing the identity theft is very, very difficult. And by the way, just as a side note, I you know, one kind of defeatist attitude I sometimes hear people say is, well, our data is already out there, so why are we even bothering with this? And the response to that is, one, data ages. Data becomes much less valuable over time. Self disturbing biometrics don't age, but a lot of other data does. So tightening down privacy rights does have an immediate effect. And second, maybe, even if all of our data's already out there, our kids' data isn't, and grandkids' data isn't. They're like, maybe we've messed up for our generation because the technology came on too fast, but we can still make a change. We can still fix things for future generations, and I think that that is a laudable thing to do. The last thing I want to talk about is enforcement of the law. I was just reading an audit report called the California Audit Report, I really understood that link with the committee, by an organization that looked at the California privacy laws, specifically their global opt out signal in compliance with the law. And what they discovered, unsurprisingly, is rampant noncompliance with California's law by major corporations, by small corporations, just across the board. And the reason that that's happening for the major corporation from Google Meta is because pretty much any penalty they pay is not gonna be lower than what they probably profit from by the law. But the fact of the matter, and I have been doing this enforcement for a very, very long time, if you violate one of these laws, first, you have to be caught. Then, it has to be reported to an OG's office, and the OG's office has to decide to look into that particular violation as opposed to the 100 other violations they know about. And then if they do investigate that violation, and that could take a couple years, they have to decide, you know, go forward with it. Like, there are so many points at which enforcement can fall away that it's often kind of worth rolling the dice and just saying, well, we're gonna go for it. That's why enforcement mechanisms are so critically important. If we're gonna pass a law that isn't really gonna be enforced by attorney By the way, I know the AG is gonna do everything like that. I'm not doubting that at all. But, you know, they have, I think, seven attorneys in the public protection division, and maybe one of them will be able to be freed up to enforce this law. They can only do so much. And that's why I do want to talk briefly about private right of action. Industry has done an amazing job over the past couple of decades of communizing the private right of action. And so I be very clear, Erica. Even the term private right of action, PRA, it kind of abstracts this concept. Imagine you live in a world where you're driving down the street and someone hits you with this car, and you get in with them, you're better. And you say, Well, I need you to pay for the damages. And they say, Well, we're not gonna do it. And you say, Well, we're gonna sue you. And they say, Well, you can't, because there's no private right of action under negligent vehicular. You have to just go to the attorney general and ask them to enforce forgiving. You can't enforce your own rights against me. That's what a lack of a private right of action all a private right of action says is if someone violates the law, as to me, I get to do something about it. What's the remedy? I go to the, well, first I go to them and say, Could you make it right? And if they don't wanna make it right, then I go to the courts and I say, Look, they're not willing to make it right. If we lived in that world where there was no private right of action for, you know, vehicular damage, and we tried to put one in place, I'm sure we would hear from the auto insurance industry saying, don't give them a private right of action. You'll get all sorts of lawsuits from it. Well, of course you will, because that's how you enforce the private right of action. You have to have lawsuits. Right? So, you know, the the the Fair Credit Reporting Act has a private right of action. That was passed in 1970. Laws used to generally have private right of actions before kind of industry started really getting really good at showing up in places like this and and convincing people why it's

[Sen. Alison Clarkson (Chair)]: a So that's a federal right. That's a federal right. And we have a PRA in our consumer protection.

[Ryan Krueger]: I believe we do. Yes. Yes.

[Sen. Alison Clarkson (Chair)]: We do. Yes. How does that I think one this is a question many of us have. How does that not exist for all of us with all in all areas in Vermont. We have already embedded in our statutes of private right of action Correct. In consumer protection. How is and maybe this is a question for Todd, how is that not protecting us now and enabling us to already stew if we have a problem?

[Ryan Krueger]: We can. People bring private suits under consumer protection laws. You buy a car that they lied to about, you can sue it. Conceivably,

[Sen. Alison Clarkson (Chair)]: with the PRA already existing in our state statutes, could it not already be used in these cases?

[Ryan Krueger]: If I believe under the current language, yes. Now what other laws tend to do is they say there'll be a clause in it that says, nothing in this law indicates private right of action, or only the attorney general can enforce this. So what they're doing is they're taking that private right of action because they say enforce as per, 9BSA come forward 53, but not with regard to this law. For this law, only the AG. For this law, there's no private right of action. That's the language that shows up in other laws to get rid of it. And this law, to my knowledge, does not have that. And, again, we've had private rights of action in Vermont for a long time. You don't see massive class actions happening. Companies are not getting bankrupted due to frivolous litigation. Mean

[Sen. Alison Clarkson (Chair)]: Todd has testified to that.

[Ryan Krueger]: Yeah. You know?

[Sen. Alison Clarkson (Chair)]: Yeah. Patient review.

[Sarah Odes (Consumer Data Industry Association)]: We have in Illinois. Right? So I I I've encouraged everyone on this committee to to read and understand what's happened in Illinois over the last ten year. And their supreme court, which was hearing maybe their somewhere between ten and twenty lawsuits about their their data privacy bill called their I don't think it's been amended, honestly. I mean, they were gonna try and take out flat section lawsuits, but the supreme court said that the pry the the bankruptcy bill in Illinois had annihilative power over certain entities. And the majority of those sued in Illinois were hospitals. That was the case that was being heard when they were talking about annihilative power. Hospitals, seniors that are school districts. They do have some high profile cases with millions of dollars extracted from big tech, but most of the cases there have been against smaller entities that that are within the reach of somebody to sue. Do you have any response to what's happened in Illinois? Because I don't wanna be Illinois.

[Ryan Krueger]: Absolutely. So you're referring to the Biometric Information Privacy Act, HIPAA, in Illinois, which is probably one of the only laws, if the only privacy law out there that has a criminology like this. It has

[Sen. Alison Clarkson (Chair)]: a private right of action.

[Ryan Krueger]: Well, let's be clear. Yes, they have a private right of action. They have a private right of action coupled with liquidated damages. Liquidated damages means in the statute, it says a violation of this law will cost you a thousand dollars per or $5,000 if it's intentional. That's why it is such a a a strong and and and difficult law, because it it has this huge penalty attached. Now the Consumer Protection Act says the attorney general can seek up to $10,000 per violation. Private actors do not get that. Private actors can get damages. K? And if they can prove really bad actions, they can potentially get treble damages or possibly treble consideration, which is generally nowhere near a thousand dollars or $5,000 or anything like that. Okay? And having approved damages in a privacy case is incredibly difficult to do, which is why I think you're not gonna see a landslide of private rights action. There is no liquidated damages. By the way, Vermont's Fair Credit Reporting Act, our state version and federal law, actually do have liquidated damages. Vermont, I think it's like $100 per violation or something like that. Have been some cases

[Sen. Alison Clarkson (Chair)]: Probably hasn't been updated for Vermont.

[Ryan Krueger]: Yeah. The point is, even liquidated damages clauses exist in Vermont, and they have not been ruinous. Illinois, they have had that 1,000, 5,000. And by the way, what I find hilarious about BIPA is BIPA basically said it had two requirements. You have to have a retention schedule that you declare to people, if you collect some of these biometric information, you have to get permission first. That's the entire law. The fact that so many companies have trouble complying with ask permission to get biometrics and share your retention schedule, it's like, I'm kind of stymied by how that is. A lot of these cases, by the way, happened while tech companies had the cases tied up at the federal level. For a long time, courts had put a block on the law. Okay? Because under federal courts, they had different requirements. And so I think a lot of this action, a lot of companies are saying, well, we don't have to comply with this law because the federal courts have blocked it. And then there was a case that went up through the state court at 106 Flags, in which the state Supreme Court said, no. This law is actually fine, and it went forward. So I think what happened was a lot of companies that were just ignoring the law suddenly found out that Biloxi was in effect, and suddenly they were on the hook for damages when they thought they could just ignore it. Because this is the point. If the state passes a law, and there's no decent enforcement mechanism, a lot of companies, not all companies, but a lot of companies would just ignore the law. Thomas?

[Sen. Thomas Chittenden (Member)]: I'm trying to reconcile example or corollary with a vehicle accident with what I just heard you say, which is that it's very difficult to liquidate and identify damages in the data breach, but in a vehicle accident, it's pretty darn clear what the damage is and what parties are involved. And that's partly why a PRA is problematic and that it is so difficult to identify what the true actual damages are and could get a lot of nuisance lawsuits. I always would like

[Rick Gardner (LexisNexis Risk Solutions)]: to file those two points.

[Ryan Krueger]: So good good point. So, yes, you're you're absolutely right. In auto damage, I think we have both sides of things like what the damage If you have a violation First off, so for damages in here, I suppose the damage would be you ask someone to delete your data. They didn't delete your data. Right, that would be what you would be suing over. So they didn't delete your data. How is that data deleted? Frankly, I'd be surprised they could convince a court to get damages just for not deleting your data. But if they didn't delete your data, then they had a data breach, and then you can show identity theft arousing from that data breach, okay, how much data were you getting from the identity theft? But you see, a lot of steps have to happen for that to happen, including connecting this particular data breach to the identity theft you experienced there, which sometimes is possible to do. It has happened in the past, but it's rare. So in other words, in a circumstance where some data broker didn't delete my data, and as a direct result of that, I suffered identity theft, I may go to the agency say, please do something about that, but with a proper run action, I could go directly on that data broker and say, the $10,000 of damages, the $100,000 of damages I experienced was because you didn't delete my data. You should make me whole, just like in almost every other realm. So that's, I think, why it's important and why I really don't think, because we don't have liquidated damages, And because lawyers, plaintiff lawyers

[Sen. Alison Clarkson (Chair)]: are Liquidated not damages to go to Illinois. So what Kesha's asking is that then, does that, the Illinois case doesn't really apply to our PRAs here?

[Ryan Krueger]: Because we do not have Because we don't have to put any of this. Correct. Correct. In under the Vermont Lives damages or what they say, call trouble consideration for exemplary damages, which would be really bad as cumulative as we have the benefits. I'm not even sure what trouble consideration would look like with your data broker, because consideration is how much you paid them, and no one pays a data broker directly. So I'm not even sure how that would be.

[Sarah Odes (Consumer Data Industry Association)]: Well, I mean, my larger point was that a lot of entities that simply do need people's data for ID badges and keeping, you know, pharmaceuticals safe, etcetera, are the ones that get caught up in these lawsuits. It's not always Facebook. It's it's smaller entities that might rely on a data broker. And and then, you know, because we heard you say, well, they shouldn't be doing that either, you know, but I just think having a lot of power to sue nonprofits and public entities like our hospitals and schools is also of concern, and it would been of concern in every data privacy bill we've had. So and and Utilities.

[Ryan Krueger]: To be clear, we're we're talking about this bill. Hospitals are not data brokers. Nonprofits are not data brokers. I won't say nonprofit data brokers. So none of them can be sued under this bill because they're not data brokers. This bill only puts obligations on data brokers.

[Sarah Odes (Consumer Data Industry Association)]: I I know. I'm just talking about the the the larger data privacy conversations that we've had have brought in a lot of entities that I mean, we were down to, like, if you keep track of 6,000 or more people's data, I think, in in the last bill, and the one that we might see, you know, we might see some return to some threshold given that we have a Democracy Bill out there. I just want us to be clear that it's it's not just big tech that that gets sued with these bills. It could be a lot of local entity.

[Ryan Krueger]: It is it is correct. But, the reason we see so many in Illinois is because of that thousand dollars per because $1,000 per basically is you may or may not get that from a court, but it gives you huge settlement leverage. Right? Nobody wants to risk that a court might, you know, give them that massive penalty. But we don't have that settlement leverage in Vermont because we don't have liquidated damages. So I

[Sarah Odes (Consumer Data Industry Association)]: We do have I mean, I don't know the attorney general's office is in here. We do have businesses that are sharing with me, you know, large requests for money for for, you know, sub consumer protection issues that have been raised. Half $1,000,000 give us this now so we don't take it to court. That's really happening right now. And and I I like, we do have to really pay attention to most of that data is coming from consumer protection complaints, you know, through through what kind of voluntary student learning program. What?

[Ryan Krueger]: Are you talking about SOPAPA? Is that is that the

[Sarah Odes (Consumer Data Industry Association)]: I'm talking about Consumer Protection Act complaints.

[Ryan Krueger]: Right. You said student learning system. That's the ed tech bill, I would assume, that is also enforced in

[Sarah Odes (Consumer Data Industry Association)]: No. No. I'm talking about how the consumer assistance program at the state, in the attorney general's office, is run through UBM. So that's where the data originated.

[Ryan Krueger]: Oh, I see. Look, it's impossible to speak to a specific incident. Half $1,000,000 to a company that's hurt people for half $1,000,000, I don't have a problem with that. I'd like to know you know, we have companies here that are multi, multi billion dollar companies. I have no idea what that case is about. K? It's also very well known that initial demands are always much higher than what anyone thinks they can settle for, and that's if it's a settlement negotiation. So, I defamation cases notoriously start with, you owe me $2,000,000,000 and then actually, it's much smaller. You can't look at the initial complaint or the initial complaint. But, again, we don't have that liquidated damages here. I really don't think we need to worry about know, that's why you see so many in Chicago, because plaintiffs' pharmacy have a good advantage and say, oh, if we can bring these cases and we can get some pretty good settlements. Well, they can. If they didn't want that, they can just complete the law, which is not that difficult to comply with, which is why I really do think we need to give people the right to enforce their own rights I under the mean, it's just such a common sense situation, which has been, again, the law for, up until a couple decades ago when the time turned and somebody became much harder to enforce against companies. And we've tried to see what's happening with that with Big Tech and these other companies, as they basically have been allowed to run away and do whatever the heck they want. I mean, the I mean

[Sen. Alison Clarkson (Chair)]: Go ahead. Just just curious because I'm not a lawyer. Maybe married one. They produced one, but I am not. And so the depth the the difference, and I think some people will be thinking, oh, class action suits. How do class action suits fit in with this? Sure. So how do class action suits fit in with the private right to do things as versus a collective right and who creates it as a class action suit as opposed to an individual suit? So is that a question that she wants here or not? Sure. Can Or is it part of?

[Ryan Krueger]: I mean, can because I know

[Sen. Alison Clarkson (Chair)]: we have to move to Emory, so I just Sure. Think that some things could still exist as a class action suit,

[Ryan Krueger]: I assume. Sure. So class actions are actually, again, another demonized term, they're not a bad thing. What a class action says is that if a company has damaged a thousand people out of them, instead of a thousand individual lawsuits going into their company, they can join as a class. That's sufficient for everybody.

[Sen. Alison Clarkson (Chair)]: That's what our AG's office is doing on behalf of us in many cases. Well, we don't no.

[Ryan Krueger]: The AG does not do class action. Oh, so Okay. Sometimes sometimes defense counts think they are, but Right. No. The AG does not do class action. The AG sues on behalf of the people, just on behalf of consumers.

[Sen. Alison Clarkson (Chair)]: Oh, that's a big class action.

[Ryan Krueger]: Well, except that there's actually, like, a specific procedural rule that covers class action, and you have to certify the class. There's all sorts of loop hurdles you have to jump to get a class action certified. None of that applies to the attorney general. They just sue

[Sen. Alison Clarkson (Chair)]: all And it doesn't apply to anything in this bill either. Correct. Right. Correct, to my knowledge.

[Ryan Krueger]: Right. No, I mean, if there is a company that, again, doesn't delete a thousand Vermonters' data, and a thousand Vermonters suffered identity theft as that strain that happens, and they wanna bring a class action under this, I think they probably wouldn't be able to. But, that was a data broker that should have deleted people's data when they asked them to. Right. And why didn't they? You know? Again, it's like, and they'll say, Oh, frivolous suits, shakedown suits, all this other stuff. Procedural law has rule 11. They have protections for these sorts of things. Right. I'm not gonna say they never happen. I'm not gonna say that lawyers don't you know, there aren't unscrupulous lawyers out there. Of course, there are. But you could say because some unscrupulous lawyers are going to do unscrupulous things, meaning to remove the right of all Vermont citizens to seek relief if they're harmed seems like overkill in the other direction.

[Sen. Randy Brock (Vice Chair)]: That's what I'm saying.

[Sen. Alison Clarkson (Chair)]: Thank you. Anything else that you'd like to add?

[Ryan Krueger]: I'm sure there is

[Sen. Alison Clarkson (Chair)]: a And testimony you'll send to us, yes.

[Ryan Krueger]: Yes. Oh, yeah, I mentioned that amendments, I think the definition of data broker and consumer is perfectly fine, and I'd leave that alone. And I think that if there is a need to put additional exemptions for use case exemptions, I believe those conversations are happening and they make sense, but I think that keeping out the kind of broad, law based, broad database you know, industries have done a really good job of stopping that from happening within the states. You know, the easiest way to stop something from happening is saying, well, it's never been done in other states. That's why it's like

[Sen. Alison Clarkson (Chair)]: We're not churched over any other states, though, right?

[Ryan Krueger]: Exactly. But if I mean, the reason they're fighting so hard in this state is not because they're worried about additional liability in Vermont or teeny times. The reason they don't want it in this state is because if we get it in this state, just like we got the data broker registry in this state, other states might go, oh, it is possible to do that. Oh, that is actually a good idea. Let's replicate their language because Vermont actually had the guts to stand up to these guys and actually put good policy in place, in a place where it's a lot harder to manipulate our legislators because it's a small state, and they're all very responsive to our constituencies and things like that. So that could mean we would love California and Texas as well. They get something like that. That's what they're afraid of.

[Sarah Odes (Consumer Data Industry Association)]: But our job is to help

[Ryan Krueger]: provide Absolutely.

[Sen. Alison Clarkson (Chair)]: That is our primary job. That would like to Yes. Great. Thank you. I think David.

[Sen. David Weeks (Clerk)]: So I recognize that Andrea's up now. Yeah. I'm curious if it if we're going to have time to do a little point, PowerPoint, you know, for a couple minutes, I we're not gonna have another opportunity, I believe, to have With the views in

[Ryan Krueger]: the same

[Sen. Alison Clarkson (Chair)]: Different views in the same room. It's exactly. So why don't we have Emory go and then let's let's see if we have let's make time for that.

[Sarah Odes (Consumer Data Industry Association)]: And I'll just say I I would like to hear more about sale of data to the federal government. I think that's what most Vermonters are concerned about

[Sen. Alison Clarkson (Chair)]: right now. I'm frankly not as concerned

[Sarah Odes (Consumer Data Industry Association)]: about Resy and King Arthur Flower.

[Sen. Alison Clarkson (Chair)]: Thank you, Ryan. Really appreciate. And, Emery, let's turn to you, and then let's make time for that back and forth over again. Sure.

[Emory Roane (Privacy Rights Clearinghouse)]: Will I will do my best to be brief. And I I probably looked like some sort of oversized bobblehead just nodding my head to most of everything that Ryan was just saying. So I I think that there's gonna be a lot of overlap here. I'll just dive right in. Chair and members of the Senate Committee on Economic Development, Housing and General Affairs, thank you for the opportunity to testify today. My name is Emery Rohn. I am the associate director of privacy rights clearinghouse. We are a San Diego based consumer privacy advocacy and education nonprofit, and we're also proud to have been a sponsor of the California Delete Act. We also manage a database that tracks data breaches reported in The United States with nearly 100,000 data breach notifications analyzed going back to 2005. I testified earlier before the House Committee on Commerce and Economic Development earlier this session in support of h two eleven, and I am grateful to be back to reiterate and strengthen that support. I wanna thank this committee and Vermont more broadly and frankly, given the opportunity, Ryan personally, for leading the charge on data broker regulation. In 2017 with HB seven sixty four, Vermont created the first data broker registry in the country, in the world. California shamelessly and gleefully borrowed that framework the following year. What we've been building in California ever since, including the California's DELETE Act and the DELETE Request and Opt Out Platform or DROP rests on the foundation Vermont laid. Vermont was first and Vermont is once again well positioned to take back that lead. The data brokers are by design opaque. Most people have never heard of them, yet data brokers are everywhere quietly collecting, inferring, and selling information about nearly every American. In 2023, the markup published an investigation into a single micro advertising platform.

[Sen. Alison Clarkson (Chair)]: Oops. Just frozen.

[Sen. Randy Brock (Vice Chair)]: Can you hear?

[Sen. Alison Clarkson (Chair)]: Yes. We we can.

[Emory Roane (Privacy Rights Clearinghouse)]: Can you hear me?

[Ryan Krueger]: I'm gonna go.

[Sen. Alison Clarkson (Chair)]: You know, you're breaking up.

[Emory Roane (Privacy Rights Clearinghouse)]: Of course. Right at the moment of importance.

[Sen. Alison Clarkson (Chair)]: It's like well, Rick's sitting right underneath you. What can we say?

[Emory Roane (Privacy Rights Clearinghouse)]: Will switch to

[Sen. Alison Clarkson (Chair)]: You wanna go out? Come back in?

[Emory Roane (Privacy Rights Clearinghouse)]: Yeah. I'll switch to a different microphone really quickly. One moment here.

[Sen. Alison Clarkson (Chair)]: Okay. We also lost your vision.

[Emory Roane (Privacy Rights Clearinghouse)]: Yep. Yep. Can you hear me now? Is this any better?

[Sen. Alison Clarkson (Chair)]: Yes. We can now see you again.

[Emory Roane (Privacy Rights Clearinghouse)]: I apologize for that. In 2023, the market published an investigation into a single Microsoft advertising platform. They documented 650,000 distinct audience segments that advertisers could target. These include categories like heavy purchasers of pregnancy test kits, depression prone, and tight money. And that is just one advertising platform. The broader data broker ecosystem is far larger. Data brokers enable stalking and harassment by putting home addresses and daily patterns on the open market. People search sites in particular have been weaponized by domestic abusers to track down survivors who went to considerable lengths to disappear. Last year, let's not forget that the man who assassinated Minnesota representative Melissa Hartman and her husband and wounded a state senator and his wife was found with a notebook listing 11 different data brokers he had used to try to locate the victim's home addresses. Data brokers also enable identity theft. Ryan brought up the congressional joint economic committee report last year that found that breaches at just four major data brokers cost American consumers more than $20,000,000,000. They enable fraud schemes that target the elderly and people with dementia. And in a country where reproductive care is increasingly criminalized, where immigration enforcement is aggressive and increasingly data driven, and where LGBTQIA people face escalating political hostility, brokers continue to traffic in reproductive health data, immigration status, gender identity and expression, and information about minors. Duke University researchers have shown that data brokers openly sell sensitive information about US military personnel, including information about their children for as little as 12¢ per record with little to no vetting of who was buying. And while PRC does not typically weigh in on government surveillance, the data broker market has become a workaround for constitutional protections. Law enforcement at all levels routinely buy data broker data to obtain information that would otherwise require a warrant. And when given the opportunity to step out of all of this, consumers overwhelmingly take it. When Apple introduced app tracking transparency in 2021, giving users a single toggle to opt out of cross app tracking, 96% of US iPhone users opted out. When California launched Drop on January 1, more than 240,000 Californians signed up in the first eight weeks, with 18,000 in the first forty eight hours alone. The agency has said that participation has far exceeded its expectations. The demand is clearly there. The feasibility, in our opinion, is no longer an open question. What is missing is the practical ability for consumers in the rest of the country to exercise that right. Now our own research and the growing body of civil society research into looking at data broker state registries increasingly demonstrates that registration alone is not enough to protect consumers from data brokers. The brokers that should be registered often are not, and the brokers that do register are not reliably telling the truth about what they do. Last year, we partnered with the Electronic Frontier Foundation and students at the Harvard Cyber Law Clinic to pull the data broker registries from California, Vermont, Texas, and Oregon, and we consolidated them into a single dataset so that one could cross reference brokers across the different jurisdictions. The underlying premise was that though there are some differences in scope and definitions, largely if a broker is required to register in one state and has acknowledged that they are obligated to register in one state, they very likely face registration obligations in others. What we found, however, is that in every single registry we examined, hundreds of brokers were registered in one state but absent from others. For Vermont specifically, last year, we identified seven and fifty unique broker entities across the four registries. Of those 750, 309 disclosed registering sorry. 309 were not registered in Vermont while they were registered in other states. A 199 disclosed collecting geolocation data in other jurisdictions, and a 179 disclosed collecting minors data. And the issue has gotten a little more complicated this year. In March, the California Privacy Protection Agency published its new enhanced data broker registry showing now 795 registered brokers in California alone. Our good friends over at the Electronic Privacy Information Center or EPIC recently analyzed that data and identified 33 brokers that self reported selling or sharing data with foreign actors, including North Korea, China, Russia, and Iran. After Epic published their research, seven of those 33 brokers contacted Epic They claimed that the information they themselves had filed with the state was wrong and that they do not in fact sell to foreign actors. So putting those findings together, we have hundreds of brokers that should be registered in Vermont that are simply not. Now the ones that do register, a meaningful share are filing inaccurate disclosures. And we only know about those inaccuracies because civil society pulled the registry and some brokers pushed back on what they found. A consumer trying to exercise a deletion right against a registry that is both incomplete and unreliable has been set up to fail. In our opinion, the single most important question in front of this committee today is the centralized deletion mechanism that is now absent from this bill. The house stripped the mandatory mechanism from h two eleven and replaced it with a feasibility study, and I urge the senate to revisit that decision. H two eleven creates an individual right for Vermonters to request deletion from each data broker with a thirty day compliance window, a conspicuous web page requirement, a prohibition on dark patterns, and a confirmation to the consumer when deletion is complete. That right is necessary. It is unsurprising, but kind of disappointing that CDIA characterizes this common sense limited right as a broad deletion framework. But on its own, it will absolutely not be enough. Transparency is essential. And but our research demonstrates that alone transparency does not solve the consumer problem. There are now 795 registered brokers in California, and that is only the ones that register. Asking a consumer to individually identify, authenticate with, submit deletion requests to hundreds of separate companies puts an overwhelming bureaucratic barrier between the consumer and the rights the law supposedly gives them. The evidence on how well this manual deletion process works is also damning. Consumer Reports tested 13 commercial data removal services over four months, and they found that only 35% of data instances were successfully removed. The researchers estimate that manual opt out by individual consumers takes, and I quote, the better part of a work week per broker. A separate study by the firm Yorba looked at nearly 22,000 formal data deletion requests submitted last year and found that only 48% resulted in verified deletion. And this was even with proper submission and documentation. And earlier this year, DuckDuckGo, which also runs an authorized agent deletion service, wrote to the CPPA about what it encounters in practice, including broker websites going offline, opt out forms changing to purposefully hinder automation, email domains blocked outright, requests with no response after multiple follow ups, and data reappearing after confirmed deletion. The effect that that go wrote was to shift the burden of enforcement onto consumers and their agents. So this is what consumers are navigating. Initiate a request. Wait weeks. Get told the broker can't find any matching data or that they're not obligated to. Or get a confirmation that the data is deleted and then watch it reappear shortly afterwards because it's gonna be collected, or pay for a service that promises to do this for them only to hit the same balls. Endless back and forth communications, additional verification rounds, and mixed at best results. Now the delete act was designed to flip that burden. The drop platform creates a single point of entry where consumer can make one request that then reaches the entire registry and obligates brokers to regularly check for and act on those requests. Drop is live today. Data broker obligations begin in August, and 240,000 Californians have already signed up. H two eleven has introduced mandated a central accessible deletion mechanism modeled very much on the California DDAC model. The house replaced it with a feasibility study, and I respect the caution behind the study, but the feasibility question was answered by California on January 1. We don't object to studying how to implement a centralized mechanism, but we do object to studying whether to implement one. The committee should seriously consider restoring the mandatory mechanism or at minimum strengthening the study mandate with concrete implementation milestones so that it doesn't become an indefinite delay. Seventy three percent of Americans feel they have very little or no control over data the companies collect about them. A centralized deletion platform, a centralized deletion mechanism is what actually changes that. More than registration alone, more even than a comprehensive consumer privacy law. It is what puts the choice about an individual's personal information back in that individual's hands. The centralized deletion mechanism, in our opinion, should not be abandoned. It should be the goal. Privacy rights clearinghouse strongly supports h two eleven and urges the committee to advance it. But we urge it to either restore the mandatory deletion mechanism or strengthen the feasibility study. So the question it answers is how to build a centralized mechanism and not whether to. Thank you again for your time. I'm happy to answer any questions about our methodology or what we learned through the implementation of the DELETE Act and DROP in California in order to respond to some of the points that some of our other panelists have raised.

[Sen. Alison Clarkson (Chair)]: Thank you, Emery. We appreciate it. We will be hearing from the Secretary of State who's been given that study next week. And we even if we wanted to, we don't have the money to implement that this year. And we know it caught California bomb to create that portal. And I think we need to figure out how we also navigate that piece as much as the policy piece sadly. So it's not a

[Emory Roane (Privacy Rights Clearinghouse)]: public Understood.

[Sen. Alison Clarkson (Chair)]: Reality for this year in our budget.

[Emory Roane (Privacy Rights Clearinghouse)]: Sorry. What? We would encourage speaking for the agency I'm not speaking for the agency, but having asked this question directly to the agency, they have said that they are interested in working with other state agencies to assist with creating these kinds of platforms. So there's arguably not the need to reinvent the wheel.

[Sen. Alison Clarkson (Chair)]: Right. We don't need to reinvent the wheel. California has done a good job.

[Ryan Krueger]: We just need to figure out

[Sen. Alison Clarkson (Chair)]: how to Vermont size it and make it work for us. Thank you. No. Appreciate. Any questions for Emery? David, I think you have a question that might engage the incredible minds on this subject that we have in this room. I do. Well, you've implied that you're right.

[Sen. David Weeks (Clerk)]: No. No. No. I what I'd like to hear is and we heard some rather stimulating point and counterpoint, but it I think it could be appropriate to respond to some of the issues in a short time period.

[Sen. Alison Clarkson (Chair)]: Well, we could start with something that's in front of us, that we've been asked to consider, which is the GLBA, the exemption from that. So Ryan doesn't feel that it gets us very much and So Rick I mean it would be interesting just to is that the kind of thing you're talking about? Yes, ma'am. So let's and Emery has a thought too.

[Emory Roane (Privacy Rights Clearinghouse)]: I would just like to throw that I I, again, was, you know, nodding my head to what Ryan was saying earlier. I think that the CFPB report on the limitations of the GLBA and the prevalence, the growing prevalence in state laws is something to follow. I'd like to sort of maybe pointly respond a little bit to some of the points were raised earlier about how every state two things, really, but how every state consumer privacy law has this exemption for the GLBA and the FCRA. Just 20. Just 20. 20. Exactly. So the for one, you know, this is while certainly not every state is just copying what California has done at all by far, but the model that California passed with the CCPA certainly set the tenor of the conversation and oftentimes set the scope of the conversation as the other states considered their versions. And so it's not very frequent that we've seen states go beyond what California has passed. California with the CCPA had a GLBA exemption in it. So I think that it's important to sort of constantly consider the political realities that the California advocates were facing when they were passing the CCPA or, for example, when we were advocating for and sponsoring the California Delete Act that we included a GLBA exemption and the FCRA exemption,

[Ryan Krueger]: you

[Emory Roane (Privacy Rights Clearinghouse)]: know, in order to get the thing passed. And also, as Sarah mentioned earlier, we wanted it to work to we wanted to delete act to nestle besides the CCPA and fill the gaps of the CCPA. I I not to get on a tangent here, but one thing that Sarah raised, I do wanna specifically object to, which is that she raised the idea that no other state law

[Sen. Alison Clarkson (Chair)]: has And a danger and we just have about So five more

[Ryan Krueger]: if you could please

[Sen. Alison Clarkson (Chair)]: quickly breathe, because I think we'd love

[Ryan Krueger]: Yes, to hear

[Sen. David Weeks (Clerk)]: your bad memory, you heard from Ryan. It would be appropriate to have the counter point just to find some balance and then go backwards.

[Sen. Alison Clarkson (Chair)]: Of course, we could go back. Let's just hear from Rick and Sarah. If I could

[Sarah Odes (Consumer Data Industry Association)]: get some counterpoints to a few comments that Ryan made, I think one thing we need to keep in mind, we keep using the term data brokers. Data brokers do this. First of all, the definition of data broker in Vermont includes a bunch of different types of businesses. Data broker is not like the term telecom, where you're all doing the same type of business. So you're using different types of data and you're a different type of business. So you can't just use one size fits all with the term data brokers are doing this because there's different regulations. For example, what CRAs are doing with the information and we're considered a data broker and the federal laws that we have to follow versus a data broker that's simply collecting marketing data. Right? So I think we have to be really careful when we use that term data brokers and then it applies across the board. Second, to note, there was conversation about big tech and saying, well, you know, it's not just Meta that would be sued. You should know that Meta, Google, Amazon are not considered data brokers and would not be applicable to this bill in any way, shape, or form. It would only be applicable in your comprehensive privacy law. So I just wanted to make sure we were clear there. Also, think it's important to note states are actually data brokers because your large data aggregators And why Brian was saying, and I would agree, none of us sitting here who represent corporations would say with a 100% certainty that we can't ever be breached because that's we would be lying with your faith. States can't make that comment either. But to Ryan's point earlier that said, you know, a PRA, you shouldn't throw the PRA simply because there are bad actors who abuse it. Well, I think you shouldn't just simply do the same thing to data brokers. There may be dark web data brokers who are doing bad things, but we shouldn't simply assume every data broker is a bad actor. If we made the secretary of state's office hold people's delete requests, they would become a data broker, and they would have to spend a minimum of $8,000,000 on a system that was secure from at at a minimum from what they believe would be

[Sen. Alison Clarkson (Chair)]: a We'll have David in next week so we can chat about this.

[Sarah Odes (Consumer Data Industry Association)]: Well, I mean, now it's it people were were saying it puts too much on the consumer to do the delete Oh,

[Sen. Alison Clarkson (Chair)]: and the moment. On the last week, it's just

[Sarah Odes (Consumer Data Industry Association)]: But if not if we create a system for people to have their information held to then be searched and deleted, we would be

[Emory Roane (Privacy Rights Clearinghouse)]: The drop mechanism does not hold personal information, just to be clear. The drop mechanism doesn't do that. It hashes the information that is provided by consumers. So it's held an entirely encrypted, you know, garbled gobbledygook that the agency can't touch. It does it's not actually identifiable. What the brokers then do is that they check their own systems against those hashes. And so I'm not sure if that actually is correct.

[Sarah Odes (Consumer Data Industry Association)]: How much did it cost for California to create their system, and what are the security provisions that we would need to meet to create the same system?

[Emory Roane (Privacy Rights Clearinghouse)]: Well, I know that the agency has those numbers available.

[Sarah Odes (Consumer Data Industry Association)]: Money for your nonprofit comes from.

[Emory Roane (Privacy Rights Clearinghouse)]: I'm sorry. Is there our I I can answer those questions if you want, but that's

[Sen. Alison Clarkson (Chair)]: cool as

[Emory Roane (Privacy Rights Clearinghouse)]: we can back.

[Ryan Krueger]: Yeah. But

[Sen. Alison Clarkson (Chair)]: you had

[Sarah Odes (Consumer Data Industry Association)]: a question about immigration data. And I did. I didn't wanna interrupt. I was just Yeah. So I that the state has said they would be very scared of a private right of action because of all the portals and systems we have that maintain We we haven't had data. We haven't had And you would have to We to have ADSs. You would have to have a lot of data in order for companies to be able to authenticate the request, right, to ensure that the Mary Smith who lives at 211 Vermont Avenue is the one who's making the request and not a Mary Smith somewhere else. So there would be a large amount of data somehow in order to authenticate those leave requests.

[Ryan Krueger]: Yeah, I'll just make a point, I'll just get Data this broker is designed defined as a business, a unit of a business. And business is defined as a commercial entity. The state is not a data broker under this rule.

[Sen. Randy Brock (Vice Chair)]: Right.

[Sarah Odes (Consumer Data Industry Association)]: Correct. But I am saying in terms of being a data aggregator and doing the same

[Sen. Alison Clarkson (Chair)]: thing could

[Ryan Krueger]: be liability of the state, which is what I just heard.

[Sen. Alison Clarkson (Chair)]: Right. It is not defined as a data broker.

[Sarah Odes (Consumer Data Industry Association)]: We every time we've had this conversation, the the question has been who should be exempt, and utilities are a business. I mean, I I think I don't know.

[Ryan Krueger]: Utilities have data directly from their clients.

[Sen. Alison Clarkson (Chair)]: They're It's different. It's slightly different.

[Ryan Krueger]: I know there's only data brokers if they have data of people who are not their customers, who they do not have a direct relationship with. They have a direct Exactly. Customer and they acquire a huge amount of data from data brokers about that customer, still not data brokers. If they sell their own customers' data to other people, still want data brokers. It's only if they have people who are not their customers' data that

[Sen. Alison Clarkson (Chair)]: they become data brokers. So so

[Rick Gardner (LexisNexis Risk Solutions)]: Well, and

[Sen. Alison Clarkson (Chair)]: it's Right.

[Sarah Odes (Consumer Data Industry Association)]: Thing that a data broker does, you'd

[Ryan Krueger]: Right.

[Sarah Odes (Consumer Data Industry Association)]: Cut that out in order to get that across the the finish line. It's arbitrary in the way it's defined.

[Rick Gardner (LexisNexis Risk Solutions)]: Exactly. And I think that kinda highlights the point. Right? Just someone can have a direct relationship. They could be amassing large amounts of data. They could be selling that data, and they're not a data broker. Right? They would not be required to be registered. They would not require to process a request under the California Deletion And to address, you know, some of the earlier comments, and I very much appreciate Ryan's comments. Appreciate the comments were made. And I I think, you know, broadly, we're all in alignment on consumer protection. Right? It's just a question of what's the best way, right, to do that. And just to kinda hone in on one of the examples that Ryan gave, you could have a scenario, as as you mentioned, somebody makes a deletion request. There's later a breach. That data is used and, for identity theft. Right? Well, the the flip side of that is somebody's data is deleted. Right? Because it was not an exemption. Their data is not there to protect them from fraud, to verify their identity. Their identity is stolen, and you you end up with with that problem. Right.

[Sen. Alison Clarkson (Chair)]: But California has figured out how to do that so that you don't it is it's really about to leave Okay. Having a little of

[Sen. Randy Brock (Vice Chair)]: I'm sure. Just just for the record, I think we would and what we have urged is to align this bill with California because we would argue that they have figured it out. Nothing's perfect. Right? But this bill is not insistent with California in its approach about the data that is exempt from that deletion request. But GLBA is and we've Right. Testified to that they were supportive of of California GLBA, FCRA. Those are those are the exemptions that we would

[Ryan Krueger]: be looking to add to this bill. But, no,

[Sen. Alison Clarkson (Chair)]: I know that that's your request, but I also think I heard Ryan say that it that exempting GLBA didn't get us as far as we think it does. Is that correct?

[Ryan Krueger]: Well, again, GLBA Data brokers are generally not financial institutions for the purpose of GLBA. GLBA covers things like banks who are not data brokers. So the overlap is not really there. It would stop certain data that might be covered by GLBA from possibly going to banks. But again, Fair Credit Reporting Act is completely carved out. So all the data under Fair Credit Reporting Act, which is what traditionally banks have used to authenticate people and all that other stuff

[Sen. Alison Clarkson (Chair)]: That's already already there. Yeah.

[Sarah Odes (Consumer Data Industry Association)]: But there are there are third party companies like those that I represent who banks use for their fraud prevention databases and they are not considered financial institutions under the OCRA and they're not considered a financial institution under GLBA, but they use GLBA data and we're not asking for a large entity GLBA exemption, but we would be asking for GLBA data because GLBA governs exactly the principal purpose that that data can be used and it follows the trail whether that's to a second party or third party or fourth party. GLBA continues to govern that data. So there's nothing that we can do outside of a permissible purpose to protect that data. So it does it's not a it's not as though it's a big bus that you can drive through an open exemption. This is a very, you know, tailored thing. And taking that away will impact consumers, fraud databases protection and other ways. So it's a serious Get out. Fraud prevention is carved out of this law as well.

[Ryan Krueger]: So now we've heard Fair Credit Reporting Act is a problem, but that's carved out. We've heard fraud prevention, that's carved out of the law already. So I haven't heard a use under GLDA that not be allowed to happen. I'll give you a use. Marketing. So if a company wants to get data about people they don't know to market products to them, it's going to be harder for them to do that because they're not going be able to get marketing data. I think that that would be prohibited. Like, people if you act by prohibited, I just mean if someone asks you to delete their data and you're only using it for marketing purposes, then, yes, you'd have to delete their data even if you're selling it to banks for marketing purposes. But fraud prevention?

[Sen. Alison Clarkson (Chair)]: That's their credit reporting act?

[Ryan Krueger]: Not they don't have to do the deletion.

[Sarah Odes (Consumer Data Industry Association)]: The Fair Credit Reporting Act, with all due respect, well, does say in order to furnish a credit report in this bill, that's not an FCRA exemption. There's a lot of uncertainty in that language. What does that mean? Does that mean the database that furniture uses to provide information to a credit report, credit reporting agency is exempt? Does that mean the actual database that has that credit report information in it is exempt? There's all kinds of uncertainty and there's a reason why the FCRA exemption exists the way it does in all of the comprehensive privacy law and it's not because we put bull over the eyes, it's because we worked with consumer advocates for years in multiple states to ensure that consumers were protected, but also the FCRA was able to still be a living, breathing law that allowed us to operate where consumers received the protections that they needed. And this this this is not an FCR exemption. It depends.

[Sen. Alison Clarkson (Chair)]: We can strengthen that if we need to. Any further thoughts? We have, like, two minutes to go.

[Rick Gardner (LexisNexis Risk Solutions)]: If I can make

[Emory Roane (Privacy Rights Clearinghouse)]: I would like to I mean, I would love to make it just a quick point that is And

[Sen. Alison Clarkson (Chair)]: we're quite

[Emory Roane (Privacy Rights Clearinghouse)]: way we passed this sorry. The way that we the FCRA and the GLB exemption was drafted in the delete act is as Ryan alluded to earlier. It's not an entity level exemption. It's a use level exemption. So it's only entities to the extent that they are already covered by FCRA. Because I agree, Sarah, that one of the concerns and one of the issues here is this ambiguity around these very large brokers that are doing lots and lots of different things. And they're entities who are doing FCRA good broker stuff, but then are also turning around and doing marketing with that data. And that's the concern that we have is that, you know, people feel like they've lost control of their information.

[Sen. Alison Clarkson (Chair)]: Greg, no. No. Thank you. And Rick no. Rick was gonna

[Sarah Odes (Consumer Data Industry Association)]: Well, they get funding from class action settlements, but their class action settlements defined as PSYPRES class what's a PSYPRES class action settlement?

[Emory Roane (Privacy Rights Clearinghouse)]: Sure. So a PSYPRES settlement is a settlement where the class of victims can't be reasonably ascertained or that the where the award would be so de minimis that it wouldn't meaningfully enrich the recipients. So, yeah, we received Cypray. A lot of our funding comes from Cypray. A lot of our funding comes from Rose Grant. So I think all of our funding information is, of course, public.

[Sen. Alison Clarkson (Chair)]: Right.

[Ryan Krueger]: Thank you. And frequently,

[Emory Roane (Privacy Rights Clearinghouse)]: those side court cases are on data breaches, which is one of our pinpol issues. Right.

[Rick Gardner (LexisNexis Risk Solutions)]: Yeah. Thank you. Just just one last comment. Yeah. You know, kind of the the comment around, you know, unfortunately, because of the definition of data rover, a lot of companies, you know, get caught up on that. They do, you know, lots of different things. And, you know, we, likewise, are very frustrated that there are companies that are not registered that should be. Yeah. And and and we're very frustrated that companies, right, are, you know, not allowing consumers to exercise the rights, you know, what what should be. So I I think there's a lot of alignment on on those fronts. But and if there are any other additional questions for us, certainly happy to to meet with, any of the committee members as well. Right.

[Sen. Alison Clarkson (Chair)]: Thank thank you all. Actually, this was incredibly educational. I think we're all grateful. This is helping us way through.

[Sarah Odes (Consumer Data Industry Association)]: I do wanna make sure we know it's some of the organizations that are advocating benefit financially for class action.

[Sen. Alison Clarkson (Chair)]: And many of the everybody represented in this room is testifying, benefiting from some piece of some aspect of this world. So I I I get that. We're the moment, we're done. Thank you very much. We'll be back in at ten of