Vermont Legislature SmartTranscripts:

[Sen. Alison Clarkson (Chair)]: Thank you very much. Chittenden. We are live. Great. Welcome back to Senate Economic Development and Housing and General Affairs. We are now switching gears to housing, our other favorite subject. And we've welcomed back Michael Gone and our head of Vermont Municipal Bond Bank. Michael, thank you for making time for this, and John Gray. And I think let's begin with Michael to frame up the challenge that was detected in the language that we passed on special assessment districts in H775. So Michael, if you would begin, then we'll go to John.

[Michael Gaughan, Executive Director, Vermont Municipal Bond Bank]: Sure. And thank you, Michael Gone, Executive Director, Ram Hin Bong Meng. I'm grateful ful for this opportunity to address this issue. I was reviewing the CHIP legislation and found language that was a carryover from the TIF legislation that speaks to some definitions of what is, what, and John will do this much better than I can, but it speaks to definitions of what constitutes property taxes and special assessments, unless they're used for operating expenses, are considered property tax and therefore subject to the increment that is, you know, then subject to either the TIF or the CHIP. This presents an issue because we need to secure those revenues for the special assessment revenue bonds that we've discussed. I think this also would be an issue unrelated to our initiative, but also would be an issue for the proposed C PACE changes as well. Because the net effect of this is that you couldn't do special assessment revenue bonds, or you couldn't do C PACE for that matter in an area that was subject to either CHIP or TIFF. The monitoring of that would be extremely challenging. And of course at the inception, we don't know, you know, what's gonna happen over the twenty year life of the bond or so. So that's that's kind of the issue.

[Sen. Alison Clarkson (Chair)]: So and and and the issue just in terms of lay terms is we wanna be able to have communities, have all our communities be able to do perhaps begin with a special assessment to do the water and sewer, let's say, and then sequentially be able to take advantage of CHIP and or TIF. Yeah. So for me, a bear of needing it in my language. The need is that we want to we don't want to have to choose one or the other. We want our community to take be able to take advantage of all the opportunities we offer them to enable the infrastructure and the housing that we so desperately need. Is that fair?

[Michael Gaughan, Executive Director, Vermont Municipal Bond Bank]: Precisely. The use case that came to mind for me was, let's say we have a greenfield development. First phase is going to be single family homes. You know, family homes are a little bit challenging under CHIP. They decided to do a special assessment, revenue bond for some of the street infrastructure, water sewer, but it's a big development site. And so then phase two is a multifamily project and they wanna do CHIP. Well that phase two area is already included in this special assessment that is then secured by the revenue bond and then that would preclude that option. I don't, you know, I don't think that's the intent.

[Sen. Alison Clarkson (Chair)]: So we don't want to preclude things, we want to enable things.

[Michael Gaughan, Executive Director, Vermont Municipal Bond Bank]: Right, exactly. Yeah, more tools.

[Sen. Alison Clarkson (Chair)]: I know, more tools are better. So thank you, Michael. Does anyone have a question for Michael? Okay. Great. Thank you. Because we needed to sort of appreciate the problem that we are then, I think, have developed language to solve.

[Rick Sagal, Office of Legislative Counsel]: Sure. So John Gray turn to you.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: I'm John Gray, opposite plaintiff's counsel. I don't have language for you today because I wanted to pose two options. They're both simple pieces, but I'll just, again, kinda restate some of what Michael's already framed pretty well. And I'm gonna pull up the existing statute so you can see where this potential problem originates from. It's in two places. The statute that I have pulled up

[Sen. Randy Brock (Vice Chair)]: for you

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: here, This is 24 PSA nineteen ten b, I think. This was a language that was added last year. This is for the CHIP program, this subdivision Subsection f, sorry, that says special assessments so the first line here says all property taxes assessed within a site, and you can think of this as equally applicable to TIP districts. I can flip to that section if you want, but it's the exact same thing. It just uses TIP district language. So all property taxes assessed within the scope of a tax increment financed district, so TIP district or housing development site, shall be subject to the provisions of this section. I'm gonna pause there. So what does that mean? That means all kinds of property taxes get swept into retention percentages. If you think about what the point of this is, it's to make those available for purposes of development. Special assessments are a kind of property tax, so they are necessarily swept into that retention. The reason that you have the problem in front of you today is because of the liveness of the issue that is raised by special revenue bonds. As you know, the special revenue bonds are secured exclusively by the special assessments. And so if you started retaining, right, all of those special assessments, they would no longer be available to back up the special assessment revenue bond, in which case the revenue bond itself would be sort of useless. But there is language here to speak to a particular exclusion. So currently, assessments are largely holding to the retention pieces of how technical financing works. But as you see here, special assessments levied under, and then we have the call outs to the chapters. I think that CPACE would end up fitting into these chapters, in which case they would necessarily

[Sen. Alison Clarkson (Chair)]: be So our committee has no knowledge about CPACE. That's great. That's great. So it hasn't come to us yet. Coming to us in 03/27, which is on the floor, I think, today.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Yep. So I'll I'll need to look

[Sen. Alison Clarkson (Chair)]: at anyway, coming to us.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: I'll need to look at CPASE just to see where it is.

[Sen. Alison Clarkson (Chair)]: Can just tell us what CPASE is?

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: I don't work on CPASE. So but it's a kind of assessment for particular, I think, clean energy purposes.

[Sen. Alison Clarkson (Chair)]: It's clean energy. I I believe we passed it in one of the senate natural bills, I think.

[Rick Sagal, Office of Legislative Counsel]: So the whole

[Sen. Alison Clarkson (Chair)]: Jeremy's telling us yeah. Thank you, Jeremy. So we we have some knowledge of it, but we don't have in-depth knowledge because it hasn't been in our

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: You have more knowledge than I do, but I have maybe enough knowledge to say that you don't need to worry, which is the best thing I can tell people. So We like that. I will just need to check where C PACE is situated. Presuming it fits into one of these chapters, which I'm guessing that

[David Hall, Director, Business Services Division, Vermont Secretary of State]: it

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: does, then it's necessarily picked up by the language here. It would flow through to whatever is done in this section. Meaning that if you are changing the language here and it picks up a rough reference to the CPASE section, you should be good. I will check CPASE and see where it's located, but I think you're gonna be fine. And I don't think you're gonna need to do anything separate. It's not a build. But if I come back, I'd have to apologize. Specialist settlements levied under those chapters or under a charter shall not be considered property taxes for the purposes of TIF CHIP, if the proceeds are used exclusively for operating expenses related to the properties within that site and not for improvement. So this is saying special assessments are largely swept in as a kind of property tax subject to retention through joint tax increment financing. However, special assessments that are used exclusively for operating expenses related to properties within that site would not count as a kind of property tax and therefore would not be subject to retention. Michael and I, neither of us were here at the time that this language because this is just language pulled from TIFF. Yeah. Is when the initial We language was were trying to think through just possibilities for why it might exist in the first place, And you might think of it as, maybe this is trying to ensure that folks can't route financing for municipal improvements through special assessments and then have it not be subject to the retention percentages. Therefore, they can dedicate 100% of the special assessment or the like. So we struggled, I think, to come up with great justifications for how someone what we were trying to identify is could someone, in trying to solve this problem, could someone use a new language to circumnavigate TIFF in some way and route municipal projects down another lane? We just didn't come up with any ways in which you could do this, but I do see an end.

[Sen. Randy Brock (Vice Chair)]: Yeah. I question. Have When was this exactly originally?

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: So the initial TIF language is back in the nineties, I believe. Actually, it may date I think you have initial TIFF predating Act 60. That was in the mid eighties, I believe.

[Sen. Alison Clarkson (Chair)]: No. Act 6068, 9798.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Sorry. The original TIFF program in the mid eighties, I believe. And then when Act 60 came along and created the same way, Provenant Pact, you obviously had to redo things related to TIFF. So you got a new I say new.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I think it

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: probably implemented same measures, but accounted for the new property tax system accompanying Act 60. So there's an update at the same time, right, '97. But the initial TIP program, I think, dates back all the way to the eighties in viral. I do have this subparity.

[Sen. Randy Brock (Vice Chair)]: Oh, the question, where did the original language that we're talking about comes from when was it first enacted?

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Yep. I think if I can get to where you're trying to go, this question was not a live question at that time, in particular because special revenue bonds are being contemplated today, and so there was nothing to disrupt in terms of securing a bond with special assessments. The tool just didn't exist at that time. So it's not just They wouldn't even have to make If you're trying to identify, did they think through this question when it was enacted and come up with a different answer, we reject this, they didn't because they didn't have this available as a question to them. So basically, if you wanted to solve for this problem, which is that you couldn't overlay special assessments on a kind of tax increment financing area, whether that be the TIP district

[Sen. Alison Clarkson (Chair)]: or

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: a CHIP housing development site, if you wanted to make sure that there was no disruption to the revenue bond and that you could overlay these, there's two different ways you could do it within this sentence. You could say special assessments levied under shall not be considered property taxes for the purpose of this section if you have the piece used exclusively for operating expenses, then you would just add or if the revenues are secured for purposes of a special assessment bond. So that's one way to do it. It's very

[Sen. Alison Clarkson (Chair)]: I like a very simple way.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: It's very simple. It's really narrow.

[Sen. Alison Clarkson (Chair)]: Adding another. That

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: is the narrowest way to solve this discrete problem. There's a broader way you could do it, and maybe we don't have time to go down all the roots of thinking through where this originated, the problem that it's trying to prevent. But another way is to just say that special assessments themselves shall not be considered property taxes. And if you think about it, you could distinguish special assessments from the kinds of property taxes that you typically administer based on the value of a property and the like. Obviously special assessments are entirely separate from the Ed Fund itself, so the typical concerns we have around ensuring that there's sort of a good faith effort to supply as much municipal effort at the same time that you're trying to avail yourselves of the Ed fund. All to say, you could do a broader stroke and just say special assessments are not considered properly intended, but the narrowest way that requires the least continued discussion in committee is the former, just to say if the proceeds are used exclusively for operating expenses or if the revenues are secured for purposes of a special return.

[Sen. Kesha Ram Hinsdale (Member)]: Thomas, I

[Sen. Thomas Chittenden (Member)]: like the first option because I mean, a professional assessment is assessed to the property, so if that is not a property tax, please.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Sure. And and what you're doing here is just saying for technical purpose that it it doesn't constitute a property tax for purposes of tax increment financing. It doesn't have any other effect beyond the scope of So

[Sen. Randy Brock (Vice Chair)]: it's not a property tax, you're excluding the taxpayer's right to use the typical appeals process? Only,

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: sorry, just to be clear, it's shall not be considered property taxes for the purpose of this section. So it's really just saying for purposes of being swept into the increment retention, we don't call it a

[Sen. Randy Brock (Vice Chair)]: property Right, but in terms of where it appears as a bill

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: to be Yeah, doesn't just talk to anything about

[Sen. Randy Brock (Vice Chair)]: It goes again to the mortising authority and the difficulty of the process.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Yeah. It should have no effect on the way that taxes or special assessments are Yeah.

[Sen. Alison Clarkson (Chair)]: I think I agree with Thomas. I think given at this point in the session Suggesting. That we do the simplest thing Okay. Possible to protect this opportunity for bulk in the art of theatre. Is that a fair way of putting it? Yeah. Okay. So I would we're gonna take out seven seven Todd again, I think, on Friday. Is that right? Yes. That's right. And we will have a new draft, and Cameron has been working on this with us. So let's go with that. Option number one, John. Is that okay with everybody? And second thing I just wanna bring you up to speed on is that the administration I had identified that so we're still in 775, the special the off-site accelerator. 802 Homes is a project is fully owned as a project by our Department of Housing and Community Development. Move in the program that the Vermont Housing State the Vermont State Housing Authority is fully owned by Vermont State Housing Authority. The off-site accelerator prod pilot, as as great as it is, is not owned by anybody. There's no one entity that's moving this forward. And in that regard, a lot of the work was going to fall on the Department of Housing and Community Development. They felt, I mean, I had felt it wasn't owned and therefore really it was premature to be doing it this year and to go with the additional concerns about the risk of the additional credit facility 1%, I felt I had the camera draft out, removing the accelerator, the off-site accelerator, and removing the 1% credit facility for consideration this week. Then yesterday, the administration came to us. Alex came and said, my staff doesn't have the capacity to do the off-site accelerator. Very simple. I would ask if he would pull it, and the treasurer's office is fine. And so I think the draft that we're gonna look at on Friday will have no off-site accelerator and will have no additional 1% credit facility. It'll just have what we all agreed to in s 03/28, which was the increase in the LIAC from 10 to 12 and a half percent. So that generates 30,000,000 additional dollars in possible loans, low interest funds from the treasurer's office. That's okay with you. That's the draft we're working on. And it was really helpful to have Alex just certify and to weigh in on that. Because that was the big issue. You know, a 100% of crew, there's nobody owning this pilot. So if that's okay with you, that's what we're gonna do additionally. So, John, if you'd be kind enough to add this to Cameron, we add this fix. Michael, thank you very much. I think those are the two fixes we're looking at at the moment. Two seven seven five, and then we may actually be able to get that baby out of here.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: One I guess one additional question I would have is I I think I could safely say, you would like the language you had each made for both Chip and Chip. So it'd be the same change just through NSS. Okay.

[Sen. Alison Clarkson (Chair)]: I think it needs to be made for both. Okay.

[Michael Gaughan, Executive Director, Vermont Municipal Bond Bank]: You so much for the quick quickness on this and considering. Really appreciate it.

[Sen. Alison Clarkson (Chair)]: Well, thank you very much for bringing it to our attention. Yeah. That's a

[Michael Gaughan, Executive Director, Vermont Municipal Bond Bank]: timely review. Glad that it wasn't next week.

[Sen. Alison Clarkson (Chair)]: Well, know, we are we're pretty flexible, and we move fast, and we can pivot. You know? We can have amendments. It's not over till the it's over, and it's not looking like it's over for a while. So but we are being shut down next Friday. So

[Rick Sagal, Office of Legislative Counsel]: Are you?

[Sen. Alison Clarkson (Chair)]: So we're not gonna need fully this morning committee is not gonna surely be fully shut down because it's we have all the bills coming at us from the house, which begin tomorrow. So we're picking up the first one tomorrow. So we have we are going to now so thank you, everybody. I think if you're okay with that, those are the changes we'll make to seven seven five at this piece and go with removing the off-site. Okay. David Hall is early, which is so exciting because we're going to just dive right in. And so for those of you who are participating remotely, we are on the floor at eleven, which is really irritating. I hear you. How are you? Our morning committees are now also being squeezed by having to start earlier and end earlier. So we are going to pivot now to Rick Segal is coming to join us, I believe, in five minutes. But I think it's fine if we begin with David, and then we're gonna hear from Richard Varn, and then we're gonna hear from Rick and hopefully be able to do all those things. So we're going to move to H 211, our data broker bill. And we welcome David. Yeah. Thank In a in a Hey. So lovely to have you here.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Good morning. It's good to see you. Good to see all of you. And

[Sen. Alison Clarkson (Chair)]: in a room that you spent so much time in.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I I miss this room, but, you know, I'm here. But I

[Sen. Alison Clarkson (Chair)]: I do like our traditional portraits of female farmers done by Juan Carlos who and Dan Dot Sagan's work. I love it. And this piece, which is part of the collection, but the others are all for sale.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: You put your touch on the room, and I love it.

[Sen. Alison Clarkson (Chair)]: Well, we have economic development. You know? If you would be kind enough to we're gonna turn the data data brokers, and we're going to address the secretary of state sections. Sure. Rick Sagal is, I assume, coming. Yes. Yes. And right. Having oh, there it is. Right in my gosh. Okay. David, take it away.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Alright. So for your record, my name is David Hall, the director of the Business Services Division, Secretary of State's office. Happy to, you know, yield to Rick at your discretion, obviously, madam chair, but in the meantime, you know, I I think there's sort of two pieces that touch on our office. One is sort of an upgrade, if you will, to the registration requirements for data brokers, and then the second part is a study at the end of the bill. You know, I we we have worked with the house and the AG's office to sort of fine tune the components that affect us. We're we didn't necessarily, you know, come to the legislature and say, you think you ought to change all of this up. It was these are substantive proposals. We're most of which we are substantively agnostic, to be frank with you. Our job is to collect this information. It's to organize it. It's to make it available to the public for scrutiny. It's to make it available to the AG's office for compliance and performance purposes, and it is to make information available to you as you do your public policy work. I mean, procedurally, substantively, the way this would impact us is we would work with our gender first on a contract amendment because this You're

[Sen. Alison Clarkson (Chair)]: dealing with the the study at the end?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Well, I'm talking right now about our registration process.

[Sen. Alison Clarkson (Chair)]: Reg the whole registration process.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: So just take one huge step up. We How's

[Sen. Alison Clarkson (Chair)]: it doing? I mean, you know, give us also enough. I mean, well The

[David Hall, Director, Business Services Division, Vermont Secretary of State]: the the data broker specifically or the whole thing? Well,

[Sen. Alison Clarkson (Chair)]: we're just focusing on data brokers. Sure.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Well, I wanna put it yeah. Let me frame it in the context of what we do. So, obviously, I mean, we're the filing office of record for businesses that are doing business at this stage for UCC filings, the Informed Commercial Group filings, and then we have this packwork of eyeballs, I like to call them. And those are things like telemarketers, amusement ride operators, utility cooperatives, data brokers. And the the point really of this initial legislation, which I worked on many years ago, was to have a basically a census of who is the data broker dealing with Vermonter's information. And if you're doing that, come register with us so we know who you are. Right now, I checked this morning, we have just over 300 data brokers who are actively registered per month. California has a much more robust system at this point, and I think the last I spoke with them, the estimates are there maybe could be as many as 800 that might end up being registered. So there's some delta between, obviously, third, fourth largest economy in the world, and Vermont, and who's doing business where, but

[Sen. Kesha Ram Hinsdale (Member)]: Well, I think that's a really important piece to pause on. The average consumer could assume that if there's someone who's registered at the data broker in California, they are very likely if it's a digital,

[Sen. Randy Brock (Vice Chair)]: you

[Sen. Kesha Ram Hinsdale (Member)]: know, it's mostly digital, they're doing business in Vermont. Sure. There is no one, there is no one who defines or oversees or releases what it means to do business in Vermont. So there are many common companies people might think of that they're using, and I did this with OpenAI, that are not registered in the state of Vermont. If I worry that there's too many bills that try and put a lot of pressure on the registry system as though it's something that's comprehensive, and it's there's no resources, there's no mandate that it's comprehensive. So, just want to make sure we are aware of what we're trying to get out of more registration requirements.

[Sen. Alison Clarkson (Chair)]: Well, I think we're wanting

[David Hall, Director, Business Services Division, Vermont Secretary of State]: to get through something. Yeah, think it's an excellent observation, and testified in response to a similar question you posed in other committee. Certainly, we are not the registration police. The law is self executing, but it's, you know, it's unlike many statutes. There's no five part test that says, if you check all these boxes, you are doing business in Vermont. Rather, we presume that if you have contacts in our state and you are engaged in certain activities here, the more activity, the more likely it is. But the statute, the way it's written, it's written in the negative. It says, just by doing these things doesn't necessarily mean you're doing business in this state, but it's a sort of a weight of the evidence test, which is not, you know, unusual in the law. Weight of the evidence is pretty normal, but, you know, sometimes it can be challenging, and also it can be questionable for businesses to know. Am I doing business? Am I not doing business? If they turn to us, we're we're not gonna give them direct counsel on whether they're required to register base, because I can't do a factual legal analysis on every business of how many contracts have you signed, what volume of sales, or do you advertise here, or do you own property, or all these things. I I don't have the capacity, like, a 110,000 businesses to do that kind of analysis. What would be the result of from of I think, or at least the intended result of this legislation is with a robust registration framework with more resources for the AG to be able to sort of scrutinize the registry, and in fact, compare it to California. I mean, the testimony that I heard is that they would say, hey, we've noticed that you guys are registered in California, and you're not registered in Vermont, should you be? And that starts there, and from there, goes down the follow-up, maybe enforcement rabbit hole. At bottom, we are the holders and managers of the data. Somebody else does something with it. The public comes to us and says, I want to know who the data brokers are. They download our records. AG's office comes to our record database and says, we see who is here and who is not here. Now what are we going to do with that information? Compare it to California. We're gonna compare it to other states. We're gonna compare it to the company's own statement of what their practices or their policies are or whatever. I don't know. But I

[Sen. Kesha Ram Hinsdale (Member)]: get so the so we wanna ask the HGF office.

[Sen. Alison Clarkson (Chair)]: Why can't office is not

[Sen. Kesha Ram Hinsdale (Member)]: Why can't they compare those records now?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Sure. I mean, they can compare what we do have Yeah. To what California has Right. And and see gaps.

[Sen. Kesha Ram Hinsdale (Member)]: Mhmm.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I mean What So, registration requirement that, like, you're observing, it's already here. The the universe is what the universe is at this time. You know, I think part of what this bill does is, a, it really expands the amount and type of information that would be in each registrant's record, and b, you know, it frankly steps up consequences. I mean, it raises the fee for registration. It raises the penalty for failure to file. It raises penalties. It poses new penalties for the omission of information or, you know, if you supply incorrect information. If you tell us you allows, you know, customer agency to opt out of these kinds of practices, and then turns out you do not, there are no penalties for that, and that's, you know, that's an enforcement aspect. It's not mine.

[Sen. Kesha Ram Hinsdale (Member)]: And does that mirror what California has? Why do you think they have 800 registrants instead of 300?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I don't know why they I mean, I don't know why. That's that's okay. But the the for us, you know, the big impact is we have to redesign the registration workflow. We have to build new, you know, mechanisms for checks, boxes that you check, documents that you

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: upload, blah blah blah.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: It will cost us money, but the fees should cover it. It will cost us time and work. That's what we do. It will ideally yield more information for consumers and for regulators about what's happening with these businesses if they do business. Well, that's it's not the objective. So that's the point. Right? That's the point. So that's sort of our first piece. Happy to answer specific questions about the substance of what they're requiring. I mean, like I said, I'm agnostic on what the data collection preferences are. I just have to build the thing. So as long as it's a clear roadmap to me, I know it's till, you know, how to work with my vendor to build out this workflow. Fine.

[Sen. Alison Clarkson (Chair)]: But the second thing that you that we're looking at is Yeah. It is. So that happily, at least, there is a model that has been fully fleshed out in California, so you have an opportunity to look at that and see how we could Vermont size it. Talk to us about the study.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Mean, fair. Ironically, you know, usually Vermont sizing works in our favor, but that doesn't always that's not always the case in the context of IT projects because, you know, systems cost what they cost regardless if you have 38,000,000 people or you have 700,000 people. So I'm not gonna prejudge anything, but we you know, this bill started its life with this single point of access deletion mechanism in the law, and we said we're not equipped for that, and we don't know how to do that, and we need to really take a step back and reflect on that, hence a study with some, you know, generous timelines. I'll tell you, from our conversations with California, it cost them over $4,000,000 to build the drop system that they have, which again, you know, serves 36,000,000 residents. And they've had at the time I last spoke with them, they had about just shy of 200,000 requests through that system to be dropped from data broker collection practices.

[Sen. Alison Clarkson (Chair)]: And that's not like it's only been open for a bit, right?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Right. Yeah. That's correct. So where that ends up, nobody knows. So the types of things that we would look at in the study would be, can we build this ourselves? Can we piggyback on the California system? Or is there some other mechanism? And when I say, is there some other mechanism to use right now, there are already companies that do this. You have to pay them, but they manage varying degrees of of sort of throughout time management practices. You can do like a one time, please go out and find all the data pokers and flush my information, Or you can do a subscription where they're repeatedly pinging these data brokers and requesting on your behalf that they drop your information. So there's a public, you know, model, but it's California, and it's expensive and complicated. And then there's a private model, and then maybe there's a Vermont model, but, you know, I I know that this has an appropriation for this work, and I, you know, I'll just be blunt. I understand that money may be in jeopardy,

[Sen. Alison Clarkson (Chair)]: and Well, the money is I wouldn't say in jeopardy. It's a negotiation

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Fair.

[Sen. Alison Clarkson (Chair)]: Between the house and the senate.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Fair. I mean, I I I certainly

[Sen. Kesha Ram Hinsdale (Member)]: Well, but we also haven't voted the bill out with the money in it.

[Sen. Alison Clarkson (Chair)]: Correct. So, I mean, that's what I mean.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: Probably It's

[Sen. Kesha Ram Hinsdale (Member)]: wanna take the pulse of this committee if that's the best use of money when we're also trying to implement the voting rights kind of other things that the secretary of state's office attention might need to be on in this moment.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Fair. And I How about different depiction?

[Sen. Kesha Ram Hinsdale (Member)]: Well, sure. But negotiation should include a consideration for is this the best use of $50,000 for now?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Yeah. I I I mean, I I think the the request for the funding or expertise and assistance is there because as much as I like to learn new things, I can't tell you the technical requirements that would be necessary for us to be able to avail ourselves of the California system.

[Sen. Kesha Ram Hinsdale (Member)]: Does the Secretary of State's Office manage the system in California?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: No. No. They have a whole privacy, robust privacy outfit that does all of that. Right. So

[Sen. Kesha Ram Hinsdale (Member)]: I think we need to hear from California, ABS, etcetera. But I we don't have $50,000 to just say that Well, we don't make it

[Sen. Alison Clarkson (Chair)]: not our decision at the appropriations committee, and we've made our case for rep you know, including it. And so they are We

[Sen. Kesha Ram Hinsdale (Member)]: wouldn't have made that case because we haven't discussed it.

[Sen. Alison Clarkson (Chair)]: We have, actually. And they are and the the house is very clear on it. So we'll see where we end up. So it's in it will be we're on third reading today, and it will then be part of the conference discussion. Thank you. That's sort of what on the study, that's what I think where we thought you'd probably sure. But me, I mean, it that's the question is, do we we gonna be able to finance it? That's let's find that out soon enough. And

[Sen. Kesha Ram Hinsdale (Member)]: Well, but, also, is it partially our job to answer those questions before we mandate the secretary of state's office to

[Sen. Alison Clarkson (Chair)]: do something? I think the secretary of state would probably have to we want consumers to be able to delete in a thoughtful way that they've data they wanted to leave. I think that's Well, we'd

[Sen. Kesha Ram Hinsdale (Member)]: be asking our our corporate filing system to do the work of a a different agency or group of people with different expertise.

[Sen. Alison Clarkson (Chair)]: Yeah. No. I don't I don't disagree. It may not end up there. If it but I think you're equipped at the moment to ask the key questions and to make recommendations with ADS to the legislature about how we move forward with this idea. And I think that's all we're asking is that we need a recommendation after looking at what it would cost, what whether we do it ourselves, what could we outsource it, you know, that's we don't have the time to do that in this committee. We're about to adjourn hopefully. So, I mean, I think that's where we have to ask the experts in order to do, you know, yes, Thomas.

[Sen. Thomas Chittenden (Member)]: Am I remembering correctly that one other state has implemented the system that this would study to see if we could, it's just California. Is that correct? I'm seeing you nodding. So I'm leaning towards the same area that I don't want Vermont spending our scarce resources to do a smaller economy on something that bigger states are going to place the trail on. So I would ask you, does this have to be done this year or could just as easily be considered a year out? Yeah. Or if the larger state placing the trail and setting the precedent for us to build off of it?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Sure. I mean, so this the study is just a study. Yeah. And and the first report is not due back until '27, and then a final in '28. So there's time. I I guess I I just wanna modulate expectations maybe. How about that? If if if we are charged with doing a study and there's no money and I can't pay a technical expert to tell me here so you need to design an API to tie into California system. I'm just not gonna be able to tell you how to do that. I might say this would work for other exploration, or we think people should just pay life lock. You know? Yeah. Right. You know, that that may be the result of what I get, but that's a it's a long time to sort of review it, and as you suggest, to see how it plays out in California. They built it. It took them several years. It cost them $4,000,000. You know? Am I gonna come back to you and say, Vermont just build this brand new system? Probably not, but I'd have to talk to experts about that. You know?

[Sen. Alison Clarkson (Chair)]: And so, you know, it has struck me that this study is being asked for the the secretary of state, but I I think we're we're right. ADS needs to be involved with this as well. Does it make I mean, we may or may not have the money. Sure. If we did have the money, it would be obviously, I think, something you would wanna be doing in conjunction with ADS.

[Sen. Kesha Ram Hinsdale (Member)]: Well, we Well, let's get ADS in here, and let's get California to just tell us on the record what path is the most worth pursuing at what thought. I mean, well, I do think we're I'm not willing to say we're ready to spend $50,000 when we haven't taken responsibility ourselves to understand the best practice that we're seeking. I would oppose a study at a $50,000 appropriation of money we don't have. There

[Sen. Alison Clarkson (Chair)]: we go.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: The last thing I guess I'll say is, you know, this type of mechanism would definitely represent a big step up for the Secretary of State's office in the type of data that we collect and retain. Like, right now, if you come to me and you put your Social Security number or your business's EIN in a filing, I'm gonna reject it. Cinch my hand because I don't want that data. I don't want the responsibility for managing it or retaining it. I don't want the risk of, you know, the various actors coming to my system. That's not what we do. And if So, you

[Sen. Alison Clarkson (Chair)]: you also see this as an exposure of the Secretary of State's office.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I'm saying if yes, if we are the ones who end up doing this however we do it, it will be a next level up in the type of security and operational function that we perform at the time. You know, we're we're not taxed. We don't have your birthday and your social and your mother's maiden and all that stuff. We don't that stuff. We're trying to help people not be, you know, exposed in that way. So, you know, that would be part of the theme that we would need to look at in the context of such a study would be what's the next level of security and what are the robust measures we need to assure that if we now are gonna become this repository of this sensitive information, how do we protect it? What are the rules, you know, around the transmission and use of it, etcetera? So it's definitely a complicated topic. I I don't wanna disabuse you.

[Sen. Alison Clarkson (Chair)]: In this discussion and development of this section, was there a discussion of of partnering with ADS on this?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I I think they have to be at the table because of security risk, but it won't just be them. It will also be our IT vendor or others who may wanna do the work. It will be It will have to involve a conversation with California about what works, didn't work. Can we use your system? Is that even technically possible? You know, it's

[Sen. Randy Brock (Vice Chair)]: complicated topic. Any additional staffing requirements?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: Not for the study per I mean, for the system, I'm sure it would be more work involved. Well, in

[Sen. Randy Brock (Vice Chair)]: the short run, it's what I'm saying.

[David Hall, Director, Business Services Division, Vermont Secretary of State]: I don't think so. Not for the study at least. But that's, you know, again, that's the money, the attach of

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: the studies to avail ourselves of people who have expertise to do too much.

[Sen. Alison Clarkson (Chair)]: Right. Okay. Any other questions for David?

[Sen. Randy Brock (Vice Chair)]: What if we didn't do this? We didn't do the data book to bill right now, for sure. What are the implications from your perspective?

[David Hall, Director, Business Services Division, Vermont Secretary of State]: We would keep on keeping on. I mean, there's literally already a registration requirement for data brokers, but it's thin. I mean, right now they come, they give us a few data points. They pay $100 a year. It's a little bit confusing. There's no amendment authorizing law, which has been a problem for us, so I appreciate that that's in here. It's a curious construct the way that it's sort of a retrospective registration requirement that arguably attaches in January only for activity you did the year before, so is the data kinda stale right now? Possibly. Are we getting full compliance right now? I have no idea, but it sounds like maybe not completely. So, you know, I think if you don't do it, it's status quo ante, and there's a data broker registry, and you can come look at it and see who's registered and

[Sen. Alison Clarkson (Chair)]: take it from there. Yeah, well, you, David. Sure. We are going to turn to Richard. Richard Garn, welcome.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Good morning. You so much for It's having

[Sen. Alison Clarkson (Chair)]: good to have you. Welcome. You have never been in this committee before. We're just gonna quickly introduce ourselves.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Thank you.

[Sen. Alison Clarkson (Chair)]: Thomas.

[Sen. Thomas Chittenden (Member)]: I'm Tom Chittenden, represent the Southeast Area of Chittenden County.

[Sen. Kesha Ram Hinsdale (Member)]: Kesha Ram Hinsdale, State District.

[Sen. Alison Clarkson (Chair)]: Alison Clarkson, Windsor, East Side Of Vermont.

[Sen. Randy Brock (Vice Chair)]: Randy Brock, Franklin County and Northern Grand Isle County. Good morning, Richard. David Weeks, representing Rolling County.

[Sen. Alison Clarkson (Chair)]: Richard, welcome. Introduce yourself share your input.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Happy to. Richard Varn, former state senator, state representative from Iowa, been the executive director of this coalition for sensible public records access for about twenty two years, working on public information and public data for about forty some, and been both an advocate for access as well as been a person that managed access. I was a CIO for the state of Iowa, the first one they had as CIO for the sixth largest US city, CTO and CIO for university and federal projects. So I've been on both sides of the managing data and advocating for its access. So I've been reading for the last twenty two years a few thousand bills on policy and public records access, and I'll be retiring soon. So I won't have that pleasure much longer. So I'm sharing with you what gleaned from that. I also spent time on the Uniform Law Commission's Uniform Data Privacy Act. That was two and a half, almost three years of work there, as well as on two other ones on data redaction tied to Daniel's Law and to doxing. And when I was a legislator, I advocated for and used many model acts and got them through the legislature. And I'm a big fan of trying to find, especially in the Midwest, we all sort of try to hang together in the Midwest. I know in the Northeast you sort of do as well, have sort of an affinity for some of your fellow New England states. And I always look to say, we've a lot of border cities, we've got a lot of border issues between, let's say Davenport and the Quad Cities and Omaha. And we always try to figure out how we could get along with folks. So I'm also, I'm not an absolutist on any of these topics. I'm a pragmatist with strong principles. So that's what you're going to hear. I'm going to have strong principles. Pragmatist with

[Sen. Alison Clarkson (Chair)]: strong principles. I like that.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: And I have a favor of accountability and the accessibility and the trust and truth that we get out of public records. I spent a lot of my career advocating for that. It's an odd little thing to be spending a lot of time on, but I felt it was worth my time to get freedom of information well understood and appreciated. So I'm going to bring that perspective to this. So in the Uniform Act, we were able to explain that the public records law, especially public records, but publicly available information in general, has its own set of governing principles and laws surrounding it. And as such, that was the statute that would govern the release of any data, its use and governance. For example, when your driver's privacy protection covered data gets released from your folks, the transportation people, they govern its release. They have strict contracts regulating its release, deciding how it can be used. In other cases, we have had thousands of discussed exemptions. Vermont has passed several dozen exemptions to the Public Records Act to protect specific sets of data from release. So we've been going back and forth since the 70s when the first Sunshine Law passed and since the Freedom of Information passed at the federal level, deciding what exactly would be a public record that was accessible to whom for what. And because of that and spending about two and a half years explaining that to the people of the Uniform Law Commission, they agreed that there should be a broad and general public exemption for public records and publicly available information. The reason that that was important not only is because that had its own governing structure and they're important, it's because there are many, many, many uses. It's easier to probably say what uses are not made of public records and what uses are made of them. So there's tons of uses that are made of public records across the spectrum of public, private, charitable, educational activities of all kinds. So when I see in the law, you have an exemption that is brought at first and then takes back things which doesn't align with other states, so Vermont would be an outlier. I've read and worked on the rules and the laws in all of the states that have passed a privacy or data broker registry or data broker regulation act. And this would be an outlier, especially in three areas and I'll point them out. Three areas are specifically on page 11 of 43 of the bill and they're in your publicly available information definition. And it specifically deals with and I'll come back to item two. Item two is good. I think I understand why you're doing that. But item three, item four, and item six under there, which is information based for sale, any inferences made from, anything made for sale or from a public website that's offered at the profile and any brokered personal information that's combined together. And I want to take each of those separately if I may. So the first one is information that's made available for sale is used by many, many people and inferences are also drawn from that. Public records or publicly available information that's made available for sale doesn't become private because it's made for sale. It's still publicly available, but this law would allow it to be deleted, creating a patchwork quilt with holes in it about what's available in databases and what is actually true in the world. Just as an example, LexisNexis is a database. This is for sale to lawyers and to others who might want to look up newspaper articles or look up cases. If I read this correctly, I would be allowed to go and ask them to delete cases I was involved with or newspaper articles that I was in that was in that database because it was made available for sale. And that's an example where we cross over both the utility of the data and the First Amendment right to speak about it, publish it, use it, talk about it, draw inferences from it and just think about it because we can't probably ever know something without drawing inferences and thinking about it. That's what gets us the inferences. Being able to make inferences from say, if I used data that was for sale, if I'd used data that was available publicly, say in the case of Clarence Thomas, if I made an inference about Clarence Thomas getting help from his friend to be able to acquire a house and I wanted to make an inference about what I thought about that, I think I have the right to do that. And I don't think that the databases that held that data should be subject to deletion because I can make an inference about that from it. So inferences are our right to think and our right to talk, and I think it treads heavily on the First Amendment. The last one is the brokered personal information. As you've written the law, you've broadened the definition of what is personal information, brokered personal information. So you've made it very generic and very broad. And you've said if anyone has that and there's a right and you say that the data broker must put on their website an opportunity to delete that data, how that could be deleted, then there would be asking them to delete data that would be part of this broker personal information. They would also have to delete the public records, publicly available information that's in that database. And I want to mention that in combination with that, if you look further into the bill, it's back buried a little later in May

[Rick Sagal, Office of Legislative Counsel]: I just clarify

[Sen. Alison Clarkson (Chair)]: what I'm legislative counsel. I believe this is all current law. This is all in kids code, current law.

[Rick Sagal, Office of Legislative Counsel]: So, Rick Stenkel with the office of the council, the definition of publicly available immigration, I believe, is once in kids code, I'll double check. Broker's personal information is not. That's unique to this.

[Sen. Alison Clarkson (Chair)]: That is unique to the because I know some of this is in kids code and some of it isn't. So I just was curious what what is? What's already we've already passed and what isn't?

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Yeah. Was going after the underlying section that were added new and concluding the parts that say that does not include. That's the part I'm after. Publicly available information.

[Sen. Alison Clarkson (Chair)]: I appreciate where you are. My understanding is that most of this was already in kids code, which we passed last year. So I was just curious which of those Romanettes were current law and which were added, and I'm unclear on that.

[Rick Sagal, Office of Legislative Counsel]: They do not testify. Okay.

[Sen. Alison Clarkson (Chair)]: It's which will testify after you. So That's great.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Yep. So if they're in current law or not, I would still object to them. So I appreciate your clarification though.

[Sen. Alison Clarkson (Chair)]: So the

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: other part that's buried back in there, it says that if there's a reason, you have a variety of exemptions as to why data doesn't have to be deleted, one of those, several of those stated, and then it stated, if in fact data is not deleted, it would have to be segregated. Then two clauses later you say you can't use it for any non authorized purposes, even if you don't delete it under the one exemptions. Just I can get you that spot in the bill thing. Give me

[Sen. Alison Clarkson (Chair)]: just Just us.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Yep, I will. Just give me a second. I got

[Sen. Randy Brock (Vice Chair)]: to jump

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: to browser window. Okay, I

[Sen. Alison Clarkson (Chair)]: think it's page 37.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Yeah, think that's correct. Page 37 and this clause one says you have to keep it segregated, and clause three says that you can't use it. I would just point out that the fact that you're saying that can't be used is sufficient. Segregating it into another database, having been a CIO, I can tell you that doesn't really mean anything. The important thing is making sure it's not used. Yeah. Your C, 13C, line 13, item C, not used, sold, shared or processed for any other purpose is sufficient. We raised this in the California Drop Act discussion in a Hudson Cook memo, law firm Hudson Cook wrote for us about describing how individuals should manage their databases. It's really difficult to tell all these people how to manage their data that way, so I would just say that that clause is not needed. But it does go back to the broker personal information and whether or not it's combined with publicly available information. So the conclusion of this is you've converted by these clauses, whether in statute or in the proposed law, these converted these publicly available bits of information into private data by their sale, by making inferences from them or by combining them with other data. That to me is not, you know, accommodating the reasons we have it for accountability, transparency, used public societal benefit, truth, fairness, the things that we need from this. We've done an interesting job of trying to balance between, you know, what is that you're going to do to protect the consumer. But there's a lot of things that create holes in this bill that allow bad actors, malevolent actors, to use the ways that they can delete data to enable them to do bad things. We need to strike the balance between those two efforts to make sure that people cannot use the right to delete or opportunity to delete data using this kind of a definition to get rid of information that shows them in a bad light appropriately, that is actually something that's true and something that people should know. So the last thing I want to mention is by being an outlier, I believe that you're going to put both Vermonters at a disadvantage on the side I just mentioned, meaning that there will be holes cut into this. Crazy quilt's a fun thing to make but it's not a to me a crazy quilt of laws doesn't make for a good structure if it leaves holes in the kinds of protections that we might expect and the kinds of uses we might want to make of public records and publicly available information. It also will burden Vermont businesses and Vermonters being being this outlier. Maybe the big folks can comply easily with some laws like this, but the local businesses always struggle when there's an inconsistency between states and laws and it's difficult to comply. So the disadvantages. And I want to close with this. He wrote this in the brief for the California folks, there's a lot of uses for public information. And on the discussion that was just held on a study potentially for do you want to do a drop act? California spent $15,000,000 or so in this couple million dollars a year to run the validation service to identify that the person is who they say they are who's asking, so that's a big deal. What we thought also is maybe you should mention that informed consent is an important part of this. There's a lot of benefits. I understand you've stated there's a lot of negatives that people don't like that comes from their information being shared. There are also a lot of benefits. A true informed consent would include things like telling people that they get public health and safety notifications, that there's civic engagement involved, that nonpartisan organizations use this to provide voter registration information, polling data, ballot stuff, education and scholarship information, identifying outreach to people to be eligible things, community resources, using it to target food assistance, housing, job training, social services, financial benefits, offer consumers discounts. If there's been a big storm, someone might come in and offer discount on roofing. These are the other side of informed consent to make sure that when people know when they're opting out and if you go forward with that, this kind of makes two points that there's a lot of great uses for this information. And if you're going to do an opt out at all, you should have informed consent and it should show both the benefits and the negatives of what they might get from opting out or deleting data. I'll stop there and take that.

[Sen. Alison Clarkson (Chair)]: No doubt, think all of us wish that actually with all these when we had the opportunity right now, ancestry.com evidently has a very clear, as you go through the whole process, a very clear you would make choices all the way along so you're not at the end of transacting something, having pages and pages of stuff you're never gonna read. But it would be wonderful if every data collector, every opportunity for collecting this had had an informed consent opportunity where it said, you know, these are pluses and minuses. Do you want it to leave or do you want keep it? I mean, it would be great if that existed and was embedded in every one of these choices that we had. But I I agree. I think that's as much on the businesses as it is on all of us considering.

[Sen. Kesha Ram Hinsdale (Member)]: I think he's saying all our businesses Yeah. A harder tech doing that. No. I Amazon, ancestry.com, they could get through all of that much more ease. Yeah.

[Sen. Alison Clarkson (Chair)]: Richard, what Thank you for this. Heck. I mean, I'm just curious. You're you're right. It would be great if the federal government would act, and we didn't have to do patchwork quilts to protect our consumers. Where do you see us in this challenging administration moving forward on any kind on any of this protection nationally?

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Well, you know, I was used to make the joke he'd never go broke betting against tax reform or comprehensive privacy law in The United States. So still still wish willing to make that joke, although it's not funny. I don't I don't think it's very easy for them to get there, currently in the current congress, but there is a bipartisan coalition that's been talking about it. I think that there's probably more agreement on what to do around young people to try to protect them both in the AI space and around privacy issues than there is around general privacy. It's hard to write general data protection privacy law for The United States, and especially since we have multiple ones already that provided those balancing tests. So it's difficult to navigate between the industries and people that have been figured out how to make it work in these different sectors and trying to come up with the general principles that applies to everybody. So I think it's a tough row to hoe for the feds to come up with one, but which is why we spend so much time on the Uniform Data Privacy Protection Act to say, let's at least get a model. And for me my focus is mostly on the publicly available information part of it. So I can stray about anywhere you want since I'm an eclectic person, been in politics a long time, I have opinions. We focused on that part to at least say the public records actors are are your own. Your your own public records act, you all in Vermont have fought and discussed it and focused on it both with the press and the advocates and the gadflies and the agencies and the legislators and everybody has had a chance to weigh in on that. And that law defines what should be publicly available. And I just want to protect that. I want to protect the uses we make of it and the integrity that it has. I don't want it to be deleted in places that then that truth disappears from that database. That's like this, the uniformity I'm looking for is at least protect that part.

[Sen. Alison Clarkson (Chair)]: Great. Thank you very much. Any other questions for Richard? Okay, Rick, why don't you Richard, thank you very much. Thank you. You submit your testimony or have you already done so?

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: I was gonna hear the any of the questions that you had and I will submit a written document after.

[Sen. Alison Clarkson (Chair)]: Right. That would be splendid.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Great. Thank you so much, mister Chittenden. Thank you, members. Thank you.

[Sen. Alison Clarkson (Chair)]: Yes, thank you for joining us. Are you two hours behind us, you're two hours behind us, just one?

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Just one, I'm in the Midwest, so in the Central, so Yes, I'm in Texas

[Sen. Alison Clarkson (Chair)]: in yeah. There's part of it, Okay.

[Richard Varn, Executive Director, Coalition for Sensible Public Records Access]: Just one back, so. Alright, thank you though.

[Sen. Alison Clarkson (Chair)]: Rick, welcome. Good morning.

[Rick Sagal, Office of Legislative Counsel]: Rick Siegel with the Office of Blipshead Points, to walk through a proposed committee amendment, if that's where you'd to begin, or I can answer questions.

[Sen. Alison Clarkson (Chair)]: You wanna answer any of the questions? Because I think you thought there were some questions raised with Richard that you and with David that that I thought you wanted to address before we move to the amendment.

[Rick Sagal, Office of Legislative Counsel]: So I and here, Simeon, Zoom link. Question about the same definitions, I hesitate to equate that have that any meaningful when definitions matter or don't match. But the policy available information in this bill does match the kids code definition, but, again, they're different laws. Mhmm. Right. The kids code, there's no deletion of data. There's no data broker regulation. I think it's good in some ways for consumers and businesses to have this to know what publicly available information is. I don't know if I'm associated with the Public Affairs Act. That's something to me separate. That is information that the public has a right to that the government does. It's not consumer information, but it's government information. So I would separate those two things personally. And the brokered personal information is just this bill. We don't have other laws that reference brokerage personal information because it's specific to data brokers. And keep in mind, this is a data broker bill. We are in the world of data brokers. We're not it's not a comprehensive data privacy law, which would apply to all businesses. Right. David Hall, where I represent how many? 200 are registered in this state? Yeah. 300? Yeah, I don't know how many of those have the wrong address. I don't know. Right. But important to remember, the world that we're talking about here is the data broker world, which is not every business in Vermont or every business country. Right. Exactly. Okay. Assume I got a link to share my screen? Email, great. Are there any other questions that I missed that didn't come right away from Dave or Same as with

[Sen. Randy Brock (Vice Chair)]: respect's question about data brokers. Some businesses don't have any connection with data brokers. Just about every business I think of does use some kind of data broker and nothing else from the credit bureau, for example, that exchanges information about their customers. It's hard if that business accepts credit. There are probably other kinds of files that they look at that may contain either customer information or vendor information or whatever?

[Rick Sagal, Office of Legislative Counsel]: Data broker's still a need that businesses have, depends on

[Sen. Randy Brock (Vice Chair)]: how The problem is, are we creating systems in which we have various pieces of data regulated by laws such as the kids code over here and this bill over here that may conflict or leak things out, but if they really do overlap, it ought to be, in effect, reconciled every time we do

[Rick Sagal, Office of Legislative Counsel]: a privacy That's actually a good question. Part of my job in what I do is to inform you all of these potential conflicts and opportunities to reconcile. I think that's something that I should do and I'm tasked to do, and that's why we have portfolios, and my portfolio includes data. So I'm aware of this bill of S-seventy one, page six thirty nine, Genetic Data Privacy, comprehensive So I have kids code, all these bills floating around.

[Sen. Kesha Ram Hinsdale (Member)]: There's an education.

[Rick Sagal, Office of Legislative Counsel]: All these bills Too much. One way or another. Thank you. I'm a pilgrim.

[Sen. Kesha Ram Hinsdale (Member)]: It is not good legislation when it is in all of these different places.

[Sen. Randy Brock (Vice Chair)]: Well well, the issue is are we

[Sen. Kesha Ram Hinsdale (Member)]: And not any fall difference.

[Sen. Randy Brock (Vice Chair)]: Looking to recognize we start with this bill right here. Are we able to see that it reconciles with all the other bills that are ought to reconcile?

[Rick Sagal, Office of Legislative Counsel]: So this one, I think, is totally separate because you are talking about data brokers, and they would be covered by data privacy if that were to pass on the government does. But I think this is something that is more specific to a certain type of business as opposed to like, probably genetic genetic data privacy. That the world of that deal is these direct to consumer genetic testing companies. There are a handful of those in world that do that. There's a handful of data brokers in the world. So I think maybe bigger handfuls.

[Sen. Alison Clarkson (Chair)]: I was gonna say, 800 is a bigger handful.

[Jamie Feenan, Consumer Data Industry Association]: But you're you're talk yeah.

[Rick Sagal, Office of Legislative Counsel]: You're talking to three. Sure. But it's more than three. Two genetic There's more than three genetic those are the three names, but there's probably close to a 100 that you don't know about. You would not they're not household names for the geneticist.

[Sen. Kesha Ram Hinsdale (Member)]: But I guess can we pause on, like, what are we hoping this bill accomplishes? Because because if we're hoping it gets us 800 data brokers in our registry instead of 300, then okay. You know? I I don't think we'd write the bill this way to to do that. I wouldn't write the bill this way to do that.

[Sen. Thomas Chittenden (Member)]: Related to that, I do wanna answer that question, but I just wanna pick up on the last comment you made too. I do think there are too many bills floating around, and I thought I heard you say that this is standalone, but I've also heard that s 71, in many ways, that passed by the senate has some data broker components to it. Is that a mistake?

[Rick Sagal, Office of Legislative Counsel]: So s 71, depends what happens to it, could As passed by the senate. As passed by the senate. It has every every data privacy bill that is active in the country has a deletion mechanism, or an opt out in one of those two banks, if not both. So, yes, s 71 has passed by the senate. It allows consumers to delete data with exemptions. Right? There's a static order bill. So this is specific to data brokers who use data for business purposes. The Comprehensive Data Privacy Bill is not always data that's being used for your advertising, marketing, whatever that is being used for. So on that same point, I'd

[Sen. Thomas Chittenden (Member)]: be supportive of starting to unify some of these discussions, bringing the s 71 as passed by the senate into this construct of h two eleven with the data brokerages. That's my question about what we're trying to accomplish.

[Sen. Alison Clarkson (Chair)]: Okay. I am really focused on data brokers. That's the bill we have in front of us, and we have to get it out by next Friday. So I I think that that You don't have to get it out. Excuse me. That is what the pro tem Well, and if we're gonna pass

[Sen. Randy Brock (Vice Chair)]: it at all, we we can't pass a bill that makes sense.

[Sen. Kesha Ram Hinsdale (Member)]: Right.

[Sen. Randy Brock (Vice Chair)]: Absolutely. And if we don't have a bill that makes sense

[Sen. Alison Clarkson (Chair)]: I think this bill

[Sen. Randy Brock (Vice Chair)]: makes with the other things that we're doing,

[Sen. Alison Clarkson (Chair)]: we should pass it at all. Right. But I think this bill makes sense. Think I this is a helpful addition to protecting our Vermonters from having their data sold when they don't want it sold to places they don't want it sold. We heard a great example of this with ICE the other day in terms of how our LexisNexis information was being sold to ICE. So no. I'm sorry. I think this has clear consumer protection in it that we are wanting to address as people who are responsible for protecting Vermonters. I do not I I think I I'm trying to be pragmatic, as Richard said. I'm trying to be pragmatic with our values in place, and I think that we can actually do that in this narrow narrow circumstance. So data privacy bill is coming at us. There's no question. It will come at us, and it will be here. But at the moment, this is a separate piece of protecting data from being sold to actors. We do not wanna have that information, you know, or we don't want that information sold before they set you back. It it does that well, I through the whole bill, and I I actually would like to go through the amendment that we have in front of us because I have to leave in a few minutes. And I think let's let's look at the exemptions that I think we are looking at, and we are working towards compromise on this with issues that have been phrased with prior. And I think we're working on trying to get to yes with exemptions that that work. So, Rick.

[Rick Sagal, Office of Legislative Counsel]: Okay. In RAP 1.2 of the committee amendments, the first and second instances are technical grammatical changes, so nothing substantive. I'm happy to explain the Ask Passed by the House version, the subsection subdivision a on line 10. It just wasn't worded correctly. It's still the email, Internet, and phone number of the data broker. So fixing that order of classifications or information. And then the second instance of amendment, again, the wording was incorrect. It's nothing substantive here, just rephrasing how that item two on line 15 was worded. On page two, instance three. So because this is an instance of amendment, I'm gonna refer to the bill that's passed by the house if this is amending. We are amending subdivision C 3 B, which is on page 36 of the as passed by the house. You can go on a second, page 36.

[Jamie Feenan, Consumer Data Industry Association]: Line 11.

[Sen. Alison Clarkson (Chair)]: Sorry. What page on the original?

[Rick Sagal, Office of Legislative Counsel]: Page 36. And just to give you the leading language, a, this is the deletion exemptions for data brokers. So on line three, a data broker may deny a consumer's request to delete the consumer's broker personal information to the extent that no change to a. B, the broker personal information is so subdivision I, Romanette I, it is being removed and replaced by what is in the amendment. So you see data subject to, and you have two exemptions, five of Grant Leach Bliley, as amended, or Title six of the Consumer Credit Protection Act, that's fair credit reporting, and then regulations for both of those that are adopted in the Act. So these provide data level exemptions. If a entity is processing data that is subject to one of those two federal laws, they would now have to delete the data if the consumer refessed that it would be deleted. They're still out of River. They still have the register, still have the pay to pay, but they would now have to delete the data.

[Sen. Alison Clarkson (Chair)]: Okay. So this is a data level exemption? Yes. Okay. Any questions?

[Rick Sagal, Office of Legislative Counsel]: So, can I do the comparison? If it's important to say, because you may hear that's the other option, is it important to be entity level exemption? Why don't

[Sen. Alison Clarkson (Chair)]: you move your screen up so that we could see the

[Rick Sagal, Office of Legislative Counsel]: Yeah, right. When you use entity, so what that would mean is that an entity, let's say a bank, car dealer, paid lender, right, there's a whole group of entities that would meet grantees widely because they're a quote financial institution, right? So it doesn't matter what data they process, because they're an entity that is governed by these one of these two acts, they would not have to delete anything single statement. So it's a broader exemption, and you're free to do that. It's a broader exemption. The data level is specific to the data that is covered by one of those key laws, which is nonpublic personal information for Grant Nick Wiley, Perkin reporting, similar consumer nonpublic information, that would be used under federal law that consumers have rights with as well. The reason you have exemptions here is because federal laws govern these privacy practices, but they're not gonna be as comprehensive as two eleven. You can be more competent. You can be more protected with consumers. That's up to you all. The federal law has a baseline protection, privacy protection. States are allowed to give more privacy than they want. Does that help explain the options? That's what it comes down to, right? Banks, auto dealers, they're already complying with federal law, hopefully. Right. There's PRA if they don't comply. They can be sued by consumers if they don't comply. However, states give more privacy, and that's the argument, is that how much do you want to give? Right. It's policy, is what makes sense.

[Sen. Alison Clarkson (Chair)]: Keep going. So

[Rick Sagal, Office of Legislative Counsel]: those are two So you're removing the Fair Federal Reporting Act, which is, I think, included in Subdivision 2, the woman at II. Yeah. The fourth instance, I'm on the same C3B, going down to page 37 of the bill, striking out line three through five, the process solely in the data broker's capacities. So keeping that introductory phrase, process solely in the data broker's capacity as a process of two, a new exemption, the state, or a political subdivision of the state. So if a data broker is processing information for the DV, CHS, or a local town, county, that that worker would not have to delete the data because they are conducting work on behalf of a government entity, state, federal, state, or local.

[Sen. Alison Clarkson (Chair)]: And is all of that data, all of that government, or state or political subdivision? Is that all of that publicly available? No. No? No.

[Rick Sagal, Office of Legislative Counsel]: That's some of it. Your address?

[Sen. Alison Clarkson (Chair)]: Yeah.

[Rick Sagal, Office of Legislative Counsel]: Depends how you share. If the consumer by consumer thing, sometimes you share that information, or you make it publicly available on your own. Okay. Romanette 2 does not change, it's just being structured differently. This is to which consumer has a direct relationship. So, again, if the consumer, if you have a relationship with a bank insurance company, and that company that you have that relationship with has a data broker, proxy or information, that is exemptive, and they would not have to delete your information. Got it.

[Sen. Alison Clarkson (Chair)]: Yeah.

[Rick Sagal, Office of Legislative Counsel]: Three, a business working on behalf of another business, so basically, data broker that has a direct relationship with the consumer as a term of decline, same thing, direct relationship, provided that the data broker is a nonprofit organization established to provide enrollment data reporting services on behalf of post secondary schools as Project Public 16. This is a very specific use case. You heard testimony from clearinghouse, I believe. They do education

[Sen. Alison Clarkson (Chair)]: Yes. Certification. In response to Tracy's Correct. The education

[Rick Sagal, Office of Legislative Counsel]: data. Degree verification. Right. That that type of work. So you have to be nonprofit. Not all these entities are nonprofits that do this work, so they would not be exempted. You have to be nonprofit, and you have to work directly for a business that has a relationship with the student in this case. Right.

[Sen. Alison Clarkson (Chair)]: Okay, so this responds to the request tracing. Very specific use case. Yeah.

[Rick Sagal, Office of Legislative Counsel]: So that ends the exemption sections. You're increasing the exemptions. You may want There may be a request for more. You can certainly get more exemption from the committee on what you

[Sen. Alison Clarkson (Chair)]: wanna do. Okay. So before we go further, any questions on these? These are pretty big compromise exempt this is a this this is an amendment that really represents some compromise. And the AG may want to weigh in on this. I I don't know who else in the room would want to weigh in on this, but this reflects some compromise. Bridget, Jamie, Todd.

[Sen. Kesha Ram Hinsdale (Member)]: Todd, do you want to first, or would you like Yeah. Will just Who

[Sen. Alison Clarkson (Chair)]: would like to go first? Todd. Happy to just

[Bridget Morris, Morris Strategies (for S&P Global)]: weigh in at Bridget Morris on behalf of Morris Strategies, and I'm here on behalf of and P Global who is a registered data broker who works with the DMV on the driver's privacy protection act. And we are looking for the same exemption request that is in s 71 that's passed by the senate and also the current version that's in house commerce, which is which the language is hold on. I have to pull up the exact language. But an exemption for the driver's privacy protection act of 1994, 18 US code section twenty seven twenty one to twenty seven twenty five. And Jamie, I don't know

[Sen. Alison Clarkson (Chair)]: if you believe that Yeah.

[Jamie Feenan, Consumer Data Industry Association]: Feenen on behalf of Consumer Data Industry Association. You're mayor of Alsera Owes was here last week testifying on the issues that they're identified with the. And I think it's similar to what Bridget just mentioned. Sarah mentioned specifically the need for legitimate use exemptions, those included GLBA, which is here. Appreciate it for that one. Yeah. This is a different version of fair credit reporting that we don't see in other states that's proposed here. Our preference would be for the It

[Sen. Alison Clarkson (Chair)]: may not be in other states, but does it work for you as a compromise?

[Jamie Feenan, Consumer Data Industry Association]: Still having my client check on that. Okay, great. The peers, the peers, talked about it all morning, lack of consistency in the bills. If it isn't the same, are we looking at treatment of the same data, but for two different purposes, this bill and under s 71, which is an implementation challenge to say it is. The third is, as Richard just mentioned, the the drivers protection act, privacy protection act. And then outside of this, of course, Sarah raised enforcement provisions, concerns related to

[Sen. Alison Clarkson (Chair)]: the funding and proper federal action. Todd? Todd

[Todd Daloz, Vermont Attorney General’s Office]: Daloz from the attorney general's office. We don't take a policy position on the exemption levels. I think as Rick described, broadly speaking, entity level exemptions are the the broadest and in in one perspective, from privacy perspective, the least protected for consumer data protection, data level exemptions are the next one, and use case is is the most specific. I think these are all data level exemptions. Certainly happy to keep tinkering with language in a way that works. It sounds like, you know, DPPA, as an example, the Driver Protection Act, similar to the other two, has a a pretty strong degree of consumer data limitation language in it. So happy to look at that if it's helpful to the committee. And I would also add that given what c four of this section, the protections provided there and the limitations on the use of data, that seems to provide a good degree of consumer protection even with these broader data of exemptions. So, yeah, we don't take a strong policy position here. Happy to work on

[Sen. Thomas Chittenden (Member)]: a compromise language that helps you

[Sen. Randy Brock (Vice Chair)]: with those things. But

[Sen. Alison Clarkson (Chair)]: we're moving in the right direction, Bridget and Jane.

[Sen. Kesha Ram Hinsdale (Member)]: Well, certainly the DPPA isn't mentioned yet in this amendment. We'll it would be

[Sen. Alison Clarkson (Chair)]: get to that. Yeah. Jamie? GLPA is good. Okay. Good. Zach? Wanna explain. Sure. Zach Combinelli, consumer protection advocate for BPHRT from our Public Interest Research Group.

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: You know, I mean, when I testified, obviously, we made the case that adding any exemptions, you know, limits what people can delete. So Sure. While we certainly would not you know, if this was a bill we were drafting, we would not include these exemptions. But in terms of compromise, in terms

[Rick Sagal, Office of Legislative Counsel]: of moving the bill Yeah.

[John Gray, Outside Public Finance Counsel (Bond Counsel)]: We still would support this bill

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: with these exemptions in there. We think it would be beneficial to consumers. Going to the question that was kind

[David Hall, Director, Business Services Division, Vermont Secretary of State]: of raised, you know, a

[Zach Tomanelli, Consumer Protection Advocate, VPIRG]: little while ago, you know, whether or not the comprehensive bill is passed, is this bill itself worth moving? We still believe yes. I mean, it deals with data brokers. Consumers do not have a direct relationship with data brokers. They have very little rights with regard to that. This would give consumers the right to request that data brokers delete. We are now adding in some exemptions, to to limit some of that deletion right, but, again, this is still, we think, worthwhile. So support the compromise and the continued discussion to get us to a place that works.

[Sen. Randy Brock (Vice Chair)]: Thank you. As a practical matter, is there anything that any of you see in this bill that so conflicts with other privacy bills that they have that implementation is made much more difficult,

[Sen. Alison Clarkson (Chair)]: if not impossible. Well, I think Jamie, yeah, need to go. Jamie raised one. As much as we can spring up I'm wondering

[Sen. Randy Brock (Vice Chair)]: if there are any others. The whole deletion section is in Kesha's. The whole deletion section? Well. You be more specific about that?

[Jamie Feenan, Consumer Data Industry Association]: You remember California's DELETE Act came after they had a comprehensive privacy act. Privacy Act had exemptions built in legitimizing purposes of California legislation. The delete act built on that privacy act and incorporated all of those exemptions that had already been discussed. Your this bill is kinda getting ahead of that because there is no comprehensive privacy law in Vermont. The 71 passes? Yes. So, ideally, Vermont would do a delete act after copying the privacy. But, again, in the privacy bill, there's already a delete option for for every in you know, every business that collects data, not just data, it includes data workers, but it includes everybody else. So there's a compliance law with plaintiff. This here with inconsistencies creates two separate you know, what do we do with an individual that wants to delete over here that's protected for GLDA, for example? Well, that's not a good protected for commercial credit. H2-eleven doesn't have that same exemption, so what do we do with a request to delete a notice of systems?

[Sen. Randy Brock (Vice Chair)]: Should there be, almost in any bill that we pass, something, some language that allows it to reconcile with other privacy bills that we have in Vermont?

[Sen. Alison Clarkson (Chair)]: That's a big question. I'm going let you continue this. I have to go to a meeting in three minutes, so I just want to tee up the next piece of the amendment because you haven't seen this yet. And we'll come back to this because obviously we're still in this discussion. But I just wanna let you know that Rob Plunkett, who is currently the chair of JITAW has, which is, I'll just remind you, the joint- Information Technology. Information Technology Oversight Committee. Oversight I think you serve on it, right? And Rob Plunkett has asked for this to be included. They are very much wanting Chittenden is very much wanting to add two members to the cyber sec advisory council, two legislative members. So I just I just wanted to tee that up. It's not a it's not a huge list here, but I just wanted to give you the context for this. It helps build it helps build yes. Coming. Okay. So I just wanted to give you that context, but then feel free to go back to that conversation. I just wanted to give you the context. This is a request from Rob.

[Sen. Randy Brock (Vice Chair)]: Let's I'd like to comment on that. Jai Talk hasn't met all year. I don't have any issue with these additions, but it's not a Jai Talk plus. Jai Talk hasn't met. Yeah. No discussion. It's controversial. Rob. Yeah. So press from this. But the rest of the committee was not aware of it.

[Sen. Kesha Ram Hinsdale (Member)]: Why can't he put that request in a bill in his committee?

[Sen. Randy Brock (Vice Chair)]: No,

[Sen. Kesha Ram Hinsdale (Member)]: I'm sorry. I mean, whatever the committee's called out, institutions and

[Sen. Thomas Chittenden (Member)]: IT. I think it's most germane

[Sen. Randy Brock (Vice Chair)]: here. Okay.

[Rick Sagal, Office of Legislative Counsel]: Walk through language to you. Yeah. Validity? So I will say this language came straight from another bill, h five sixty. So it's a house bill. I forget the sponsor of the bill. So it does a couple of things. You know, we can have a discussion about the cybersecurity advisory council. We do have two members from here who may may know about it as well. This is a council that was created, I believe, four or five years ago, that meets, on a pretty regular basis to advise the state on various cybersecurity issues. This bill, this language, is copy and paste in Form five sixty. There's no legislative members on this council, and I think there's request that have these two members added. Fairly unique in that it's specific to committees. Usually, you have the speaker or the committee and committees appoint those members, but this language would just have the chair of house energy and infrastructure and the chair of institutions be on the committee and a member from judiciary.

[Sen. Kesha Ram Hinsdale (Member)]: This is a gov ops

[Sen. Alison Clarkson (Chair)]: for class. I mean,

[Sen. Kesha Ram Hinsdale (Member)]: that's all I'd say. It's not directed at you, but we I sat on the ops. I'm surprised. I don't know if the chair remembers this or not, but when we created the AI council and the cybersecurity council, etcetera, the and and anytime we're just adding new legislative members to, like, a random group that none of us have jurisdiction over, it's like it should go through.

[Sen. Randy Brock (Vice Chair)]: That's money from that and whatnot.

[Sen. Kesha Ram Hinsdale (Member)]: Yeah. So any and if we get too specific about who's supposed to be appointed, etcetera, that's a

[Sen. Alison Clarkson (Chair)]: whole gov ops question. It's just just I don't know.

[Jamie Feenan, Consumer Data Industry Association]: Chair

[Sen. Thomas Chittenden (Member)]: should sign gov ops and then

[Sen. Alison Clarkson (Chair)]: Yeah. There.

[Sen. Randy Brock (Vice Chair)]: Sorry. Can speak out. Excuse me.

[Rick Sagal, Office of Legislative Counsel]: The sixth section is related. The council is set to sunset on 2028, and the request to push that to two thousand thirty three to give the floor time to meet. Take So care of that's the amendment. No other changes. Happy to answer more questions.

[Sen. Randy Brock (Vice Chair)]: Any further comment on the amendments that you've heard so far? Open the enthusiasm. It's a very popular amendment.

[Sen. Thomas Chittenden (Member)]: I've got seven emails on page two eleven with very, complicated requests for changes in

[Sen. Randy Brock (Vice Chair)]: the language, so I don't even know how to start to cite right through these things. I know So

[Sen. Thomas Chittenden (Member)]: I don't know if I'm looking at other Japanese cases

[Sen. Randy Brock (Vice Chair)]: as well. Have you have you presented those to the I'm not ready

[Sen. Thomas Chittenden (Member)]: to present them, but I

[Sen. Randy Brock (Vice Chair)]: just sent you an email.

[Sen. Kesha Ram Hinsdale (Member)]: Yeah. Yeah. So and I I'm happy to say this on the record. I received a request that we consider the specific needs of clinical research data. That is like, So considered third parties to data brokers and they manage a lot of clinical research that people sign up to participate in, etcetera. I tried to get into Thomas because I tried to cut this part of my brain out and that being the person who's dealing with data privacy, I think what's clear is that this bill is not ready to be voted out today. I don't know what day it is, or tomorrow.

[Sen. Randy Brock (Vice Chair)]: In terms of the concerns that were expressed,

[Sen. Kesha Ram Hinsdale (Member)]: were there any specifics to that? Everyone's wondering if they fall under this bill because it has unique definitions, unique exemption. I think the concern that got raised two years ago with the data privacy bill as well is lumping together things like genetic, biometric, consumer, etcetera, and then lumping in who's the data broker who manages this information gets extremely complicated. And and if it doesn't align with other states' bills, then we are uniquely being asked to account for what this bill would do or not do to different entities. And I think we have that is the problem with that with all of these now.

[Sen. Randy Brock (Vice Chair)]: The issue with with a lot of this is the sometimes inconsistency with other state laws who are handling data of the same type and often from the same originating sources, some of which would be in our database depending on how it's constructed and in other databases and are treated separately on a state by state basis. That is a real complexity problem that I think would be difficult for the industry, particularly if the data is not located here, which most of it is not.

[Sen. Kesha Ram Hinsdale (Member)]: Right, and I think that's Mr. Barnes' point is, unless we are clear on what we're trying to accomplish, then we start to bring in a lot of other entities that we haven't determined whether or not we believe they have a legitimate use for that data.

[Sen. Randy Brock (Vice Chair)]: There could obviously also be inconsistencies in how data about from ours is transmitted depending upon what database it's in in the first place. Yes. And if the databases are treated differently, sorted differently, and identified differently, that could create other issues. Again, the reconciliation nature, I don't know, is particularly addressed here.

[Sen. Kesha Ram Hinsdale (Member)]: No, because we keep them layering on board exemptions, but that's just, in my mind, bad policy making.

[Sen. Randy Brock (Vice Chair)]: The other members like Vinnie, in terms of this being ready for prime time at this point, any observations as to where you are on it? No, please. Oh, hesitant. President. President and watching the watching the landscape here are quite not not quite convinced, but listening. Senator Chittenden?

[Sen. Thomas Chittenden (Member)]: I think regional consistency is important to me since we can't trust the federal government to apply it. I think that was quoted by Mr. Barnes there that it's easy to bet against that happening. I'd like to make sure that we're not getting out of ahead of the rest of the country with non enforceable, very practical legislation.

[Sen. Randy Brock (Vice Chair)]: Let's talk about enforcement for a second. What is your perception about how Vermont enforces this if in fact we pass it? If there's an enforcement mechanism that makes sense and that is sufficiently clear that, A, we have the ability to do it, we have the will to do it, we have the departments available that have the confidence to do it, and that it really serves in public interest. Maybe that's a question where the attorney general's office start with.

[Todd Daloz, Vermont Attorney General’s Office]: Yeah. More than happy to respond, senator. So, the way that two eleven is drafted, it is layered on top of the existing both date of birth of law that sits on the books already, and the Security Breach Notification Act that is also operative. Are obviously a lot of new pieces in this, again, mainly focused on the operation of data brokers, not any entity that holds consumer information. I do think

[Rick Sagal, Office of Legislative Counsel]: it is important to think of

[Todd Daloz, Vermont Attorney General’s Office]: those as a little differently. I'll try and come up with an analogy here, but as far as enforcement goes, we do currently enforce security breach notification, and we do enforce the data broker registration. What we have seen is that there are some changes in this bill that will help the existing enforcement. By way of example, a couple years ago, we came to find out about a company that was taking airline data and was operating as a data broker, collecting and selling that airline ticket data. So you can think about that data as, generally speaking, the who, the when they travel, the where they're going, the price of the seats, that kind of data was getting collected, packaged, sold.

[Sen. Kesha Ram Hinsdale (Member)]: Are they in the California Data Broker Registry?

[Todd Daloz, Vermont Attorney General’s Office]: So I I have not studied the California Data Broker Registry. They are in our Data Broker Registry now Okay. Because we identified them, reached out to them, and said, you're clearly a data broker under state law. We engaged in, an enforcement action with them. You know, it's a it's a I I used the the word with, intentionally. It was a negotiated settlement, but, they had been in violation of Vermont law in our view for quite some time, existing Vermont law, not even this new bill. And, you know, at the end of the day, they they didn't pay as hefty a penalty as we think was appropriate in this circumstance. This new bill would help expand our enforcement ability there. But, again, that's a circumstance where we heard about it, we investigated it, we were able to follow through on it. This bill would strengthen our ability to do that with the registration element. Security breach notification, you know, there was a big matter years ago now that involved a big data breach that Vermont led on and ended up, you know, protecting a lot pulling back a lot of Vermont consumer information and and recovering a good amount of penalties from a major data broker, a a major data breach, from a large player across the country. Again, that's existing law. When we look at h two eleven, as I think, mister Hall said on behalf of the secretary of state's office, without official numbers, we think there's a tremendous degree of underregistration, and that's where studying it, finding some kind of partnership either with California or another entity, I think Vermont filling it alone, just my viewpoint, is probably too big a lift.

[Sen. Kesha Ram Hinsdale (Member)]: Just so folks know, California has 566 registered data brokers, not 800. They're all listed, and you can see which ones. It's a great it's a great registry, I think, for I I don't know that recreating it here wouldn't would accomplish anything. I I encourage people to look at the California Data Road for registering, including the HE's office, so they can know what we're looking for. I I clicked on, for example, citizenship. Who collects citizenship data? We should be paying really close attention to that because, you know, that is probably a concern. That's what I'm concerned about.

[Sen. Randy Brock (Vice Chair)]: Is that a basic search for California Diner Broker?

[Sen. Kesha Ram Hinsdale (Member)]: Yeah. It's it's CP, it's Cal, yes, is a very basic search. I just always look up California Data Broker Registry, and it says on here the 11 data brokers that collect citizenship information and who they sell that data to, whether it includes law enforcement, federal government, etcetera. I think if we're trying to actually do the job of policymakers, we look at this, see if it gives us the kind of information we want, and look more deeply into into these data brokers. I don't know what recreating this data broker registry in our state would do if you're already able to look at the 266 state of brokers in California were not registered with us, that shouldn't take $50,000 in Or acknowledge the

[Sen. Randy Brock (Vice Chair)]: data brokers

[Sen. Alison Clarkson (Chair)]: that are

[Sen. Randy Brock (Vice Chair)]: registered in Vermont to compare

[Sen. Kesha Ram Hinsdale (Member)]: it Exactly.

[Sen. Randy Brock (Vice Chair)]: California database. Yeah. And that would tell you that would also tell you something.

[Sen. Kesha Ram Hinsdale (Member)]: I truly I like

[Sen. Randy Brock (Vice Chair)]: Perhaps about California.

[Sen. Kesha Ram Hinsdale (Member)]: I would hope people look at this and ask themselves, what are we trying to accomplish with this bill?

[Sen. Randy Brock (Vice Chair)]: I guess the other question I have is we're we're talking about things that are occurring in The US. Are there any, to anyone's knowledge, data broker registries for companies that register this kind of information internationally? And how are we dealing with those? For example, is there someone in a jurisdiction that commonly takes data, whether it's from Malta or Panama, that it registered there and not in The United States at all, is collecting these data, and then how does any of this apply to them? Does it? What would the AG's office do if there were a data broker in Panama that had all this information, was doing all the things that they're doing right now? What would you do?

[Todd Daloz, Vermont Attorney General’s Office]: I understand. If I can respond to a couple of different things. So center on Kinsdale, there are folks in our office who work regularly with Cal Privacy. I don't happen to be one of them. So they're aware of what's on the Cal Privacy website and and working

[Sen. Kesha Ram Hinsdale (Member)]: So what would this bill accomplish for you that's different than their work already?

[Todd Daloz, Vermont Attorney General’s Office]: I think what this bill could accomplish is enabling greater multistate actions around data brokers and the like, which is expands the ability of the Vermont AG's office, which is one of the smallest in the country, to affect greater change and and ensure greater enforcement of laws. To the question about extraterritorial enforcement, those are always really challenging cases. A lot of fraudsters, a lot of scammers are in other jurisdictions. It's hard to crack them down. It's hard to ensure that they are complying with Vermont law, and what we tend to do is work with the service providers in The United States who have more responsibility and more interest in compliance US law to attempt to limit the scope of those those kind of matters.

[Sen. Randy Brock (Vice Chair)]: We've talked about this forever, and we probably will at the next meeting. But, unfortunately, we have to go to the floor right now. The green light is on. And thank you very, very much, everyone.

[Sen. Kesha Ram Hinsdale (Member)]: I think if we're looking for testimony, should have the folks in the AG office who currently work with the California Department of Registry and then explain what valid. Thank you, Mr. Yukarne.

[Sen. Randy Brock (Vice Chair)]: Thanks, Senator.