Vermont Legislature SmartTranscripts:

[Senator Alison Clarkson (Chair)]: Good morning, everybody. Welcome back to Senate Economic Development, Housing, and General Affairs. We have a long morning on labor, and we apologize for being late to California who's gotten up early, and we are very grateful to you for we appreciate the time difference, and we're very grateful. I think we let's just introduce ourselves. I think we have three from California, Maureen, Phil, and Tom. And we are lucky enough to have Cal Privacy well represented here. And you'll introduce yourselves in a sec, but let's just introduce ourselves so you know who we are. We welcome you to the Senate and are grateful for you making time for us. David, you wanna start with you?

[Senator David Weeks (Clerk)]: Sure. Yeah. Hey. Good morning. Thanks for coming up so early. David Weeks representing a county that's near Killington, And I'm a former ten year resident of San Diego. Navy brought me out there. So I speak California.

[Senator Alison Clarkson (Chair)]: You speak California. Oh, great. Randy?

[Senator Randy Brock (Vice Chair)]: Randy Brock. I represent Franklin County and Northern Grand Isle County. What Canadian border?

[Senator Alison Clarkson (Chair)]: Right. Alison Clarkson. I represent the East Side Of Vermont near Hanover Dartmouth, East Side Windsor County. Senator Kesha Ram Hinsdale. I grew up

[Senator Kesha Ram Hinsdale (Member)]: in Santa Monica, California, and I represent Chittenden Southeast and serve as the senate majority leader.

[Senator Thomas Chittenden (Member)]: Tom Chittenden, same district. I tried California. I was out there about four or five months. Didn't take two. Couldn't understand what you were saying.

[Senator Kesha Ram Hinsdale (Member)]: I did believe. I did believe. I will say, and my mother is now here too, so Anyway. We don't always follow your laws.

[Maureen Mahoney (Deputy Director of Policy & Legislation, California Privacy Protection Agency)]: We are, as you know, in

[Senator Alison Clarkson (Chair)]: the process. We're coming to the end of landing our data broker bill as two eleven. We're gonna be at H two eleven, and we're adding pieces to it. But before we sort of close out our work on the data broker piece, we had wanted to discuss the deletion act and your good work in California. And I believe, Tom, you are the executive director of CalPrimacy, a model that we're very interested in emulating and Vermont sizing. And we welcome you all. Introduce yourselves and however you'd like to go. We are, I think, interested in in your development of it. I think we're going to probably not reinvent the wheel. You took a lot of time and money inventing that wheel. And I think we're just we're curious how it's working and look forward anyway, so looking forward to hearing from you.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Well well, thank you, chair and and members. Very nice to meet you. I'm I am Tom Kemp. I am the executive director of the California Privacy Protection Agency or Cal Privacy. I'm joined by Maureen Mahoney, our deputy director of policy legislation and Phil Laird, our general counsel. I have spent some time in Vermont. My daughter did go to Dartmouth, my eldest daughter, which obviously is in New Hampshire, but we went over

[Senator Alison Clarkson (Chair)]: across Yes, the and

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: my cousin Tim is a school teacher in the Randolph School District. He teaches math there. So love love the area right there. So what we're gonna do is probably spend about fifteen minutes showing some slides and Maureen will drive the slides while I do the talking. And then we'll open it up to questions as well. So we just want to set the stage and speaking of wheels, we certainly want to share as many wheels as possible with you and so we're we're very much in the mood of wanting to collaborate you know, with with folks such as yourselves and I should state while we cannot take a position on the bill, we're more than happy to talk about our registry law, our experiences implementing our delete act, including the development of and launch of our accessible deletion mechanism called the drop system, the Delete Request and Opt Out. And there's a lot of similarities between what you guys are proposing with H-two 11 and what we have in our legislation as well. So I'm going to, have the slides, hopefully show up. And so Maureen will do sharing and, we'll jump to slide two. And stop me at any time. And can you guys see the slides? Yes. Okay, great. So just moving to slide two. So interestingly enough, we were actually created, this agency is an independent agency. We were created by the voters via a proposition. 9,300,000 people voted yes to create this agency and extend our privacy law, which kind of shows you that there's just a huge pent up demand for allowing consumers to have better control of their personal information. As an agency, you can see functions that we have. We do share enforcement with the attorney general general of California. But what I'm gonna do is focus on the fifth function, which is the administration implementation of the delete act, which prescribes unique requirements of of data brokers. So moving on to the next slide, I did, look at, your proposal. It we have a lot of similarities in terms of how we define what a data broker is. But at the core of it is a data broker are entities that we don't have a direct relationship with. Right. And they collect and sell our personal information and oftentimes they collect and sell our personal information to anyone with a credit card and we're completely oblivious to this as well. We, in our regulations define what a direct relationship is and you guys have put it in your H two eleven, the definition and there's there's a significant amount of commonality and similarity between the various definitions right there, which is great. We love harmonization. And Connecticut just passed in the legislature SB4, there's harmonization and consistency right there between the definitions as well. So very comparable definitions. Moving to the next slide. Okay, let's talk about the industry. It's a like, why are you doing this? What are the pain points that you guys are looking to address? I'll give you my perspective. I'm not here to you know, obviously, you guys have I've listened to some of your past sessions that you've had on this bill. I think there is obviously, you guys have a great awareness, but let me just give you my 2¢ on this. Obviously, it's a multibillion dollar industry, and the data brokers can be small businesses to very large corporations. It's very opaque to consumers. They they really don't know who these entities are. They don't know who's selling their data. And this market is increasingly very profitable because businesses use personal information to not only serve targeted ads, but also to track purchasing and spending habits. And what's happened is, especially over the last few years, there's been a number of substantial privacy risk. Probably the one that impacts most Vermonters and Californians is that these data brokers are collecting massive digital dossiers in each and every one of us. California's privacy law has a right to know. And so I actually went out and did right to know request of some of the some of the data brokers. And it's not like two or three pages worth of information. Some of these dossiers would be fifty, seventy five pages. That it's scary to think that someone can buy a 75 page report on each and every one of us just with whipping out a credit card, and it shows kind of an identity graph, who your relatives are, what their relatives phone numbers are, what their email address is, where you've worked in the past, etcetera. There's very sensitive information. They infer what your religion is or may they may know what your religion is, etcetera. And what we've seen is is that there have been some massive data breaches of these, data brokers. And, a neighboring federal senator, Maggie Hassan, came out with a report in February 2026, that said the four major data broker breaches have cost US consumers over $20,000,000,000. That came out in February 2026. There's significant concerns about very sensitive personal information, including reproductive health information being sold. Data regarding people who've used period trackers has been sold. Usage of specific religious based applications, that's been sold. And then increasingly, there's significant concern about data sales to the federal government, including for immigration enforcement. Right. We we've seen data brokers data being used to dox people, used by people with restraining orders to track down domestic violence survivors. And, unfortunately, in the case of Minnesota to target politicians, we saw New Jersey targeting of judges as well. So in some, it's an area where consumers really need additional protections just given the Latin massive dossiers on each and every one of us.

[Senator Alison Clarkson (Chair)]: Tom, can I just take a second? We have a question from Kesha.

[Senator Kesha Ram Hinsdale (Member)]: I do so really, like, with the limited time we have, what what concerns me about going into headlines is when we're talking about data breaches, any of us could have that problem. Right? You now have a registry of everyone who's been asked to be removed from these sites and it costs millions of dollars to keep that secure. So I'm a huge fan of your data broker registry. I'm a huge fan that it tells you where your information is being sold, etcetera. Some of the things you mentioned that were being tracked are not options from what I saw on your website, if they're tracking your religion or your menstrual cycle or your healthcare information, and they have some relationship where they give that to the government or they sell that to somebody. But I was very impressed, for example, that on your site you can choose citizenship and then say, okay, so they have my citizenship information, 11 brokers show up on your site of the five sixty six. And then I think two of them are credit agencies that then you list as sharing that information with local, state, and federal government. So, I mean, I'd like to get us beyond the the scariness of our data being out there because I think with advances in AI and other things, like, this is something we're all worried about. It tugs at our heartstrings and our gut, but we need to create a workable system that is secure and that makes people feel like something's being accomplished. Right. So I I wonder why we would need our own website. Maybe we need our own ability to put a function that says, input your email address and very limited information, right? You should all be fans of data minimization. But puts in very limited information to your site to be included in the do not email list or whatever it is, do not solicit. You can't control if it is an entity that has the right or is exempt to be able to control that information. So that probably covers the credit agencies that have citizenship information and have a relationship with the federal government. I don't know. Okay. But what like, why do we need to reinvent this wheel? Or is your office or your your digital services agency in California looking at how to make the delete function, a marketable product, you know, that you can sell to other states so they can participate in your website.

[Senator Alison Clarkson (Chair)]: Yeah, I think that's a key question on our minds having heard Everything else a lot of okay. Up, this kind of testimony. We I think one of the questions is might other states subscribe to your to your delete function. Is that something that you've considered? But it we'd love I'd love to have you just finish, and then then we can have that conversation.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Okay. Yeah. I mean, the registry itself provides just transparency and visibility. And with the proposed enhancements, it would give Vermonters the ability to specifically identify which ones they would want their data. Obviously, actually have some things in your proposed registry that we don't have. For example, in our registry, we do not have data breaches reporting. That may be a very significant importance to you legislators in Vermont. And so that you could actually, if you were to implement H two eleven, you could filter on which ones had data breaches. And then you with H two eleven, you've added deletion capabilities, not at scale like with the drop system, but you'd but H two eleven also in my reading adds the ability to do one off deletions. And so the combination of the registry with deletion either on a one off basis, which is what you have or what and we have that in California through our privacy law or in doing it on mass scale through the drop system gives the flexibility there as well. So but, yeah, let's actually do a little let's go to the next slide to do a kind

[Senator Alison Clarkson (Chair)]: of a Thank you. Okay.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: So what we did is we followed you guys in 2019. You guys had the first data broker registry law. We followed you as well. But then we came in 2023 with the delete act that actually adds the ability to do mass deletion at scale as well as facilitate opt out. So instead of, like, having to contact each and every data broker, you can just spend five to eight minutes, provide some basic information and that information and then then starting in August, the data brokers will will have to start doing the deletions. And then because of significant concerns about the sale of data brokers that the legislature came back and added another piece of legislation, SB three sixty one, that provides significant, expansion of the registry, to provide additional information as well. And you can see in our new and that registry is a living, breathing thing. The senator mentioned 566. 11 more data brokers have actually signed up, and so we're now at 577 data brokers, that have been registered with the state of California. So so Yeah.

[Senator Alison Clarkson (Chair)]: But I just wanna finish.

[Senator Kesha Ram Hinsdale (Member)]: Well, what caused them to right. Like, we're also in a place where we have, like, 300 on our list.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Yes.

[Senator Kesha Ram Hinsdale (Member)]: Our list has

[Senator Alison Clarkson (Chair)]: Is in well,

[Senator Kesha Ram Hinsdale (Member)]: we've been talking about this in education too, about education technology, but we how does your enforcement of registration work? Is it through your agency that you you find out about a data broker and you and you say you're not on our website and there's a penalty if they're not

[Senator Alison Clarkson (Chair)]: or

[Senator Kesha Ram Hinsdale (Member)]: something.

[Senator Alison Clarkson (Chair)]: Yeah. Yeah. It's it's

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: very similar to what, in our case, we're the enforcer in the case of your proposed legislation. It's, your attorney general. They they call people up and say, looks like you're not registered, and then there's corresponding fines associated with that as well. The the nice thing that you guys have is that actually because we've kind of done a lot of the leg work, it would be easy for you to identify of the the you can look at the delta between your 300 and the 577, and you can call call them up. And and the nice thing is is that every time a data broker registered, and I've seen you've increased your fees as well, the the registry fee, you know, goes to towards the maintenance. And so one thing that, that's true of our system is that the data brokers, basically pay for everything with their fees. They pay for the registry. They also pay for, the actual drop system itself. One difference is that your proposal, for $50,000 for a study would actually looks like it's gonna be paid out of the general fund, as opposed to you could simply just, I don't know, increase your proposed fee by a $100, and that would pay for it over a two year, period at, you know, 300 times a 100 would would would fund it. So you could actually do something without actually having to take money from the general fund by simply just leveraging the actual registry to pay for that.

[Senator Alison Clarkson (Chair)]: Yeah. Thank you.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: And that's

[Senator Alison Clarkson (Chair)]: In the middle of that negotiation with the appropriations committee at

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: the moment. Yeah. No. But but again, I wanna pro even the the re the headcount, the resources that we have to build this. And then we even have a proposal in front of our legislature to fund, in additional enforcement comes through the data broker fund that's created through the the fees itself. Another actually, an area which you guys have exceeded California, not only you've exceeded California with your proposal with requiring data brokers to reveal the number of breaches, you guys also have a credentialing to purchase in in your legislation, which actually something we don't have. So that that actually is a cool feature that that you've you've added that we don't have. So you've you've gone beyond us. But the biggest difference, between our three pieces of legislation, which I'll just call the delete act and and what you have is that your proposed bill would would only enable deletion on a one by one basis, which has a lot of value because especially given that you can sort and filter specific types of data brokers who they sell to, what type of data, while we enable it at scale, which is the drop system. And and then if you go to the next slide, Maureen.

[Senator Alison Clarkson (Chair)]: It's one by It's one, one by one until we can actually either subscribe to a platform that enables us to do more or we adopt our own and build our own platform to do this.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Yeah. So let me just kind of say that, obviously, we are the we're by independent board. I just actually presented at our board meeting that we are very interested in collaborating, sharing to the extent possible. Obviously, we don't know. I'm not gonna like offer like four or five different options when I don't know what you guys would be interested, but everything's on the table in terms of potential areas of collaboration. And frankly, you know, if Connecticut goes forward, we'll probably have already figured out exactly what kind of relationship that we would have as well. So I I can't promise or commit because I don't know what you're looking for.

[Senator Alison Clarkson (Chair)]: And Right.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: We're also we're also trying to get our deletion live on on August 1 with the data brokers itself. So we're our R and D effort is focused on that next phase right there. But we're certainly, you know, open to collaborating with other states and sharing to the extent possible what we can, which could even include potential sharing of technology, etcetera.

[Senator Alison Clarkson (Chair)]: Great. Let's keep going. Thank you. So

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: again, the data broker has an annual fee. And then this is the other thing I will point out that we actually do require data brokers to to audit their deletions. That starts in 2028. That's actually part of the legislation as well. So that's the overview of the the DELETE Act. So let me just quickly just go through the actual drop platform. Oh, and this is the the so this is the timeline. So it's gone live. I'm pleased to tell you that over 286,000 Californians have already signed up in the first few months of it. We actually expect that number to increase very increases as people realize and know that the deletions will start happening in August as well. So it's very possible that, you know, maybe twelve months from now, there's over a million people using this. It's within the realm of possibility given the overall popularity of the actual platform itself. If you go to the next slide, I'm gonna skip this slide. I won't get into the details. But just from a quick and dirty consumer experience, that the consumer has to verify their eligibility, which is the residency. They create a basic profile. That information is immediately stored in a secure manner. It's hashed. We don't even know, who's using the system. All we know is that they're a valid resident, and then they hit the submit button on this. And then if we just you could just quickly this is just the simple eligibility, and we even tie into login.gov so they can leverage an existing law if they have social security or TSA or whatever, they can leverage their account that's already validated that they're a resident of, in our case, California. Skip to two slides, skip to this one. The customer profile, very simple information, email address, phone number, zip code, your your your date of birth, variations of your name. So if it's Tom Kemp or Thomas Kemp, different data brokers have different data. Then we also have some unique identifiers including your mobile advertising ID, which is what uniquely identifies your phone. That's how and I can tell you based on our registry, there are over a 100 data brokers out there in the wild that track each and every one of our precise geolocation. So we could even you can even put in your phone advertising ID and then you can stop the geolocation data being sold out there. And then I won't get into the security aspects. It's highly secure. And then finally, you just hit the submit button and you're off to the races.

[Senator Alison Clarkson (Chair)]: Right. I think we have a question. Okay.

[Senator Kesha Ram Hinsdale (Member)]: So if I don't know if you wanna go back, but on your page, is there, like, a checkbox or something where you say I'd like notifications if a data broker has violated these provisions or something? I mean, I know you're out, but there are certain ones you can't opt out. Right? Like, does it make it clear that you can't opt out of credit reporting and things like that?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Right. But let's be very clear. Credit rep you've you've brought up credit reporting a couple times. So these credit reporting agencies obviously, stuff under FCRA like your bill and our bill is exempted, but these credit reporting agencies have separate businesses. So if you go to our registry, you look at some of the large credit reporters, they're separate entities that actually are in the data broker business itself. And so I want to be very clear that people have subsidiaries that act as data brokers. So it's Okay.

[Senator Kesha Ram Hinsdale (Member)]: So now we're talking. So if one of those credit agencies says that they have sold or handed your information over to the federal government Right. How do you get your citizenship, not only how do you get notified, are you is California now able to locate the the the brokers that are the the sales side of that and go after them for a violation?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Okay. There are okay. So, data brokers, so, what gets reported back to the consumer is is the success or not of whether the deletion occurred, okay? Which which tells you whether or not the actual data broker, you know, has your records and the information. So it's a living, breathing system. Starting in August, the data brokers will match the data and drop with the consumers put in with their own databases. If they find matches, they'll do deletions and opt outs and they'll report back for the specific consumers. So what the consumer will see is they will see a nice pie chart or graph of the 577 data brokers. They may see that 275 deleted their information. Okay? To the extent that they want to say, ah, well, what did they do in the past? Then, with my data, they they would have to actually maybe do, you know, specific, queries to the actual data brokers. So this will not be a real time feed of who the data brokers have sold your data to and when and all that stuff. What the consumers will see is the extent of whether or not the data has matched in these internal databases and whether or not the deletion happened.

[Senator Kesha Ram Hinsdale (Member)]: Okay. So while incomplete, this is highly sophisticated. Like, I want to give you credit for that, that people will have relatively accurate, personalized information with which to call certain agencies and try and make sure that they're not on some list. I obviously still worry about federal law enforcement. I think that's the main reason people, right now in this time, might be concerned about their their civil well-being, not necessarily their financial well-being. But we and I'm I'm like, not don't even wanna ask you how much this costs every year because it we are not California. We can't we do not have the budget create something this sophisticated. Right. So but what could we go back to, is California contemplating leading the nation in helping to create access to something this sophisticated for our state.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: The the short answer is yes.

[Senator Alison Clarkson (Chair)]: I think I I just wanna hear

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: The the short answer is yes.

[Senator Alison Clarkson (Chair)]: The other

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: thing is I wanna be very clear that the taxpayers of California have not paid $1 for this. This has all been driven by the registration fees.

[Senator Alison Clarkson (Chair)]: So

[Senator Kesha Ram Hinsdale (Member)]: How much is the registration fee?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: It's It registers It's today, it's $6,000.

[Senator Alison Clarkson (Chair)]: Okay. So the Six So

[Senator Kesha Ram Hinsdale (Member)]: 566 entities paid $6,000 and it paid for the registry?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Well, the registry is very simple to be candid. It's it's what the registry itself, we've had a registry, you have a registry, etcetera. That that is that is relatively easy and not expensive to

[Senator Randy Brock (Vice Chair)]: to build.

[Senator Kesha Ram Hinsdale (Member)]: Okay. So our secretary of state's office said that the security is for the drop system.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: It's it's the drop it's the drop system. Okay, so the registry is simply all the data brokers that are registered their information as well. Like it's analogous to, I don't know if you have a registry of beauticians or cosmic ologists and there's additional information that has to be collected and people can go and they can sort and filter and all that stuff, right? That is relatively trivial compared to the actual deletion request system Yes. Itself. So, yes, the the data broker fees, 6,000 times 577 data brokers, which is the updated number in the last month, you know, gave us the the money for this particular year to build this. It also include it also supports the additional resources, not only to build it, but to maintain it and also applies to enforcement that we've carved out as well. So I want to be very clear that yes, we're interested in having any and all types of conversations about potentially sharing this. And we would welcome collaborating with, if you do pass that element of the study to discuss kind of areas right there. And then the second thing is is that the cost, is is borne by the data brokers.

[Senator Alison Clarkson (Chair)]: Right. I heard you say you would be I heard you say you'd be happy to collaborate, particularly if Connecticut was interested as well, you'd be very happy to collaborate and explore a subscription series or something like that.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Well, I don't know. I'm not gonna, don't

[Senator Alison Clarkson (Chair)]: I don't comment know. On that.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: It's like specific, but it really depends on what you guys are interested, what's feasible, But yes, we do want promote this to the full extent possible in terms of and supporting other entities.

[Senator Alison Clarkson (Chair)]: Right, so would you be kind enough to continue?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Okay, So the very successful. So next slide, Maureen. Okay. So, we did give the data brokers, through the legislation, not we being the state of California and the legislature said system goes live January 1. We we met that deadline. People are now registering. But starting in August 2026, that is when, the data brokers begin the deletion. And then consumers can go back into the system, they can add more information, new zip code, new email address, etcetera. Right? It's a living, breathing system, but they can also check their drop status. And and the nice thing is is that if even if there isn't a match and their data is deleted, they are now put on an opt out list, a suppression list moving forward. So so the so so the and it's a one and done type thing. You don't have to go back and do it. Or furthermore, even if new data brokers are registered, it it will apply to net new data brokers. So you don't have to go back into the actual system itself. Next slide, Maureen. We'll skip all this the details right here. And then we talked about the failures to register. It's $200 per day. So we've had some we find approximately a dozen companies. And But really where it really kicks in is that if they fail to delete, it's $200 per day per consumer request. And so you can imagine, say a data broker doesn't delete and say there's 300,000 Californians that match the data in their database. That's 300,000 times $200 times number of days as well. And but even in the failure to register, let me bring up two specific failure to registers examples. There was a company down in Texas that we did a settlement with called Data Masters who sold lists of people with Alzheimer's, drug addiction, and other health conditions. Because they failed to register, and in the end they didn't with California and pay that fine for registration, they agreed to exit the California market. So there was an example of a data broker that sold highly sensitive personal health information. There was another data broker that actually decided to shut down and not pay for the registration. That company was called Background Alert. Their tagline is that it's scary how much information you can dig up on someone. And so clearly, you know, that was their so I think it's a net positive when you have these types of examples of these types of data brokers not doing business in the state based on, you know, the settlement agreements that we've reached with them as well. And then the next slide, I I just wanna tell you how excited people in California about this. This really shows that states can do innovative things that can deliver kitchen table issues. People are scared about elder fraud. People are scared about identity theft. They're tired of getting all the spams and texts. Right? This solution dramatically reduces the digital footprint that we have out there and gives people for the first time ever control of how these third party entities use your personal information. This is incredibly popular with residents here in California. And I think that concludes my presentation. So we'll open it up to Phil and Maureen to answer and myself to answer any questions.

[Senator Alison Clarkson (Chair)]: Tom, thank you very much. And Maureen, this was very helpful and gives us all sorts of ideas. And I think this and our secretary of state who's gonna be doing this, reviewing how we might engage with some of this work and how we go forward in Vermont size, this deletion act and drawback. I think will be this is gonna be perfectly important for the work he is gonna be doing. Any questions committee for Tom or Maureen? Randy?

[Senator Randy Brock (Vice Chair)]: Just one, in terms of the data brokers themselves, have there been cost increases that data brokers have passed on to their customers as a result of the work that they have to do under your rules and regulations?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Well, the the cuss remember, they don't sell Interview. To consumers. They sell to other businesses or anyone with a credit card. And so the cost is $6,000, you know, for the for the state of California. So I I don't know how they actually go about it, but it's not something brokers business is that you are you and me, we're their product and they sell it to other businesses. They don't they don't necessarily sell stuff to us. So it's that's that's the reality of of of the industry.

[Senator Randy Brock (Vice Chair)]: Well, you had mentioned that the customer doesn't pay, the California doesn't pay any fees to you. The data brokers presumably pay fees to you.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: All of

[Senator Randy Brock (Vice Chair)]: things that get paid to you for each of the data brokers involved, $5.76, costs something. I'm trying to determine who pays for it in the end.

[Senator Alison Clarkson (Chair)]: Both businesses.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Well, yeah. I mean, obviously, you know, just like if you guys have a registry of cosmetologists or beauticians or whatever, right, that that is a that is a fee and that in the end, the the legislature of the state of California and by the way, I Texas has a data broker registry as well. So the republic a republican state, very red republican state also pay also charges. They don't have the they and they have deletion mechanism as well that society that the the legislature has decided, from a societal benefit to charge these companies to provide transparency to a very opaque market given the sensitivity of the type of data that they have. If they were not selling personal information, then they probably would not have to go through a registration process that now four states have, in place. So yes, they have to pay $6,000 to the state of California to register and that pays for the not only the registration the registry, but it pays for the drop system. You know, your registry, I think, charges a $100, and then you're gonna increase it a little bit as well. And and that's that's the price of for a data broker to do business in the state of Vermont that they have to pay a 100 or a proposed, I don't know, $900 fee. That's the Given price of doing the sensitivity of the information and the impact on society that the legislature has made that decision, that that's worth the trade off to charge a relatively small amount of money to facilitate these types of services to their consumers.

[Senator Alison Clarkson (Chair)]: Right. Any other questions for Tom, David?

[Senator David Weeks (Clerk)]: Well, I do have questions, but Tom alluded to the fact that his colleagues may have additional information, which I'd really like to hear before we round this out. Right.

[Senator Alison Clarkson (Chair)]: Maureen, are we going to Phil next?

[Maureen Mahoney (Deputy Director of Policy & Legislation, California Privacy Protection Agency)]: Yeah. Phil is there.

[Senator Alison Clarkson (Chair)]: Yeah. Thank you all for joining us so early. Yeah. Phil, welcome.

[Phil Laird (General Counsel, California Privacy Protection Agency)]: Thank you. Yes. Happy to take any questions.

[Senator Alison Clarkson (Chair)]: Okay. So you don't have an additional presentation?

[Phil Laird (General Counsel, California Privacy Protection Agency)]: No. No. No. Yeah. We're just

[Senator Alison Clarkson (Chair)]: Counsel here to for Cal Privacy?

[Phil Laird (General Counsel, California Privacy Protection Agency)]: Yes.

[Senator Alison Clarkson (Chair)]: Oh, great. David.

[Senator David Weeks (Clerk)]: Well, thank you all. Again, thank you for getting up the early hour. We appreciate that. I've got two children in California, so I fully respect the three hour difference. Question is, I I think Tom alluded to it. It's the opt out of the delete is both retro retrospective and forward looking, at the same time. Is that correct?

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Bill, go ahead.

[Phil Laird (General Counsel, California Privacy Protection Agency)]: Sure. Yes. Yes. That is correct. That is correct. So once you submit a deletion request, the data broker has to process that deletion at the time they receive it, but then they have to retain what we call a depression list, commonly referred to as suppression list of individuals that they need to continue deleting information for and not selling or sharing going forward.

[Senator Alison Clarkson (Chair)]: But just to build on David's question, it doesn't go back in time. It's a prospective law rather than one that goes back and deletes parts. You know, it's more prospective than retrospective.

[Phil Laird (General Counsel, California Privacy Protection Agency)]: Well, to to that end, I guess I'll just say, I mean, I I think it's it's a a direction to the data broker to delete the information they have at that time. And, obviously, information they'd have they've already disposed of in the past, they can't necessarily go go delete at that point. So it's deleting what they currently have and ongoing. But there is a provision in our law that requires them to also extend that direction to any of their service providers and contractors, meaning it's not just the business itself, it's anybody engaged in partnership through contracts with that business and maintaining or processing personal information that has to also follow that directive.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: Great.

[Senator David Weeks (Clerk)]: Dave. Okay. So, again, thank you. I the world I came out of is all about measures, countermeasures, counter countermeasures. I'm really curious if if as this initiative has developed over several years in California, if you're still finding the legislation to be effective and if you've had to modify what you've asked data brokers to do or not do over these years so that we can benefit from your

[Senator Randy Brock (Vice Chair)]: experience.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: I'll jump in. I'll have

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: maybe Maureen can Maureen and Phil. But when okay. So we had our data broker bill just like yours, in 2019. Then when the DELETE Act came out, that it really opened the eyes of the legislature about the problem. And then then the next year, there was this s b three sixty one that enhanced the registry and then sent right now, there's actually a couple additional pieces of legislation that's being proposed in California that builds further upon the DELETE Act to, for example, provide the the means actually, Maureen, why don't you talk about some of these this legislation that that's that is being looked at?

[Maureen Mahoney (Deputy Director of Policy & Legislation, California Privacy Protection Agency)]: So California is currently considering two bills that would amend the Delete Act. One would reduce the turnaround time for deletion requests from forty five days to thirty days, And the second one would increase some of the disclosure requirements with respect to data brokers as they're registering with the agency, specifically providing more information about inferences that they've drawn about certain sensitive data categories and would also put some of the elements that are currently in our regulations with respect to the definition of data broker into the statute.

[Senator David Weeks (Clerk)]: Thank you.

[Senator Alison Clarkson (Chair)]: Thank you very much. This was very helpful. And I really appreciate you taking the time to do this. Thank you so much. We will be in touch with additional questions as we go through this. And I'm sure over the course of the summer and fall, as we do this study and figuring out how we actually robot size this, we will obviously be reaching out. So thank you all very much for taking the time to join us this morning. I hope you have a grand day in California, yet another day you haven't fallen into the ocean. Well, I do understand that you are fighting for water over there. We heard on National Public Radio, but water challenges continue. So good luck there in California.

[Tom Kemp (Executive Director, California Privacy Protection Agency)]: Thank you. We appreciate you inviting us here and we certainly will do anything and everything we can to support. It's actually built into our ballot initiative that we're supposed to work with other jurisdictions, and, Maureen and and Phil do a great job of of doing that. So, let's keep up the dialogue. So thank you so much.

[Senator Alison Clarkson (Chair)]: Hey. Thank you so much. We have a lovely rest of the week.

[Senator David Weeks (Clerk)]: Bye bye.

[Senator Alison Clarkson (Chair)]: Thanks. Bye bye. Rick, wanna come join us?

[Senator Thomas Chittenden (Member)]: It's just a matter of time for that bigger breakdown.

[Senator Alison Clarkson (Chair)]: I know. I have a chance to meet a geologist out at or whichever one is there. So Good morning. Good morning. I would just like to tee us up with the following, which is my sense is that so move from California to here. My understanding is that two '11 is in pretty good shape, that we have exempted. We've made some big compromises. We have I would like just to reflect on the three compromises we've made, which I think this committee is landing on. We've made the exemptions to the GLPA, to the Fair Credit Reporting Act, and to the clearinghouse. I think that we are in a pretty good place on 02/11, and we have a request from two members of our committee to include s 71 with the Connecticut updates, which we have done and is in now is incorporated into 02/11. I would like to say I'd like to land and be clear that we're in a good place on 02/11 before we go through the work of looking at s 71, which is a big bill. We are gonna need to take time to just quickly review it. Some of us are more familiar with it than others. It was passed out of the Senate last year. Connecticut's updates alone will take us some time to appreciate. So to that end, I would just like to get a sense. I believe we are in a good place until eleven. We have made compromises I support and that I'm willing to move the bill forward on. And I'm ready to take up S 71 with the Connecticut updates. How are the rest of you feeling? Because S 71 is big enough. I don't wanna muddy the waters doing both. They're pretty separate. They'll be under one umbrella, but they're very separate things. So I think we're in a pretty good place on h 211. I'm hoping the three of you feel the same way. And

[Senator Thomas Chittenden (Member)]: I'm always looking to try to draw my friends across the table to do the conversation.

[Senator Alison Clarkson (Chair)]: I know, I thought that was a direct request.

[Senator Randy Brock (Vice Chair)]: Well, know, the first thing I asked, it was just a question, it's not necessarily that I oppose it, but I wanna know what this costs. And I still don't know. Because the costs get registered in one place in terms of what the government collects, for example, registration fees. But the cost is actually on the various people that have to do various things associated with their responsibilities under the bill.

[Senator Alison Clarkson (Chair)]: I don't know that there was there a fiscal note on this, but we can ask for it. I don't believe there was a fiscal note done on this.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: So Rick Sable on solicitor council, I believe, got more JFO produced because of the increase of the fees. There's more revenue, more revenue in the state. But as far as, the JFO's not going to speak to cost of businesses. An increase of

[Senator Randy Brock (Vice Chair)]: It's an important piece because there are a whole lot of responsibilities that businesses have in response to dealing with the requirements then. But that, I think, a harder thing for JFO to be able JFO to may not be the one to do it. They'd be talking with others who do economic analysis. Those are questions that we ought to ask. We ought to ask, if there's no other way to do it, ask business associations and so on as to how they feel about this because of what

[Senator Alison Clarkson (Chair)]: We have asked them. They have been testifying. It's been very clear how they feel about it. And we have made three big compromises to support a business that they But it's something have to we have

[Senator Randy Brock (Vice Chair)]: to consider, and if your question to me, to us, is how we will vote on it, that is a factor

[Dylan (Representative for LexisNexis)]: that will

[Senator Alison Clarkson (Chair)]: be Okay. And I think

[Senator Randy Brock (Vice Chair)]: I wanna understand it.

[Senator Alison Clarkson (Chair)]: Okay. Then what I want, I'm having you understand it.

[Senator Randy Brock (Vice Chair)]: Understand it at this point.

[Senator Alison Clarkson (Chair)]: Okay. Other than that, Dave

[Senator David Weeks (Clerk)]: Slightly unusual tactic. The S-seventy one, haven't looked at S-seventy one for-

[Senator Alison Clarkson (Chair)]: Yeah, exactly. That's why I wanted to sort of land as much as we're able to 11 before So, we move

[Senator David Weeks (Clerk)]: flat footed. I don't remember, you know, what the conversation was about us. Don't know how we voted. I don't know the content anymore.

[Senator Alison Clarkson (Chair)]: That's why we're gonna start it

[Senator David Weeks (Clerk)]: and then And I'm okay with that. I'm okay with schooling back up. But I can't tell you how I feel about incorporating the s 71 because frankly, you know, unless until I begin to do some research, I really don't.

[Senator Thomas Chittenden (Member)]: So I I'm one of the ones that has put this on the table and I appreciate the chair for having this discussion. I am worried that we're gonna end up with no data privacy bill again this year. From what I'm hearing at the hallways and what I I think the house is has been, I don't know where they're landing. I know they're having important discussions this afternoon, that we must just might end this session the way we ended last by any end with just nothing. S 71 as passed by the senate senator Weeks, was unanimous. It is a good bill that is regionally consistent, that doesn't have a PRA, that I also think is a great starting point we'll build on in the future. So I just didn't wanna move h two eleven out of committee while I was still hearing about the concerns being raised in the house. But I do want s 71 has passed by the senate with some modest adjustments to pass into law this year. And so that's what I've seen happen in other contexts. It seems very germane. And so I also thought making sure the language is consistent with the data deletion and the data, all those pieces in H two eleven with S 71 also might make it easier for people to follow this law so that they were entwined and not necessarily separate sections. So that's why I think this is a worthwhile discussion.

[Senator Randy Brock (Vice Chair)]: Great. Think the discussion, I believe, is worthwhile. And so

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: the question is we have

[Senator Randy Brock (Vice Chair)]: to have a discussion before we say how we feel about it. Had discussion now for weeks.

[Senator Alison Clarkson (Chair)]: We've s 71 is separate, but we've had the discussion on data brokers now for weekly. And I appreciate your concern about the cost of business. We will get Pretty modest is my guess, because these are big businesses. I mean, LexisNexis, another thousand dollars here or there is not gonna break LexisNexis. I am not worried about that. I am concerned that we land, we've made good compromises on H two eleven, and I would like to sort of have settled that before we move to s 71 because s 71 is a big bill, and we're gonna have to take some time to look at it.

[Senator Thomas Chittenden (Member)]: See the language of s h two eleven with the compromises? Because I'm just not sure what you're those three bullets. I just don't know what you're referring to. Is there a draft? But I'm just wondering if can it to

[Senator Alison Clarkson (Chair)]: there's a draft.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: Yeah. So so Rick Siegel, office of council, but I think the chairs in it can be draft 1.1 of the committee amendment that had the instant amendment that I walked through was of last week. That'd be Two eleven now?

[Senator Randy Brock (Vice Chair)]: Yes. Two eleven. Right. Draft 1.1.

[Senator David Weeks (Clerk)]: I can share my screen here. We have one We have a

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: 1.2. I'm sorry. It's 1.2. 1.2. So that draft had the two no. Let's see. One, two, three. The four instances of InVent. The first two were technical. I believe you have a highlighted copy, right, Sandra Weeks? One two. Yes. 1.2. The sharing consumer's data was just a grammatical correction, and the email, internet address, phone number was a grammatical correction. The third instance, adding GLVA as an exemption of data subject to the GLVA, and then title six of the Consumer Credit Protection Act, the Fair Credit Reporting Act exemption, and then the Clearinghouse student certification, education certification exemption. But the DPPS, I think there were three that was testifying. Three. There's the Clearinghouse. That was up for disc I didn't hear a clear indicator what the committee wanted before drivers drivers protection drivers privacy protection act.

[Senator Alison Clarkson (Chair)]: Oh, I thought that was included in the fair credit reporting.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: It's separate. So if the committee wants to add that, I can certainly add that.

[Senator Thomas Chittenden (Member)]: I see value in adding it.

[Senator Alison Clarkson (Chair)]: Okay.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: Hey. Have you had a discussion about

[Senator Alison Clarkson (Chair)]: We we discussed this briefly. Bridget is I think, Bridget, this is Bridget, your area. Yeah. And we did have discussion about it, but I don't think we landed. I'm sorry. I apologize. I have not realized that was a dangling purchase. I mean, I didn't realize that was still dangling. So and remind us, Rick, what that entails. So The exempting what?

[Dylan (Representative for LexisNexis)]: It's a it's

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: a federal law. I think 1994 is when it was passed that intends to give privacy to drivers, motor vehicle records. Right? Similar to GLBA, similar to fair credit reporting, where there's this federal landscape of privacy that protects consumers. These privacy bills tend to be more private for consumers. You know, 02/11, if it were to not accept the DPPA, there would still be this federal protocol that entities have to apply have to abide by, but then they'd also have to abide by this, and that's per labor privacy, which you can do. It's a policy to subscribe. You you don't have to get more privacy or less privacy, but you have to hit the federal minimum, which is what the DPVA, GLVA, and record reporting. So it's a policy choice if you want to exempt those motor vehicle records privacy, that law includes a bunch

[Senator Alison Clarkson (Chair)]: of car businesses and other it it it includes some

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: car There's market re yeah. Market research. Exempt. Market research, you know, most of it is governmental business, but there are some, but I think private investigators can have access to motor vehicle records for their work. So there are some things that are not covered by the federal law that this would cover if you were not to exempt them. So again, it's just a choice of what you want to do.

[Maureen Mahoney (Deputy Director of Policy & Legislation, California Privacy Protection Agency)]: Bridget. Bridget Morris with Morris Strategies on behalf of S and P Global. I just will also add that the DPPA, in order to get information via the DPPA, you have to contract with the DMV. So there's a very strict DMV contract. The DMV also submitted a comment on this DPPA exemption last week to your committee requesting that it be part of H two eleven.

[Senator Alison Clarkson (Chair)]: Was on your Apologies, it has not

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: we have a registration. We have a state exemption, state or substandard, I'm gonna say, which I think would include the DMV. I'm gonna no?

[Bridget Morris (Morris Strategies, on behalf of S&P Global)]: Where do you mean oh, because it's it says for a group processing on behalf of the DMV, but we're not processing on behalf of the DMV. We're purchasing the data from the DMV, and we're processing on behalf of insurers and other groups. But I don't think our organization

[Senator Alison Clarkson (Chair)]: better than purchasing simply it from the DMV. Right. It's tricky. How are we clear that those are all good actors that we want to share a lot of information with?

[Bridget Morris (Morris Strategies, on behalf of S&P Global)]: There's a very strict contract that these companies have to abide by and the data have get to that data, very heavily audited. The DMV governs all of that data and ADS has also been involved in writing that contract as well. That's been enforced. Dylan.

[Dylan (Representative for LexisNexis)]: Yes. Just Dylan's working for with Lee and I for LexisNexis. To give the committee a little bit of a picture about the type of data we're talking about here, my client access the intermediary between DMP and auto insurers. And so when you go to pull a new apply for a new auto insurance policy, they're gonna wanna know, hey. Are you a frequent speeder? Do you have a ton of speeding tickets? Do you have a ton of motor vehicle infractions? They're gonna go to my client to get that information. That's easier on the DMV because they're not getting a request for information every single time there's a new or relapse auto insurance policy. And so if the deletion if we are required to delete the data, if a Vermont consumer goes to apply for a new auto insurance policy is going to look like on paper that they, have no motor vehicle history now for someone with a bunch of infractions, that may be a good thing for them because they're gonna get a lower rate than they might otherwise get. But it it's going to negatively impact both safety of other folks on the road. And, also, if you have a good driving history, they're gonna have to price that policy based on a lack of information just as they would with a 15 or 16 year old driver. So it is important that we maintain the exemption for DPPA. As Bridget has has said, the Vermont DMV contracts very strictly limits how that data can be held, who it can be shared with,

[Senator Alison Clarkson (Chair)]: cybersecurity this exemption up by exempting this data.

[Dylan (Representative for LexisNexis)]: If you're exempting d m d m DPPN data, you are that data is still gonna be have to be processed, held

[Senator Alison Clarkson (Chair)]: Total every company would have

[Dylan (Representative for LexisNexis)]: to sign that contract. If you wanna get the data from DMV,

[Senator Alison Clarkson (Chair)]: you have to sign that contract. So if that is the final piece to two eleven

[Senator Thomas Chittenden (Member)]: The other

[Senator Randy Brock (Vice Chair)]: thing I

[Senator Thomas Chittenden (Member)]: have another one, though.

[Senator Alison Clarkson (Chair)]: And the definitions I'm

[Senator Thomas Chittenden (Member)]: Publicly available information is has different definitions of s 71 as of h as does h two eleven. So I've been trying to synthesize. That's why I thought it'd be also useful to find these two. So I don't know if Rick can speak to that now in the next two minutes, by getting some consistency across the two businesses where I see value in intertwining the mission one.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: So, I believe the request is to basically align publicly available information as was in that '71. Maybe I think Connecticut made a couple changes, in the 2025 definition, but I think the main thing is to make sure these are the same so that the control of their static brokers, which is, I think, a reasonable request. So it's, again, policy decision, how you want that definition to be. I think senator Chittenden's definition is more open as far as what is publicly available. It, I think, aligns more with some other states, Vermont, and the kids code has one definition that I think the house wanted to keep, So they can pause

[Senator Alison Clarkson (Chair)]: it for a good choice. Two eleven is based on kids

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: code. Correct.

[Senator Alison Clarkson (Chair)]: So we already have a misalignment there in exploring s 71 upstairs, which I believe we will have it. And so I'm more optimistic than you, Thomas. I believe we will because everyone wants one. I believe it's coming out of Congress, and so I'm not too worried about it, but I am willing to do this. The question I have is, have they addressed this alignment issue up on the 2nd Floor?

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: That specific definition or any of the definitions? Not that one. There's been discussion about it, but there's not been a clear indicator of what I we're gonna

[Senator Alison Clarkson (Chair)]: would like to explore that with the chair before we make a decision.

[Dylan (Representative for LexisNexis)]: I just

[Senator Thomas Chittenden (Member)]: like regional consistency, and I'm also looking at reproductive itself, sexual health data, which I don't see in h two '11. So it just seems like a better than if we need to realign kids go, I'd be able that too. Yeah.

[Senator Alison Clarkson (Chair)]: But it's in it did get to. So with those two possible changes to to 11, if we're going to take it so

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: What are the two changes? DPPA and what's the other change?

[Senator Alison Clarkson (Chair)]: DPPA and the and aligning the definition

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: of publicly available. Which is

[Senator Alison Clarkson (Chair)]: Which I'm reluctant to Okay. To change definitions at this point, but I'm happy to ask the chair, how they're dealing with the idea.

[Senator Thomas Chittenden (Member)]: I'd like to see them, like, next to each other, and that's where it'd be useful just to see where the differences are.

[Rick Siegel (Office of Legislative Counsel, Vermont Senate)]: That's right. I can email I can email that to the committee. That would be great. Okay.

[Senator Alison Clarkson (Chair)]: That would be great. So if we have agreement, I'm I'm trying to get us to land February. So I think we're almost there. S 71, if people are interested in incorporating it, we would then begin to look at it on Tuesday. I think on Monday, we're going to enter a time nine to eleven, Tuesday. We're back here Tuesday.

[Senator Thomas Chittenden (Member)]: Mississippi one has passed by the senate. Right?

[Senator Alison Clarkson (Chair)]: Yes. With the Connecticut updates.

[Senator Thomas Chittenden (Member)]: So that's the vote of contention. Right?

[Senator Alison Clarkson (Chair)]: We have. It's not a vote of contention. It's it there's there are some Connecticut updates people like and some that they don't, but we've included. I think most of them accept for some of the ones that I believe the chamber said have seen challenges with. So this

[Senator Randy Brock (Vice Chair)]: is

[Senator Alison Clarkson (Chair)]: a very chamber friendly amendment. Just saying.

[Senator Thomas Chittenden (Member)]: To that point, if I may, we make it hard enough for businesses to operate in Vermont with our regulatory structure that I don't want to make it even harder to have an isolated island of policy around data. That's why I see regional consistency, and I agree with the government, this perspective. And I think it's a starting point that we can build on next year. Since you've raised chamber friendly, I'm just trying to make remodeling.

[Senator Alison Clarkson (Chair)]: No. I'm a chamber friendly kinda girl. I appreciate our chamber, and we rely on our chamber for many, many partnerships. However, I'm just trying to get agreement here. If s 71 is what you're interested in looking at, we're gonna make time next week. I will battle with our program here on more time. Now this is something I need you all to weigh in on to because we're gonna need to take time. We're gonna ask you all to read it. Rick is going to send us the new version of s 71 with the Connecticut updates. We will look at it. I really need you to look at it this weekend, you know, over the next few days. We're gonna look at it Friday. We're gonna begin to walk through it on Friday. So if you could look at it out in all that spare time you have, we're gonna begin to walk through it on Friday. We will then land these two additional pieces on H211 first, okay? And then we're gonna dive into 7.2. Is that a plan? Okay, great. Thank you everybody. Excelsior.