Vermont Legislature SmartTranscripts:

[Sen. Wendy Harrison (Chair)]: Okay, today is Wednesday, May twenty seventh, twenty twenty sixth. This is Senate Institutions, and what we are doing this afternoon is we are getting a walkthrough from Budge Council on S-seventy one as it was passed by the House yesterday. Thank you, Rick, for being here.

[Rick Segal (Office of Legislative Counsel)]: Yes, thank you. Rick Segal with the Office of Bledged Head Council. You should have either on your community web page or in front of you, the S-seventy one House Propulsion Amendment. You may also have draft 5.2, it's the same document. It's the 5.2 is the draft of House of Commerce, worked on favorably, and the House adopted the Commerce report. So the House amendment just got released just about an hour ago. Senator Nancy updated the commencement. There's also, as I see, you will have a printout of the side by side. I will be going over that as well. But I'd kinda like to start with an overview of the bill and kinda talk about how it differs from what past seven, well over a year ago, if that works, Madam Chair?

[Sen. Wendy Harrison (Chair)]: Yes. Thank you.

[Rick Segal (Office of Legislative Counsel)]: What House Commerce did, it went through several iterations of this bill. Late last year in May, I did a strike all of it, but in House of Commerce, that was a drastically different bill. It was a basically, you may remember last year, this thing that you switched out of the language, House of Commerce kind of reverted back to what you were working on before you flipped the language, if that makes sense. So House Commerce had that version on the website for a while. Didn't get to it until after crossover this year. Got back to it. There were discussions about, you know, should House Commerce stick with that flipped version? Should it go to more to what the senate passed? Should it be some kind of middle ground? You'll hear me say Connecticut '20 2581 in this meeting, because the s 71 is passed by the senate was largely the Connecticut 2023 initial framework for data privacy. That's what you go past. Not quite a copy and paste, but this is mostly what Connecticut had done a few years ago. Last year, Connecticut made pretty big adjustments to their data privacy before Q walls took up at 75. So those amendments became in this chamber, this house, state house, known as the Connecticut 2025 amendments, which take effect July 1. And I'll talk about those amendments. So Commerce is working through all these different iterations of the bill, and finally resorted resolved to 5.2, draft 5.2, which is foundationally what you all passed in March of last year with Connecticut twenty twenty five changes, both of them, and some Vermont changes as well that were specific house numbers. Does that set the stage somewhat well?

[Sen. Wendy Harrison (Chair)]: Yes. And Senator Benson, you have questions, do it right here.

[Rick Segal (Office of Legislative Counsel)]: That's right.

[Sen. John Benson (Member)]: Guess just the first question is, why can I get,

[Rick Segal (Office of Legislative Counsel)]: That's probably a policy question, but from what I've heard, is there's a desire for a regional model, which is not entirely accurate because New Hampshire does not have exactly what Connecticut has now? Maine does not have the same privacy laws passed, so House decided and the Senate last year has chosen Connecticut to be its You don't have to do that, but that's what most members have chosen. It's not quite a model law, and I want to see a little bit more as I think about it. You heard UCC, the Uniform Commercial Code, is a model of law because every business, when they conduct a transaction, the UCC can govern it. So you want that to be kind of the same across state lines. So most states, including Vermont, have adopted the UCC. Data privacy, same idea, where you may have businesses that operate in all 50 states. How is a business going to comply with all 50 data privacy laws if they're all different? That's one of the arguments for a consistent law, but that's not happening in the Senate. You have very unique data privacy the most across the states.

[Sen. Wendy Harrison (Chair)]: And I'll just add to that. Many people think that an effective, meaningful federal law would be best? That doesn't have to be the time center.

[Rick Segal (Office of Legislative Counsel)]: Okay. So I have shared the House proposal commitments on the screen. I'm gonna go through this, and would you prefer this or the side by side? I don't really have a preference myself. Would it be easier to see the side by side? Anybody? I

[Sen. Wendy Harrison (Chair)]: like this side by side.

[Rick Segal (Office of Legislative Counsel)]: Okay. And I have, so, what you have is something called Draftable, which, frankly, I didn't have time to, ctpage.com again side by side, so Graft Tool's a pretty good tool where you just upload it and there's no user error, it knows which text is different. It's kind of small, but that's probably the best we're gonna do. Okay, there are gonna be four types of differences between house and sign up versions. One is gonna be layout non substantive, so kind of adding reader assistance throughout the bill. I did that throughout the last few months to kinda improve readability. This is a very technical complex bill, so adding some subsection headings were not in the center version, but they are in the house version. You also that's one type of change. The second type of change is Connecticut twenty twenty five. Those are also noted, but those have been updated from the senate version. Third type of change is house of commerce unique changes, mostly in the definitions, but there are a few other portions where house of commerce had some kind of not Connecticut or any other, specific reason to make a change. They just decided to go with a different version of the of the language. Fourth is aligning with the age appropriate sign code, which just simply passed last year. And I'll note when those things happen. You. Okay. So the definition of so it went to Senate, Friday's House. The definition of a warning was removed because the House refers to that type of protection differently as under one VSA 150, part of the shield law, I'll get to that, but it's not necessary. You're not removing a protection, you're just removing the definition because it's not necessary. The short title, House of Congress wanted to call the Civil Law Data Privacy and Online Surveillance Act, so bring that over to this version. No change to the definition of affiliates. Authenticate, no change to that, except just title to subchapter. That's not a substantive difference. Biometric data. So this is a change to align with the age appropriate design code at, House of Commerce decided to not go with Connecticut's 2025 update of biomedical data, which was minimal, but there was an update to that definition. So the main difference you can see here is the include. In the house version, you have some things that are clearly including biometric data, iris, Brenda's Gantt, fingerprints, and so forth. Those aren't excluded in the Senate version, but they are explicitly included in the House version as biometric data. And that is sensitive data. So when you think of sensitive data, this is one of the things you wanna think about being treated a little bit differently than spoken. What it does not include is the same as the Senate version. Subversions four and five are either exemption cross references. The house version includes several HIPAA related exemptions. The so I guess the senate does have that. Sorry. So moving on to collect, that is not defined in Connecticut. The House decided to define collect, and that is a Vermont decision that they made. It means buying, renting, gathering, obtaining, receiving, or accessing any personal data by any means, other than such activities that should be pulled in a processor or between a processor and subprocessors. It also includes receiving data from the consumer, either actively or passively, or by observing the consumer's behavior. Consents. No change to the consent definition between the two. Connecticut added the word organization to nonprofit in their definition of consumer, so that was added to the House Gripen as well. The term or status in consumer health data is, I believe, also a Connecticut 2025 update to what is consumer health data, and it's also sensitive data, but mostly along with kind of HIT 2025, especially updates there. Submission 11 on the I'm looking at the right side mostly. It's kind of the beginning document. Consumer Reporting Agency is used in the exemptions under the Fair Credit Reporting Act, so that is brought into the house definition. Controller is the same. COPA is the same, it is cross referenced to the Children's Online Private Security Protection Act of 19 leagues. Covered entity is the same. Credit union is not defined, and Connecticut is defined in Vermont, it does not use as exemption. Dark pattern is the same. Decisions that produce any legal or similarly significant effect is a Connecticut twenty twenty five alignment. So it means any decision made by the controller or on behalf of the controller that results in a provision or denial by the controller of any financial or limited service, any housing, any insurance, any education, enrollment, or opportunity, and so forth. The identified data is a HIT code alignment. It does not match up with Connecticut twenty twenty five, but again, the House decided to keep that definition as the HITSCO definition. And you can see where the differences are in blue in 18 and in 16. So adding a few words, phrases, about reasonable measures especially, and re identifying the good news. Okay, 19 derived data is also a KITS code definition that was brought over, it's not defined in Connecticut. It's data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about a consumer device. Gender affirming healthcare service, health data are the same, and the two. And if you all, by the way, I'm kind of assuming that Connecticut 2025 is understood. I know it's probably not, but I also understand the time for

[Sen. Wendy Harrison (Chair)]: the truth. Yes, this is what you're doing now is perfect.

[Rick Segal (Office of Legislative Counsel)]: I just also, if anyone has, please stop me. I don't mind being interrupted if you don't have a question about this. Genetic data is not defined, and genetic appeal it's defined here, it matches, for the most part, the kid's code definition of what genetic data is. It is also sensitive data. Geofencing matches the Connecticut definition. Healthcare facility has a cross reference at the exemption section, so that's why that is included there. Higher entity, same thing, that is in the exemption section. 27, or identifiable individual is a HITS code alignment. That last phrase after the comma, so it means an individual who can be readily identified directly or indirectly, comma, including by reference to an identifier, such as a name, an identification number, precise geolocation data, or an online identifier. Institutional higher education is the same, mental health facility is the same, minor is not defined in Connecticut or in '71 is passed by the Senate. It is defined here. That matches KITS code, it's also a fairly common definition of what a minor is. Herald data was added in Connecticut, so that's why it was added here, subdivision 31. Nonprofit organization matches the Connecticut and the Senate definition. 33 is a cross reference in the exemption section referring to healthcare research. Person matches as passed by the Senate. Personal data is aligned with GITS codes. It is any information, including derived data and unique identifiers, that is linked or reasonably linkable alone or in combination with other information to an identified or identifiable individual, or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals. Precise geolocation data matches the Senate as does processing. Process Aware has a couple of additions. This is a Kids Code alignment. It needs a person who collects or processes virtual data on behalf of a controller or another processor. Senate just has a person who processed my behalf of a short lived. Profiling is also a Kids Good match gist. See on the left side, replace it related to identified or identifiable individual. The house version has including an individual's economic situation, etcetera, or identifying characteristics is also new, and that's a kids' book clinic. 40, protected health information, is the same. Synonymous data is the same. It's a mathematical fix. Data is plural, by the way. I learned that from the editors. Yes. So every time you say data, it's data R, not data is. Data is the singular

[Sen. Robert Plunkett (Vice Chair)]: word for data. Unless we're talking about star tripping, which means data.

[Sen. Wendy Harrison (Chair)]: No, we're gonna talk.

[Rick Segal (Office of Legislative Counsel)]: No, Senator Plunkett. That's the end of it. 42A, publicly available information, is different, not even from Senate, Connecticut. It's also a little bit different than kids' code. The House of Congress took quite a bit of time debating this definition, so I think we should probably go over it. 42a, publicly available information means information within the House version that is made available through federal, state, or local government records, or to the general public from widely distributed media, or a controller has a brief public basis to believe the consumer has also made available to the general public. That's mostly aligned with what the Senate has. There's a couple of differences, but that's not where the disagreements came up. The disagreements came up in what it's not included. And taking a step back here, this is taking a very important definition because it is publicly available, it's not personal data, and therefore not gonna be regulated by this addict. So when when a bill, when this bill says a piece of data, or when a controller deems a piece of data to be publicly available, that data is not gonna receive any type of deletion ability or the consumer to opt out. At that point, it's publicly available, right? There's nothing

[Sen. John Benson (Member)]: that the consumer do have.

[Rick Segal (Office of Legislative Counsel)]: Subdivision So, B, publicly available information, does not include Another way to think of this is this is personal data, okay? Personal data includes biometric data collected by a consumer without a consumer. Two, information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website, either in exchange for a payment or through a charge. Three, an inference that is generated from the information described in that subdivision, the information that is coded in. Four, solely for the purposes set forth in A1, two, and four of the sub tabular information that is made available for sale right now. So I'm gonna stop with that one. That one is unique. So for the most part, this aligns with kids voting central to that. House of Congress decided to kind of restrict that exclusion of this. So if information is made available for sale, it could be any information, Robert, we're not talking about personal data at this point, we're talking about any information. If that piece of information is made available for sale, it does not just make it publicly available immediately, but it's all necessarily personal data. So A1, A2, A four. A1 is the consumer has the right to know that the controller is processing that data. A2, and Dylan just told this to me just twenty minutes ago, but we'll get it again. Not processing consumers' personal data or any

[Sen. John Benson (Member)]: material, sorry. Wrong two. Correct

[Rick Segal (Office of Legislative Counsel)]: inaccuracies in the consumers' personal data, and four, obtaining a copy of that data. So, if it's made available for sale, the consumer has those rights for that data. Confirming whether or not they have it and are processing it, correct inaccuracies that's in that data that's for sale, or four, obtaining a copy of that data in some kind of tangible format. The difference between Kids Code in this definition is you don't have the solely for the purposes set forth. It's just Roman F4, information that's available to your sanctuary, if that makes sense.

[Sen. Wendy Harrison (Chair)]: Thanks.

[Rick Segal (Office of Legislative Counsel)]: Five, any obscene visual depiction, That's why federal law says personal data that is created through the combination of personal data with publicly available information. Seven, genetic data, unless otherwise made publicly available by the consumer to whom the information pertains. Eight, information provided by a consumer on a website or online service made available to all members in public for free or for a fee, where the consumer has maintained a reasonable expectation of privacy and information such by restricting information to a specific audience, or intimate images, authentic or computer generated, found to be non consensual. Going back to the Cena version, you can see that it just had 33 on the left, A and B, didn't have the does not include restrictions on password. Should I continue?

[Sen. Wendy Harrison (Chair)]: Yep. Okay.

[Rick Segal (Office of Legislative Counsel)]: You have reproductive or sectoral healthcare. This is a cross reference to Vermont's one PSA 150 C. Reproductive or sexual health data is the same as the Senate passed as it is facility. Sexual health facility is the same as the Senate passed. Sale of personal data is the same as the Senate passed. Sensitive data matches the Connecticut 2025 updates. You can see the changes of ravine, highlighted in blue, adding to sensitive data status as non binary or transgender, two, a mental or physical health condition, diagnosis, disability, or treatment, information derived from genetic or biometric data, and then if a controller has actual knowledge or briefly disregards that a consumer's child, that personal data gets sensitive data. Payroll data, we've added, has sensitive data, and then various account numbers, government ID numbers, that applicable law does not require to be publicly displayed. So that's some type of thing, account, credit card number.

[Sen. Wendy Harrison (Chair)]: And those are all, I'm sorry, those are all Connecticut 25? Yes. Okay, thank you.

[Sen. Robert Plunkett (Vice Chair)]: Target and

[Rick Segal (Office of Legislative Counsel)]: advertising matches the updates, I think it's like 75, which I think will amendable. And you have third query, no domain, create secret, no change from a FastPass five to some estimate. Those are the definitions. Next section is applicability. As passed by the Senate, the applicability was 100,000 consumers. In other words, if a controller processed the data of, at minimum, 100,000 consumers, that controller was subject to be regulated by the Act, which Connecticut had in 2023. 2025, Connecticut lowered that to 35,000. This version also reduces it from 100,000 to 35,000 consumers. Connecticut added two other thresholds, which was the sale of personal data and the collection of sensitive data. Connecticut signed on one, so if you sold the personal data of one Connecticut consumer, we're subject to the bill. If you collected the sensitive data of one Connecticut president, you were subject to the will. House commerce decided not to go with that, it takes 3,000 consumers for deletion. It's still 35,000 is kind of the the floor for the major just processing data, but it's you. Collect the sets of data of 3,000 per month consumers, you are regulated by regulated by the bill. If you sell the personal data of 3,000 kilometers, you are subject to the bill. Either one of those three, you mean that you are regulated by it. So how do Connecticut, The health data language is the same, so moving on to the exemptions. So the exemptions is very different for Mass Pass by the Senate. The house decided to keep the exemptions that it had been working on for the last two years. In 2024, the last biennium, house of commerce took a lot of testimony, on basically making those exemptions very specific. They wanted to include loopholes with various entities that they thought did not serve a loophole. So the exemptions in the senate version matched Connecticut's. The exemptions in the House version are not at all. They're very, very, very different. I'll go over these, but the the ones you may hear about in the House version, there's not a nonprofit exemption. The Senate did have that, but also had a in 2025 had a nonprofit exemption as well. There's occasionally on the Senate version, you'll see Subdivision for the institution of higher education, which is a exempt in the Senate version. The House version does not use that same language. It uses instrumentality in the state, which is a institute of higher education in the state. If it's not a state college, they would not be necessarily exempt unless they'd be not an exemption, if that makes sense.

[Sen. Wendy Harrison (Chair)]: Yeah, if it's a private school, then That's also correct.

[Rick Segal (Office of Legislative Counsel)]: I'll just go through the exemptions and the house side. So any federal, state, tribal, or local government entity, or any speciality in the state, as I mentioned, 2A, a covered entity that is not a hybrid entity, any healthcare component of a hybrid entity, or a business associate. The next several exemptions are healthcare, health research related. So three, patient identifying information. Four, information to the extent for public health, community health, or public population health services, as authorized by HIPAA, when provided by or to a covered entity, or provided by or to a business associate, in accordance with the dissociate agreement with a covered entity. Information that is a healthcare record, if the information is held by an entity that is a covered entity or business associate under HIPAA. C, information that is de identified in accordance with the requirements for identification under 45.64514, and that is provided for individually identifiable health information as described in HIPAA. The personal information consistent with the human subject protection requirements of the US Food and Drug Administration. Five, information due only for public health activities and purposes described in 45 CFR 160 four-five-two, which is the disclosure of protected health information without authorization. This information that identifies a consumer in accordance with activities that are subject to the federal policy for the protection of subjects. Activities that are subject to protection provided in 21 CFR Part 50, which is FDA clinical investigations, protection of human subjects, and FDA clinical investigations institutional review boards. Or C, research conducted, you give those two other requirements. Seventh, patient identified information that is collected and processed in accordance with 42 CFR Part two, common legality and substance use disorder patient records. A, Patient Safety Work Product that is created and used for the purposes of patient safety improvements in accordance with 42 CFR. Nine, information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986. 10, information processed or maintained solely in connection with, and for the purpose of enabling notice and an emergency to persons that an individual specifies. Eleventh, any activity that involves collecting, maintaining, disclosing, selling, communicating, or using information for the purpose of evaluating the consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or motive when it is up strictly in accordance with the paracredible impact by a consumer credit reporting a consumer reporting agency, a person furnishes information to a consumer reporting agency, A person who uses a consumer report. Well, information collected, processed, sold, or disclosed under and in accordance with the Faulkner Laws of Regulations. The Drivers' Privacy Protection Act of '94. Data that is subject to FERPA, the Family Educational Rights of Privacy Act, data that is subject to the Airline Deregulation Act, data that is subject to the Farm and Correct facts, Data that is subject to federal policy under 21 USC three thousand eight thirty, which is the regulation of listed chemicals in certain machines. Data subject to Title V of the Grant Leech Wiley Act. A state or federally chartered bank or credit union or an affiliate or subsidiary that is principally engaged in financial activities, an agent broker dealer investment advisor or investment advisor representative as defined in 5102, DFR, or securities and exchange regulated by. 16, insurance companies. It is the persons regulated to make DSA Part three, unless you establish or maintain self insurance. 17? Why don't you fast, let me know.

[Sen. Wendy Harrison (Chair)]: This is

[Rick Segal (Office of Legislative Counsel)]: good. This is of the denser stuff. 17 healthcare providers and healthcare facilities, as defined in eighteen ninety four(two), provided such providers and facilities maintain all protected health information in accordance with the requirements of ATVSA, ATV-eighty one, and HIPAA, regardless of whether such providers or facilities are covered entities. 18, protected health information under HIPAA. A third party administrator as combined in the third party administrator rule, provided a third party administrator is subject to and compliant to EFR's Regulation IH two S one-one, which is their privacy of consumer financial and health information. 20, personal data of the victim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim service organization collects, processes, or maintains in the courts of its operation. 21, a nonprofit organization that is established to protect and prevent prodigal acts in connection with insurance. 22, information that is processed for purposes of compliance, enrollment, or degree verification, or research services by a nonprofit that is established to provide enrollment and data of the portal services on behalf of post secondary schools. 23, the noncommercial activity of a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report, or other publication in general circulation. A radio or television station that holds a license issued by the FCC. A nonprofit organization that provides programming to radio or television networks, or a press association or wire service. Finally, data processed or maintained in the course of an individual applying to, employed by, or IHS agent or independent contractor of a controller, processor, consumer health data controller, or a third party, to the extent that the data is collected and used within context of our goal. As emergency contact information of a consumer. That is necessary to retain commensurate benefits for another individual related to the individual who is subject of the information pursuant to 18, which is the protected health care information of the HIPAA. Subsection B, Controllers, processors, and consumer health data controllers that comply with the verifiable parental consent requirements, COVA, the Child Online Privacy Protection Act, shall begin complying with any obligation to obtain the consent pursuant to the subject matter. Those are the exemptions.

[Sen. Robert Plunkett (Vice Chair)]: They seem you weren't there the entire time, but there's a lot of exceptions. Some of them are are clearly covered by some other law. Some of them clearly entities or perhaps data that by policy. We don't wanna necessarily subject to this. In terms of those that are regulated by other law, we don't have time to do it, but did the house made out the chair and mark out here go over each and every line and compare it to how our comprehensive data privacy regulations, would protect those and essentially come to the conclusion if we're okay with that or was it just there was another law that covered so

[Rick Segal (Office of Legislative Counsel)]: Right. So this year the committee, my knowledge and knowledge, do that deep dive, two years ago they took a very, very deep dive and I'm able to explain if he remembers how to keep you all my answer to that exemption sanction.

[Sen. John Benson (Member)]: This year, the deepest week, is hearing getting testimony from our financial institutions, insurance, our health care.

[Sen. Robert Plunkett (Vice Chair)]: Okay. I'm here at that process to get to this.

[Rick Segal (Office of Legislative Counsel)]: So Section 2415B, Defense Interpersonal Data Rights, that to comparing the Senate version and then also Connecticut twenty twenty five. The updates in blue that you see on the right side are Connecticut twenty twenty five digits. So these are consumer rights, subdivision one, confirming whether or not a gate controller has actually processed air ticket, and then including just the new language that I add, the inferences about the consumer derived from such personal data, and whether a controller or processor is processing a consumer's personal data for the purposes of profiling to make a decision that produces any legal or generally significant effect concerning the consumer unless such confirmation or access will require the controller to control trade secret or the controller prohibited from disclosing such personal data under subsection e. So last year, Connecticut added quite a bit of this profiling protection, mostly AI automated decision technology in response to that. So you'll see this time and language appear in certain instances. Subdivision two, no changes from as passed by the Senate, correcting the inaccuracies in your data. Three, no change, deleting your personal data. Four, no change, obtaining a copy of your data. Five, no change, opting out of your data for purposes of targeted advertising or the sale of your data, except as provided in 2014 GPB, which is like a loyalty program. If you have one of those loyalty cards with your virtual school organization, you've agreed to opt in to that. Profiling and further into making an automated decision is the same as in Senate Pass version. Subdivision six is brand new. Again, Connecticut added this in 2025. This is the profiling type of protection. If the consumer's personal data were processed for the purposes of profiling and furtherance of any automated decision that produced any legal or similarly significant defendants to our consumer, and if feasible, A, question the results of such profiling, B, be informed of the reason that such profiling resulted in such decision, C, review the consumer's personal data that were processed for the purposes of such profiling, and D, if they concern housing, taking into account the nature of the personal data and the purposes for which personal data were processed, be allowed to correct any incorrect personal data that were processed for the purposes of such profiling, and have the profiling decision re evaluated based on the corrected personal data. Seven, obtain from the controller a list of third parties to which such controller has sold their consumer personal data, or such controller does not maintain a list of the third parties to which such controller has sold the data, a list of all third parties to which such controller has sold virtual data, providing control shall not be required to obtain the trade solution.

[Sen. Robert Plunkett (Vice Chair)]: The if feasible on number six, that's in turn. Yes.

[Sen. Wendy Harrison (Chair)]: Yeah, that's notable. I

[Rick Segal (Office of Legislative Counsel)]: will double check, but do you see something I don't see? Do you have a pen? I guess in my book. No, I don't. Okay, okay, okay.

[Sen. Robert Plunkett (Vice Chair)]: No, I'm only asking questions. I'm not That's a I

[Rick Segal (Office of Legislative Counsel)]: I would understand if you have a pen and Okay. Pen So we are at Subdivision B, exercising consumer rights. So Subdivision 1 is the same except adding a cross reference about the privacy notice that was not in the Senate version. It's also not in Connecticut, but I thought it's important for rear assistance and for the controller to know we're talking about this specific privacy notice that the bill requires you to make to comply with the law. So the green means that it's been moved. Again, Connecticut, for all that we put from them, I also reorganized their work, the flow a little bit better. So the green indicates this language existed in the Senate version that you all passed. I didn't have time to organize that Senate version as I would apply it, so you have some of that language has been moved and organized in a different way. With that said, subdivisions 2A, B, and C exists in the Senate version, just in a different place, which is basically that the consumer has the right to designate a person to act on a behalf. The one major difference between this and Senate and Connecticut is that the House decided to allow the consumer to have an agent for all resorts. So the right to know if they're processing the data, the right to know if you opt out, the right to get popular data. I believe in Connecticut and in the version that you all passed last year, A5, which was the opting out of your data, that was what I believe Kinetics still just has that as the one way you can have point to nature. So the way this works in reality is a consumer would be able to hire a company that does this for you. And you'd give them your data, you'd pay them how much they charge, and then they would have the right to do all these things that you have the right to do, but they would do not have have, if that makes sense. So it's a noble difference between Senate, Connecticut, and then put the house mask together. Otherwise Some the green. That is actually Some of the green. That is actually So 2A, that's kind of near the bottom of your screen.

[Sen. Wendy Harrison (Chair)]: Yeah.

[Rick Segal (Office of Legislative Counsel)]: A consumer may designate another person to serve as the consumer's authorized agent and act on the extent you have to opt out of secret processing of the personal data for purposes specified in subsection A subsection I'm noticing something, actually, that might make you choose something. So, the way that's worded, again, it's language taken from the center version, right? The

[Sen. Wendy Harrison (Chair)]: I found this on the web.

[Rick Segal (Office of Legislative Counsel)]: Thanks, Zuri. The center version just allows you to do for the opting out of personal data. So I guess

[Sen. Wendy Harrison (Chair)]: So the agent could do more things.

[Rick Segal (Office of Legislative Counsel)]: Yeah, but the language might Here, so here's the language, right? So 2A. A consumer may designate another person to serve as the consumer's authorized agent. So this it just said, for the purposes specified in sub second A, that would make more sense, but we have a whole bit of a rigid, to opt out of the processing of the consumer's personal data. You see what I'm seeing here? Yeah. I don't think it removes the right of consumers, but it's a little confusing. So I'll let y'all think about that. Going back to the side by side, you can also fix, the ACCOs can affect 01/01/2028, so if you see something you don't like, and you wanna pass this, you can sort of fix it if you wanna fix it next year. Okay. So you have two a, b, and c. B and c are the same, just moved in a different place in this bill. Three has a small change like Connecticut made the actual knowledge. If the consumer's a child, they change that language to that. If they have actual knowledge or willfully disregards that consumer's child, but the actual substance has not changed. C equal compliance is the same. Time line to respond is word for word. You can see I added the subsection headings, otherwise it is word for word is passed by the subheadings. I'm gonna skip this unless you want me to

[Sen. Wendy Harrison (Chair)]: Nope. Yeah. Go. Okay.

[Rick Segal (Office of Legislative Counsel)]: You have a couple of adding the word consumer, nothing substantive there. Pursuant to the section, non substantive. So the next substantive change is e, subject to e, which is brand new, then it could add this in 2025, the House decided to break this over in their version. E, disclosure of certain information. A controller shall not disclose the following personal data in response to a request to exercise the consumer's rights pursuant to a one of the section, and shall instead inform the consumer or the person, an agent, exercising such right on behalf of the consumer, with sufficient particularity that the controller has selected consumers. So this is sensitive, and the point of this is the controller should not just disclose, Here's your social security, but we are collecting the Syrians. It's more of like, We do have your social, but we're not gonna give it to you. Just, We have it. Then there's, it's kind of up to the control room, sufficient particularity how they wanna disclose that information. Any questions about that section?

[Sen. Wendy Harrison (Chair)]: Is this part of the process to correct information?

[Rick Segal (Office of Legislative Counsel)]: Could be, yes. It's mostly just non disclosing sensitive information. They consume over an alibi license to go to their own hands or to be read by someone they don't wanna have it created. Okay. So 2415b, the duties of controllers, this is the data minimization section of the bill. On the left, again, senate reflects Connecticut 2023. The right is a mixture of senate and Connecticut 2025 and a few things in Vermont. House did a little bit on their own. A one, a controller shall limit the collection of a consumer's personal data to when a screen is only necessary and proportionate, Connecticut added those two words. I think they had adequate, relevant, and necessary. So that's the same as Connecticut. Relation to the purposes for which the data are processed as disclosed to the consumer. That subdivision one pretty much matches the 2025 Connecticut Object Machine. Two is a little bit different. Two, not process, a Controller shall not process a consumer's personal data for any material new purpose that is neither reasonably necessary to, or compatible with, the purposes for which the data were processed versus two fifty seven Division I subsection, unless the controller receives consent from the consumer. Connecticut did something similar, except they ordered that a little differently, and also kind of defined what is reasonably necessary, what a consumer would expect. House of Commerce decided not to get that explicit list, and instead required to disclose the consumer and cross referencing subdivision one. In other words, that if if a controller wants to process a consumer's data that it already has for a material and due purpose so I think of, I used to speak at the World House Commerce, a flashlight app. Like you download a flashlight app, right? Use it for a flashlight, and you get the app, you agree to their terms, and the terms would be can access your flashlight. Right? That's maybe one thing to let it do so it can work appropriately. Most consumers wouldn't anticipate to know your location, that it would be able to track where you are, these kind of things. So if a controller wanted to do that, wanted to process your data for geolocation or something else, they would need to disclose that and get your consent. That's what two does.

[Sen. Wendy Harrison (Chair)]: That's explicit consent. Right?

[Rick Segal (Office of Legislative Counsel)]: It's consent, often, yes. Okay. Which could be, you know, it's there is some language that defines consent, and it needs be unambiguous, it needs to be clear. Okay. So three is the same, establishing reasonable administrative, technical, physical data, security crisis. So four, what the House did and how I organized this is a little bit differently. Substantially, it's not that different than what the Senate did over at nineteen twenty four, twenty five, so. But organize it as far as for sensitive data. So these are all the things that a controller shall do or shall not do when it pertains to sensitive data. A, not process the sensitive data unless the consumer has provided consent, that's often, and unless the processing is recently necessary in relation to the purposes for which sensitive data are collected. B, not sell sensitive data unless the consumer has provided consent. Also opt in. And C, if the controller has actual knowledge or remotely disregards that the consumer is a child, processes sensitive data in accordance with COPPA, which is in Copenhagen's language. And then it's Roman Ed two, if applicable, section 2,449 F of this title, that is the kids code, and that is something you'll notice in this bill. There are a few times that this bill explicitly references that soon to be effective law in January of next year. Because if you're a business, you could be also regulated by that vote. Controllers should be aware that this regulates them, as well as the kids' vote law. So that is intended to ensure that they also be a fair value. Five, a controller does not process personal data in violation of any laws to the state that prohibited the lawful discrimination against consumers. This is Connecticut between 2025 and any evidence or lack of evidence concerning proactive anti bias testing or any similar proactive effort to avoid processing data in violation of any such law, including any evidence or lack of evidence concerning the guilt about quality, efficacy, recency, and scope of any testing or effort, the result of which shall be relevant to the claim available for a violation of such law and any defense bill thereto. So Connecticut made that update and the House of New York City. Sixth is the same as in the Senate, providing a mechanism for consumers to revoke their consent. Seven, if a controller subject to nine, which I'll get to in a second, if the controller has actual knowledge and hopefully disregards, then the consumer is at least 13, but he doesn't recognize me, which takes him out of COPA. So COPA is 13 and up, and that's the point of that page 13. But they're minor. A, not process the personal data of the consumer for purpose target advertising. That is a Connecticut 25 edition. B, not sell the consumer's personal data. Eight, is the same, not discriminate against the consumer for exercising any rights that they have chosen to exercise as law. And nine is unique to Vermont because it brings into I don't know, the kids code into play. If the controller is a covered business, which is a Kid's Code definition, and the Consumer is a Covered Minor, as quotes are defined in the Kid's Code section of the title, they shall comply with the requirements set forth in that subchapter. And it's more restrictive, so they need to give birth. The limitations are the same as passed by December. The privacy notice has Connecticut 2025 updates. Subdivision B has one thing that is not Connecticut that's in Vermont reference. So a controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes B, let's skip to B, the purpose for processing personal data, and a description of the processing pursuant to A1. So A1 is the data minimization piece, which says that a controller shall limit the collection as disclosed to the consumer. So the controller has to, in the proxy notice, describe that process that they do. C is Connecticut twenty twenty five, a description of the means for consumers to submit requests to access their rights, including a description of how consumers may exercise rights under 2,415 D. A, their personal rights, those seven rights they have. S is Connecticut twenty twenty five a clear and conspicuous disclosure of any processing of personal data for purposes of targeted advertising, or sale of personal data to a third party for purposes of targeted advertising? Okay, subdivision H is twenty twenty five, work for work. In fact,

[Sen. Wendy Harrison (Chair)]: let's see.

[Rick Segal (Office of Legislative Counsel)]: And then H into subdivision two, this is all Connecticut three, all the way until subsection T is what Connecticut did in 2025. So, I'll go over this quickly. H, a statement disclosure, whether the Controller collects, uses, or sells personal data for the purpose of training large language models, and I, the most recent month and year during which the controller updated the privacy notice. Two, a controller shall make the privacy notice required under subdivision one publicly available through a conspicuous hyperlink that includes the required symptoms, on the homepage of their website, on their application store page, or download page of mobile device, three, on the application settings menu, or a similar conspicuous and accessible location. B, for a meeting in which the controller regularly interacts with consumers, including mail, if they don't have a website. C, in each language in which the controller provides any product or service subject to the Product's Notice, or carries out any activity that is related to any product or service described in that product or that it provides. And D, in a manner that is reasonably accessible to and usable by individuals with disabilities. Three, whenever a controller makes a retroactive material change to the controller's privacy notice, the controller shall notify the consumer with respect to any personal data being collected after the effective date of such change, provide a reasonable opportunity for the consumer to withdraw consent from any further and materially different collection. C, take all reasonable electronic measures to provide the notice. Take into account technology available to the controller and the nature of their relationship with the consumer community. Four, nothing in the subsection shall be construed to require a controller to provide a privacy notice that is specific to the state if they are to provide a notice that is generally applicable and that otherwise satisfies the requirements in the subsection. So if they comply with Connecticut, they'd like to apply for a long term.

[Sen. Wendy Harrison (Chair)]: And that's Connecticut language also?

[Rick Segal (Office of Legislative Counsel)]: Yes. Yes. Okay. D, providing consumers with access to exercise rights, adding that subsect containing this there. So A and B are the same, it's just language that has been moved, nothing substantively has changed there. This goes back to earlier in the section where I you saw other Korean language being moved around, that's where it was moved to. So we're looking at the means that a controller shall establish. Shall we provide a clear, conspicuous link on the proposed website to a webpage that enables a consumer or their agent to opt out of processing of their data, or targeting advertising, or for sale of their data?

[Sen. Wendy Harrison (Chair)]: That's Canadian. I

[Rick Segal (Office of Legislative Counsel)]: believe so. I don't have the label, but blue. It's blue, which means it's new. Yeah. And this list this this section tends to be 2025. Okay. No other changes after subdivision b that are substantive. So I'm gonna move to 2415F, which is gonna be very, very similar, last past five to seven with Connecticut updates. So you see 2415F on the left side, 2421F, process of duties, same idea, different title of the section. You see some changes made in Connecticut 2025 in subdivision one. On the left side of the grouping, the information available to the processor by appropriate technical and organizational measures. That's been removed and replaced by to the extent possible. On the subsection B, without any changes here, you will see the word words and impact added quite a bit in the next few paragraphs because Connecticut added impact assessments to their requirement for controllers who conduct pro bono. So no changes here. 24.15 gs, these are the data protection and now impact assessments. No change to subsection A. No change to subsection B. So C is very new, again, directly to Connecticut, Impact Assessments for Profiling. Each Controller that engages in any profiling, for the purpose of making a decision that produces any legal or similarly significant effect concerning the consumer shall conduct an Impact Assessment for the Profiler. The assessment shall include an extended read only known by or available to the Controller, as applicable A statement by a controller disclosing the purpose, intended use cases, and deployment context of and benefits afforded by the profiler. An analysis of whether the profiling poses any known or reasonably foreseeable high risk of harm to the consumer, and if so, the nature of that risk and the steps they've been taking to mitigate that risk. Three, a description of the main categories of data, processes, inputs, or in the profiling, and the outputs such profiling produces. Four, an overview of the main categories of personal data that the controller used to customize the profiling, if they use data to customize profiling, any metrics used to evaluate the performance and no limitations to the profiling. Six, a description of any transparency measures taken concerning the profiling, including any measures taken to expose consumers that the controller is engaged in profiling while the controller is engaged in profiling. And seven, a description of the post deployment monitoring and user safeguards provided concerning such road modeling, including the oversight, use, and learning process established by the controller to address issue horizons with such road modeling. Subsection D is the AG disclosures. The changes are adding or impacts because they will have the right to request not just the data protection assessment, but also the impact assessments if they have an investigation open. Same thing with E, the assessment efficiency and applicability, if a controller is already doing one of these in a different state that has the same requirements and belongs, then that same assessment can carry over to Vermont. Okay, 2415H, De identified data. Really no change to Subsections A, Requirements. B, Limitations. C, synonymous data. And D, oversight, disclosing nothing of substance here compared to as past five to seven fifteen. 2415I, construction of duties. In subdivision one, so the way I think about this section is kind of another exemption section, or kind of clarifying this is what the film is not to interfere with. So, subdivision one, the sub tracker shall not be construed to restrict a controller's, processors, or consumer health data control's ability to comply with federal, state, or municipal laws or Mensus regulations except it's prohibited by one being safe from 50. That's the shield ball in Vermont. That is a, obviously, unique Vermont language there. No other changes from one to 10. That's passed by the Senate. Subsection B, internal use of data, no real change. Just had them go around a little bit. Four. Let me confirm. I believe that's Connecticut. It is. So in 2025, can I get added to work A, B, C, and D and E? So we're talking about internal use data. So the I'm gonna go to the intro to the the obligations imposed on controllers, processors, or consumer home data controllers under the subchapter shall be for security controllers or processors' ability to collect, use, or retain data for internal use to, four, process personal data for the purpose of profiling and furtherance of any automated decision that may produce any legal effect concerning a consumer, provided that the personal data are processed only to the extent necessary to detect or correct any bias that may result from the processing, bias not effectively be detected or corrected without processing, and the data are deleted once it has been completed, B, process subject to appropriate safeguards to protect the rights of consumers secured by the Constitution. C, subject to technical restrictions concerning the reuse of data and industry standard security and privacy measures. D, subject to measures to ensure the data are secure, protected, and subject to suitable safeguards, including certain controls concerning and documentation of access to the data to avoid misuse, and ensure that only authorized persons may access the data while preserving the confidentiality of the data. And e, not transmitted, transferred, or otherwise accessed by a third party. Six, is mandatory. Or perform internal operations in accordance with the internal operations extensions, this avenue COPA, if the controller processor it processes data in accordance with the exception. Subsection C, the only change is subdivision three. In 2020, the general assembly passed Section one language versus 13, facial recognition technology by law enforcement. This bill was not authorized by the use of that technology, by the least. No change to subsection third parties, or subsection clarifications. Subsection personal data processing. Rephrasing a couple of things, no substantive changes. And then we have the enforcement section, 2415J. So the Senate version is just age enforcement. The House version is also age enforcement. There's a couple of differences, just how that's drafted and how that the cure period's drafted, but it's substantively pretty pretty similar to what the senate passed. So under the senate version, it falls under the Consumer Protection Act. It falls under the Consumer Protection Act under the house version. There's no prior round of action for consumers in the Senate or in the House version, and it's explicitly not allowed in the version. The reporting is a little bit different. The reporting in the House version will have the AG on an annual basis, reports the number of violations issued, how many of those resulted in enforcement, that resulted in trial, whether they gave you a cure or gave the opportunity to get consent for a cure. On the incentive side, there's a bit more information about kind of guiding the EEG and whether or not to get a cure, the house does not, prepared for that language. There is guidance that the agency shall provide guidance to controllers and processors to comply with the act. It's not very substantive, it's just kind of like you shall comply with the guidelines. Consumer health data privacy, and I'll follow-up with the curator again. Consumer health data privacy, it looks quite a bit different because the center version carried over the Connecticut drafting style, which was, they separated this section from their exceptions. That's what they need for us to do. In H one twenty one, which you all passed two years ago, you did it a different way. And the house version kind of brought back over that previous way, which is that the exemptions are all in one place. So if you're exempt from the bill, you're exempt from the bill, including the consumer health data. So you'll see a bunch of exemptions on the set aside that apply just to consumer health data privacy. Most of those exemptions were also in the Connecticut exemption section, but they just, for whatever reason, they separated out their exemptions from 98% of the bill, and then consumer health data was separate and convenient in of itself. That's why there's so much language missing, subsection B and C. But otherwise, the Consumer Health Data Privacy Language is the same as us. Excels, the geo fence went from seventeen fifty feet to eighteen fifty feet, so 100 extra feet. Okay. Okay, so that's the statutory part of the bill. There are two sectional sections the House added that were not in the Senate Archer's House. The extra one hundred?

[Sen. John Benson (Member)]: Eighteen fifty is what we had. The original film we did to me has enough images besides the same.

[Rick Segal (Office of Legislative Counsel)]: Thank you. So I'm gonna flip over to the bigger bill where you can see these here. There's no more comparison with it.

[Sen. Wendy Harrison (Chair)]: Okay, we only have five minutes.

[Rick Segal (Office of Legislative Counsel)]: I can stop there. Do you, at least

[Sen. Wendy Harrison (Chair)]: this was good, this was very comprehensive.

[Rick Segal (Office of Legislative Counsel)]: I guess the last thing, I'll go over the cure period. Okay. Is sixty days, so the effect today is 01/01/2028. It won't take effect for a year and a half with the accident. Starting that January and ending 06/30/2029, the AG can offer a cure period, actually shall get one if it thinks a violation is curable. So a year and a half, if there's violation of the AEG and if it thinks it's curable, the AEG shall issue a violation and give them sixty days to cure it. After that, 07/01/2029, the cure is optional. Completely uninsured by that.

[Sen. Wendy Harrison (Chair)]: Okay, and it takes effect 01/01/2028? Correct. Okay.

[Rick Segal (Office of Legislative Counsel)]: So the Senate also had to have a cure period. It was brought over and pushed out because it takes effect on the earth.

[Sen. Wendy Harrison (Chair)]: Okay. Well, thank you.

[Rick Segal (Office of Legislative Counsel)]: That was A lot of talking.

[Sen. Wendy Harrison (Chair)]: Yeah, but we made it through them. So thank you very much. Sure. Brett, did you wanna say anything? You don't need to.

[Brett (unidentified guest/witness)]: Sure. Thank you, madam. This process that we went through was lengthy. We took a lot of testimony. I can tell you that there is no one around my table that is completely happy with this bill. We have people that, if it's one thing we went far enough, we have people that we write about two sided. And I think not just around the legislative table, but around the room as well. I think everyone feels the same way. My feeling is that we have done a good job to get something on the books to start a basis from where we continue year after year to improve just as Connecticut has done. And, by starting at Connecticut's 1.5, I think we're we're starting Vermonters at the right place. I know other New England states are still at Connecticut 2023. Hopefully, they're gonna bring theirs up to date as well. We did make some changes, but in my world, when we deal with insurance, that we deal a lot with model law throughout the country. But each state is also able to make changes within that model law or their specific state. I think that's what we've done here, as well as try to keep that as model as we can. But there are Vermont specific things that we wanted to improve in this, you know, like kids code and different and those other things. So I think all in all, we have a strong bill, not as strong as we passed a couple years ago, but we listen to our business community and listen to advocates and try to walk that fine line. I'll wait, I guess I'll leave it to you.

[Sen. Wendy Harrison (Chair)]: Good, thank you. And the chamber was not opposed?

[Rick Segal (Office of Legislative Counsel)]: Yes, I mean you should talk to them, I mean

[Brett (unidentified guest/witness)]: they're not going out and jumping up and down saying yeah, yeah, pass this, but they did not oppose it as well. I would suggest you talk with the governor's office as well. My understanding is that the governor maybe already does.

[Rick Segal (Office of Legislative Counsel)]: That was a rousing endorsement. Well, I think they need to look at

[Brett (unidentified guest/witness)]: the language, but I think the concept of them is much better. There's no ERA, And there's others that changes.

[Sen. Wendy Harrison (Chair)]: And it would be the first level of security and predictability that businesses would have. All right. So, I'm ready to I feel like this was a very comprehensive presentation. Are there questions, comments, books? Start with that. Okay. Does anyone wanna have another meeting? Do that. I just wanna have a. Yes.

[Sen. John Benson (Member)]: Gonna say, this is a big bill Watson and first time I've ever seen it. Right. So I'm just not comfortable with it because I wasn't part of how the god had ever known.

[Sen. Wendy Harrison (Chair)]: Right. And then that situation that you I mean, whenever you're new like that, there are Yeah. Have many different need to

[Sen. John Benson (Member)]: Difficult spot because I just am a part of the development of this building. Right.

[Sen. Wendy Harrison (Chair)]: But many legislators before you have to go school. Very involved. They're more than just legislators. Okay. All right. So, I'd like to do a straw poll of, concurring So, the everyone who is ready to take care of the house, please raise your hand. Those who are opposed. Those who don't have an opinion.

[Sen. Robert Plunkett (Vice Chair)]: Yeah. That's it's a straw poll. You can't have no opinion. Yeah. Yeah.

[Sen. Wendy Harrison (Chair)]: Then okay. So it's 32 or 311. That's 32. K? Well, thank you very much. And we'll go figure out

[Rick Segal (Office of Legislative Counsel)]: Quarter.

[Sen. Wendy Harrison (Chair)]: Sorry? Okay. All

[Rick Segal (Office of Legislative Counsel)]: right. Usually someone reports the changes from the outside.

[Sen. Wendy Harrison (Chair)]: Should have option 3. Okay, I'll be ready to do. Okay, thank you.