Vermont Legislature SmartTranscripts:

[Senator Wendy Harrison (Chair)]: Believe it's the twenty ninth. Does that make sense? May 29, We '20 '20 are here in Senate institutions and we're here to hear from Senator Ron Pinsdale regarding a amendment that she has that is evidently also supported by other folks. So, we'll hear from the other folks as well. So, Senator. Oh, okay. Like to join us. Thank you.

[Senator Kesha Ram Hinsdale]: So, I guess I would just start by saying this is a conversation that many committees have been having. We have a lot of data privacy bills, and one of the things that concerns me is how important clarity and consistency is across states, and that that principle should hopefully absolutely carry to the work we do within bills that are passing at the same time. So this morning, Senate Economic Development passed s two eleven. Is it an s bill?

[Senator Robert Plunkett (Vice Chair)]: H

[Senator Kesha Ram Hinsdale]: two eleven, data brokers. Many people who fall under Not data brokers. Yes, data brokers.

[Senator Wendy Harrison (Chair)]: Okay, because it was the other one too. EdTech. Okay. It would they could

[Senator Kesha Ram Hinsdale]: be added EdTech to that bill. So we have genetic data in our magazine. We have and even today, I love my chair. She was talking about eye scans and saying, genetic data. Three of us looked at each other and said that's biometric data. Like, I there's a lot of ways I wish I didn't know this much about at this point, but it's so important that we're precise in our language because people all over the country have to look at our laws that make sense of that. So we passed a definition of publicly available information that our committee agreed on. And as I understand it, it is a reciprocal definition that exists elsewhere in the country. Vermont Country Store emailed us about this as well. They have long been part of a national consortium of businesses who look at online data privacy. And just like in tax policy, consistency is paramount. Anytime there's a conflict, you're kind of jeopardizing I would say you're jeopardizing the integrity of your policy that you're putting forward. If they have to look in both places, which as Rick explained to us this morning, that many people who fall under both bills would have to look in both places, they will see conflicting definitions, and they will not know which one leads. Now, Rick, I might also point out to you, because we made this decision intentionally, that the third place that a stronger definition of publicly available information appears is in the kids code. And on my part at least, it was a conscious decision to leave a stronger definition in the kids code, because we have all unanimously agreed over many biennia that we are trying to prohibit the transfer of data of children, you know, that there is no way they could have consented to to the transfer of their information, especially sensitive information. And so we did not seek to harmonize the definition in the kids code, but we are seeking to to harmonize the definitions of data, publicly available data in both of those bills because currently they can claim it. Okay. That's and I actually don't have a copy of amendment. Maybe you guys do. Which

[Senator Wendy Harrison (Chair)]: you did. Crab does. The

[Senator Kesha Ram Hinsdale]: the second instance of amendment is hard to understand just by looking at the plain language, but I guess I I this is a bigger topic for me in that having been through a lot of experiences on the data privacy bills, there are groups that that I I I don't say it in a demigrating way at all. They are there professionally and they are well paid to get exemptions, to look for ways to improve the bill for their clients. It is my sense, and I think we're seeing that in the reclarification from the nonprofit community of how they felt they experienced their interactions in house commerce, that they everyone's saying, well, if the nonprofits are the odd people out, they're on their own. A lot of other groups got their you know, had negotiating power like the chamber or got their exemptions and basically said, I'm not gonna be the one to keep fighting on this. Now common good has been around for several years, and they really grew out of the out of the pandemic because we we didn't have a collective voice for nonprofits in the state house. That does not mean that number one, you know, they have presence in the building every day, nor are they in a position in a very short period of time that we've all had this fill to try and do the herculean work of getting all perspectives from nonprofits. So, hi, I was just getting to the nonprofit group. So what I think is very concerning for the senate as a chamber, as a precedent, is that we would get a bill that we have in our possession for roughly two days and not hear from one of the groups that's most impacted that is now characterizing their ability to be heard and have their needs met as having a big gap. I'm not gonna go into my constituents and say, I'm not sure how sensitive data applies to you. I'm not sure what it means to collect demographic information because we've asked a lot of our nonprofits to collect demographic information. I'm not sure how much this will cost you. I'm not sure if you're impacted if you have Vermont consumers or if you are a nonprofit in Vermont. I'm not sure. And I haven't heard from any nonprofits who feel like they have a good handle on what they're being asked to do in the next eighteen months and at what expense. Good. So the second legislative amendment exempts all nonprofits. I think even they are willing to compromise somewhere on the amount of runway that they have, but I can't in good conscience ask nonprofits with everything they are facing right now. And I know there might be some that we think are are big and sophisticated and maybe we don't like their their work, but we have 6,300 nonprofits in the state of Vermont. We also don't know I don't I'm not sure if this captures nonprofits in other states. I think it does.

[Senator Wendy Harrison (Chair)]: That's an interesting number. Sixty three? Sixty three hundred.

[Senator Kesha Ram Hinsdale]: Okay. Cert common goods certainly didn't get a chance to talk to Do more than a

[Senator Wendy Harrison (Chair)]: you know how many businesses we have?

[Senator Kesha Ram Hinsdale]: Totally. I feel like I knew that number at one time because there was different types of instances.

[Senator Wendy Harrison (Chair)]: Oh, yeah.

[Senator Kesha Ram Hinsdale]: I don't know. But like Like, spells proprietors or Okay.

[Senator Wendy Harrison (Chair)]: Somebody Because I I suspected the nonprofits that that would overlap with me. So it's like, that's alright.

[Senator Kesha Ram Hinsdale]: Just You know, I mean, they would they would all be defined differently. Right. Like, with what they do And my guess is, like, 30,000,

[Senator Wendy Harrison (Chair)]: but I gotta just make that up.

[Senator Kesha Ram Hinsdale]: We have a lot of small businesses. Right. And then not very many large businesses. Right. So having the chamber at the table meant that they could get into all of the details about who does this impact on the business community, who should have specialist inclusion, what thresholds matter to 3,000 threshold for sensitive data, you aren't gonna get a lot of for profit businesses that should be collecting demographic information or sensitive information. Most nonprofits are collecting sensitive information so they can help people.

[Senator Wendy Harrison (Chair)]: And how do you come to that conclusion? I mean,

[Senator Kesha Ram Hinsdale]: I would say for the last fourteen years that I've been here, we've been asking them how many people of different genders and backgrounds and races and cultures are you serving? What kind of work are you doing with them? How many of this community participated in your program? There was a big culture also peaking in the pandemic of seeking out demographic information. Oh, totally. And frankly, I also speak as somebody who worked in the nonprofit with the largest number of files on record. The steps to end domestic violence, it used be called Women Helping Battered Women, and I was the legal director. It is the it is one of the longest running nonprofits in the state, and it sadly has thousands of files. I just I don't know how I can't get into them and tell them how this impacted.

[Senator Wendy Harrison (Chair)]: There are. But you know what?

[Senator Kesha Ram Hinsdale]: I don't know if it's like, we have two hours or something to discuss it. Okay. Alright?

[Senator Robert Plunkett (Vice Chair)]: I guess my question would be that the the runway that is set up Mhmm. Gives us an opportunity to to fix something that we didn't fix. Now Could you have eighteen months that we can fix this? If there is an outcry. So

[Senator Kesha Ram Hinsdale]: I don't think that's long enough. I will just say, if eighteen months Well, eighteen

[Senator Robert Plunkett (Vice Chair)]: months, eighteen I'm months to sorry. I didn't mean interrupt because I I I well, it was a little disingenuous when I said that eighteen months and and then an additional eighteen months to cure, so it's three years.

[Senator Kesha Ram Hinsdale]: Okay, but it's eighteen months to comply. Right. So we don't know how much money we're asking them to spend. Don't know exactly how our definitions align with their mission and their work, and eighteen months is one legislative session in the first year of the biennium to we we also can't control what the next legislature does. So I have got I have just had a bigger concern as we lose more and more people who have been institutions in this building of the kinds of contingencies or promises we make for a future legislature. The the nonprofit community has no reason to trust that, and they have looked at us lately and have no reason to trust it anyway. But they also there's nothing that binds them to do that. So unless we made a contingent and said it it exempts nonprofits until we provide the technical assistance to help them supply, I could support that, or I could support giving them an extra two years. But saying you have eighteen months, one

[Senator Robert Plunkett (Vice Chair)]: An extra two years is meaning Well, five

[Senator Kesha Ram Hinsdale]: to comply, they have eighteen months. An eighteen month cure period is not at all the same thing. An eighteen month No,

[Senator Robert Plunkett (Vice Chair)]: that's fair.

[Senator Kesha Ram Hinsdale]: Senator Ingalls just saw the message and said he can't be

[Senator Wendy Harrison (Chair)]: here. Okay. You.

[Senator Kesha Ram Hinsdale]: To comply means how much money are they spending? What does this mean? Where do they get legal counsel? Where do they get technical assistance? It's not just sort of floating around.

[Senator Wendy Harrison (Chair)]: Okay. I understand. Let's make sure we get here from Tina.

[Tina Zook (American Heart Association – Vermont)]: Are you ready? Sorry, I don't want to interrupt. I apologize for the informality. I have a sinus infection, so I'm not all dolled up. But thank you for giving me some time to speak today. We totally support the legislature's desires and goals around data privacy, and we follow industry standards.

[Senator Wendy Harrison (Chair)]: Excuse me one second. You could please identify yourself for the record.

[Senator Kesha Ram Hinsdale]: I just

[Senator Wendy Harrison (Chair)]: want to thank you for being able to come here on such short notice.

[Tina Zook (American Heart Association – Vermont)]: Oh, of course. Yeah. Tina Zook. I'm the government relations director for the American Heart Association in Vermont. I'm in Colchester. We support the work of the legislature on this issue. We see this as something that's needed. But I think where we're coming from is exactly what senator Ram Hinsdale said, that we would like overall a nonprofit exemption. Barring that, we do have language for maybe an alternative. I think maybe you didn't hear or the other committees didn't hear a lot from nonprofits because I think the message was kind of clear that there wasn't going to be an entity level exemption. There wasn't going to be a nonprofit exemption given, and so they were exempting specific data. And so in talking to Common Good, I think they were working given that in hopes that they could get some maybe resources for education and compliance. The American Heart Association's position is we would like an exemption because every dollar that we spend on compliance for data privacy takes away from our mission. And we're really concerned about donor dollars, and we want to make sure that they go where people said they wanted them to go research and education and guidelines that will help fight heart disease and stroke. And this is a highly technical bill that's going to take a little bit to understand and resources and lawyers for nonprofits. And not all may have those resources. I don't know that we meet the threshold because we aren't the Vermont Heart Association. We're the National Heart Association with people in every state. So we would love an exemption overall for nonprofits. If we can't, I think I did send an email, I think, to all senators with this. If we can't get an overall exemption, but I think a lot of the smaller nonprofits really would like that as well, We would ask that under the exemptions that they include personal data collected, processed, maintained, secured, or disclosed by a nonprofit organization in a program that's validated by a third party national charity accountability organization to confirm that it meets or exceeds accountability organization's privacy standards. I apologize. That's a whole bunch. But I did send that. You will have that language in an email. But I think the nonprofit exemption makes sense. I do like the idea that Senator Ram Hinsale mentioned earlier. So I apologize. It went right out of my head. But like a waiting period for us to give them some time before it's required.

[Senator Wendy Harrison (Chair)]: Okay, thank you. Can I ask you a question? In the national organization, do you deal with California or Maryland? Do you have any Windham? I

[Tina Zook (American Heart Association – Vermont)]: can't speak to the specifics of that. We do have lawyers on staff in our national office and we do comply with other states.

[Senator Wendy Harrison (Chair)]: It's the law.

[Tina Zook (American Heart Association – Vermont)]: Comply. We're going But I don't want to say the less we have to, but the more burdensome that this becomes for nonprofits, we spend a lot of time chasing what we have to do versus spending the money on on really our mission, what we're, you know, trying to save lives. And every dollar we can steer towards that. We do really well at not spending money on administrative costs and having it go to our mission, and we'd like to keep doing that.

[Senator Wendy Harrison (Chair)]: Right. Yeah, you have a good reputation. Yeah. No, I mean,

[Senator Kesha Ram Hinsdale]: you personally, I'm not talking to you personally. But

[Senator Wendy Harrison (Chair)]: you also. So, yeah, we do care about making sure that folks have the resources that they need to comply. There is language in the bill on that. There's not separate funding at this point. That's the challenge. What is the It's early in the bill. Yes. That's my understanding. Okay, does anybody else have any questions? How many, do you know how many folks you process the data of in Vermont?

[Tina Zook (American Heart Association – Vermont)]: I do not, I do not because that, I don't know that.

[Senator Kesha Ram Hinsdale]: Okay. Alright.

[Senator Wendy Harrison (Chair)]: Well, as we go through this process, which will be a multi year process, please stay in touch and if you have suggestions, you know, more suggestions, that would be wonderful.

[Tina Zook (American Heart Association – Vermont)]: Thank you. Thank you for the time.

[Senator Wendy Harrison (Chair)]: Thank you.

[Senator Tom Chittenden]: I can say one thing. Sure. Senator Tong Chit, and I just want to say my impression from the discussions that we've had down the hall is that the vast majority of states with comprehensive privacy laws, including California as well as Connecticut and New Hampshire, do exempt nonprofits. And so it seems that Maryland might be the exception that doesn't Oh, I see. Exempt them. But for me, I I would just echo what I just heard there, and, that's why this is worth considering if not giving a longer time period for just nonprofits. We're not talking about everybody. We're just talking about nonprofits or at least be more consistent with our neighbors. It seems to be well worth considering to apply this this group that wants to be heard.

[Senator Wendy Harrison (Chair)]: Okay. It is worth considering. Thank you. Anything else?

[Senator Robert Plunkett (Vice Chair)]: Well, we only have one other person. The

[Senator Kesha Ram Hinsdale]: other person Tina was Snyder about treatment.

[Senator Wendy Harrison (Chair)]: Okay. I understand that there was another person who patient recommended, but she is not, she's not connected to the Internet.

[Senator Kesha Ram Hinsdale]: They needed to clear their mornings, and then they tried to make time in the afternoon. That was Emma Paradise from Comic Bed, Vermont, and Jesse Bridges from United Way. Full disclosure, United Way is holding a lot of riskier funds for entities that can't hold them themselves, especially risky in this political environment. They we have just hit the maybe I shouldn't say it in public, but we are scraping the 1,000,000 mark on the Vermont Immigration Legal Defense Fund. And, you know, anyone right now that has to comply with this, dollars 40,000, which was the figure we heard from California for an entity several years ago, dollars 4,000 is a lot.

[Senator Wendy Harrison (Chair)]: Sure. Sure. Yeah, it's also critical that data, especially data like that, be, careful again. So, okay, I am good. Anybody else? Alright,