In the Trenches with State Policymakers Working to Pass Data Privacy Laws

Last Friday, the House Committee on Commerce and Economic Development for the State of Vermont held a hearing to gather testimony on data privacy developments in other states. In March 2024, the Vermont House unanimously passed a consumer privacy bill that is now going through the state senate. House members sought feedback from other lawmakers based on their experiences moving consumer privacy bills through their respective legislatures.

The hearing featured five witnesses:

• Margaret O'Neil, State Representative, Maine
• Sara Love, State Delegate, Maryland
• Collin Walke, Former State Representative, Oklahoma
• Whitney Westerfield, State Senator, Kentucky
• Daniel Zolnikov, State Senator, Montana

Witnesses, including lawmakers from Maine and Oklahoma, discussed how legislation they put forward in their states was blocked by what they regard as overwhelming opposition from the tech industry and other business interests. In the case of Kentucky, the industry hijacked the one State Senator’s privacy bill effort to pass its own ‘spec’ bill, according to Sen. Westerfield. Meanwhile, lawmakers in Maryland and Montana offered a more hopeful story of overcoming industry lobbying to pass strong privacy protections in a blue and red state, respectively.

Below are four key takeaways from the discussion, followed by a transcript. The lessons these lawmakers provide are relevant to other state legislators engaged in drafting and passing privacy bills, and to members of Congress who may face intense corporate lobbying as they renew efforts to pass a nationwide privacy law through the American Privacy Rights Act of 2024 (APRA).

Privacy is a bipartisan issue

Much of the policy debate in Washington is filtered through an intense partisan lens. But listening to the discussion, one would be hard-pressed to distinguish who is a Republican and who is a Democrat if the lawmakers had not disclosed their affiliations. The panel of speakers included three Democrats and two Republicans, and all shared a common concern with the egregious amount of data being collected, how it was being used, and how little control their constituents had over the process.

Indeed, even on specific aspects of privacy policy, the typical fault partisan lines were less defined. The most ardent supporter of the importance of including a private right of action (PRA) in state and federal privacy laws was Sen. Westerfield, a Republican from Kentucky. Sen. Westerfield noted, "Our constitution, our federal constitution, Kentucky state constitution provides courts to give us a place to find redress of grievances… And so I think just at a fundamental level for us to limit the ability to use the courts for what our constitutions made our courts for, runs counter to what we ought to be standing for. And again, that's not a partisan position, that's what our constitution says our courts are for.” His position contrasts with many of his Republican counterparts in the US Senate who have so far opposed including a PRA as part of federal privacy legislation.

More importantly, when these lawmakers could get their bills to the floor for a vote in their respective chambers, they often passed unanimously or near unanimously. In Montana, where Republican State Senator Daniel Zolnikov introduced the Montana Consumer Data Privacy Act, it passed both chambers of the legislature unanimously. Former Democratic State Representative from Oklahoma, Collin Walke, repeatedly got “super majorities” on a privacy bill he introduced in the Republican-majority state House, only to see it die in the Senate due to what industry lobbying efforts he observed. Sen. Westerfield also said he had support for his bill in Kentucky by a count of 30 to 2 in the state senate, only to see it held up by a few powerful members when the state’s Chamber of Commerce came out in opposition to the bill.

Industry has a playbook for stopping privacy legislation

Despite this bipartisan support for privacy laws, industry often wins the legislative battle thanks to overwhelming resources and common tactics designed to slow down the process, exaggerate concerns, and water down meaningful protections. When two competing privacy bills were introduced in the Maine House of Representatives, Rep. Maggie O’Neil described seeing “more lobbyists hired in the building than I have ever seen on bills before. And that's eight years of experience working on different measures.” Former state representative from Oklahoma, Collin Walke, said that one tech company with an office in his state “hired about 30 more lobbyists just to lobby” on the privacy bill he was trying to pass.

Many of these lobbyists represent trade groups and organizations that have different names but often have the same companies as members, including big tech companies such as Google and Amazon, but also AT&T and other telecom companies. One major group repeatedly referenced during the discussion was the State Privacy and Security Coalition (SPSC). Its members represent some of the biggest names in tech, telecommunications, and banking, all of whom have a stake in monetizing the public’s data and information.

Del. Sara Love from Maryland said that despite representing themselves as different groups and requesting separate amendments to her privacy bill, they all seemed to be working together:

“And what was interesting is this group would ask for these ten amendments. This group would ask for these 15 amendments. This group would ask for these three amendments. And it was death by a thousand cuts because they all had the same members. So it was clear they were all talking. But they thought, well, if she'll take this from this group and this from this group and this from this group, in the end we'll get what we want.”

This deluge of requests for amendments was constant throughout the process, she said. Even before the bill was introduced, Delegate Love circulated it for feedback with stakeholders and received “97 requested amendments,” ultimately taking 32 of them in an effort to work with industry. Still, they opposed the legislation until the very end. Yet, once the legislature passed the bill, a lobbyist commented to Del. Love in response to the law, “this is going to be fine.”

In addition to industry trade associations and groups, the Chamber of Commerce's state chapters were also actively lobbying against the bills. Often, they bring up concerns about the supposed impact of these proposed laws on small businesses in the state. Their influence and familiarity with legislative leaders mean they can stop a bill in its tracks and prevent it from advancing for a vote, even if it has the support to pass. Rep. O’Neil described how industry “organized local businesses and local chambers almost to scare them into thinking that they wouldn't be able to access the tools that they usually access with targeted advertising.”

The opposition comes even though many state bills set business thresholds that would exclude most small businesses from the law. Del. Love described her experience with such arguments in her state, saying, “you could see certain legislators have that talking point near the end. And we would say to them, okay, what small business do you know in your district who is processing the data of more than 35,000 customers and we're not talking about payment? And they're like, well, it's going to hurt small businesses. So it isn't, just isn't.”

Another tactic by the industry is to bring forward important state employers to oppose the bills. In Maine, L.L. Bean, an important company economically in the state, lobbied in opposition to Rep. O’Neil’s bill despite efforts by the lawmakers to address some of their concerns regarding data minimization in the bill's language. (L.L. Bean issued a letter disputing Rep. O'Neil's characterization of its actions.) Rep. Monique Priestley of Vermont noted that she was seeing a similar campaign play out in the state with L.L. Bean as well as the American Catalog Mailers Association, which, according to Rep. Priestley, indicates on their website that “it's a data privacy war chest to fight state privacy policies.”

Finally, if industry can’t kill the bill, its goal is to weaken or co-op it, according to the witnesses. Kentucky Sen. Westerfield started working on a privacy bill four years ago. It had the support of the majority of the state senate, but it was blocked by the committee chair, thanks to opposition from the state Chamber of Commerce. According to Sen. Westerfield, industry then found “a willing sponsor in the House who isn't a student of the subject matter” to file their “spec bill, which is Virginia more or less.” Sen. Westerfield added, “And of course it sailed and my efforts last year and this year to try to convince House leadership to not pass that bill just on spec without at least encouraging or being willing to consider some amendments was unsuccessful.”

State privacy efforts need coordination and public campaigns

Given that industry appears to be coordinating its efforts to influence state’s privacy legislation, many lawmakers on the call wished they had organized such a hearing while going through their legislative process. Rep. Priestley offered, “I feel like a big part of this was just getting more states talking to each other. Because the playbook, it seems like there are enough coincidences, state to state, from talking to people, that I don't know how we fight this unless we're doing it together.” Rep. Priestley later added, “And in some cases you just get so many of requests, you're like, maybe I am wrong about this. But then you read the articles about all the different states and the reps and they're like, no, that was not crazy. It was really just a tactic.”

Indeed, industry appears to benefit from the lack of communication among state legislators. As Sen. Daniel Zolnikov from Montana explained in talking with an industry group as part of crafting Montana’s privacy bill that he had modeled on Connecticut's bill:

“So as our session continued, I was able to watch a Maryland hearing on their privacy bill, where the same organizations that was watering down my bill said, can you change your bill to the Connecticut bill? We would be supportive of that bill. So that bill in Montana isn't good, but that bill in Maryland is good. Then I am like, do my people, do Montanans not deserve those same protections, but it's perfectly fine on the east coast. That's a little bit insulting to A Montanans, and B, my intelligence. Right?”

Though Sen. Zolnikov, later joked that industry “think[s] we're all decentralized. Luckily we have their technology we get to use to our benefit, right?”, state legislators from different states have a few opportunities to connect. Being a state legislator is often a part-time job, and the opportunities that exist for gathering are frequently shaped by industry support. For example, a privacy panel during last year’s National Conference of State Legislatures was tilted heavily in favor of industry, including an industry lobbyist and speakers representing more industry-friendly privacy laws in Connecticut and Texas.

In addition to lobbying, industry can also run ad campaigns urging a state’s constituents to oppose privacy legislation. When industry could not stop Del. Love’s privacy bill in Maryland, it turned to ads. Del. Love noted that “they ran an ad during the Orioles opening game. They ran an ad against us on CNN. They ran an ad against us on MLB TV. I mean, they went out hard on our bill.”

Lawmakers cannot respond to these campaigns nor engage the public with the same resources and tactics, even though people in both blue and red states overwhelmingly support privacy laws. As former Rep. Collin Walke argued, “there's not a single person who you talk to in their district who goes, oh yeah, let's go ahead and just keep letting them do whatever the hell they want with our data. That doesn't exist. No constituent doesn't like this [privacy] bill.” Rep. Walke further pitched the idea for a “public service campaign” targeting legislators that hold up privacy legislation on behalf of industry. “And so what we have to do is get outside of the rotunda and get out there to make the legislators feel like, well, crap, I really got to do this…” he offered.

States will set the bar for national privacy legislation

There may be a fait accompli feeling about state privacy efforts, given that a national federal privacy law hinges on preempting all or significant parts of state authority on the issue. But even if that comes to pass, states are setting the bar for national privacy legislation. As Sen. Zolnikov noted regarding his efforts in Montana, we needed “to raise the bar from the Republican side, especially when the US Senate and House on the Republican side are going to say, well, look at what Kentucky did and Utah did. That should be our national standard. Now I want them to say, well, look at what Montana did.” Now Vermont has an opportunity to add to the standard with its own legislation.

Transcript of the Hearing

What follows is a lightly edited transcript of part of the hearing. Please refer to the hearing video when quoting the speakers.

Rep. Michael Marcotte (VT)

House Committee on Commerce and Economic Development. It is Friday, April 26th, 2024, at 1:04 in the afternoon. So, we're here to continue our discussions on data privacy. We are fortunate enough to have a number of legislators from around the country joining us this afternoon to just have a discussion with them on the issues that they faced in trying to put forth a data privacy legislation in their state. So, first with us is Representative Margaret O'Neill from Maine. Representative O'Neill, welcome. Thank you for joining us this afternoon. We certainly appreciate your time and know you had a difficult experience in Maine.

Rep. Margaret O'Neil (ME)

Good afternoon, everybody. Thanks for having me.

Rep. Michael Marcotte (VT)

Good afternoon. Thank you for joining us. We appreciate you willing to come in and chat with us about your experience trying to pass data privacy legislation in Maine. And sorry to hear that it didn't quite make it across the finish line.

Rep. Margaret O'Neil (ME)

We were sad about that too. But we still have hope for Vermont. We're excited about Maryland. So thanks for all your work.

Rep. Michael Marcotte (VT)

Thank you. So I think if you could just let us fill us in a little bit about the difficulties that you had. I think we've all experienced some of the national groups coming in and working against either sinking the bill or significantly watering the language down so it's not relevant to anything. I don't know, is that something you experienced in Maine as well?

Rep. Margaret O'Neil (ME)

Definitely, yeah, we have a long process with it. So first, I'll tell you a little bit about myself. My name's Margaret O'Neil. I am in Maine. I'm in southern Maine, about 20 minutes away from Portland. Maine is a similar legislature to Vermont's legislature, and that it's a citizen legislature. So, for people like me, it's not my day job. My day job is being an employment law attorney. I've been in the legislature for eight years and met people from Vermont along the way. I served as chair of the committee that handled agricultural and forestry issues and got to meet some people from Vermont over the years and really was glad to meet people like Carolyn Partridge.

So, over the years, I worked on a number of privacy bills, followed what Vermont had done with data brokers, and tried to replicate something like that here. And actually the Vermont AG, I think his name is Ryan Kriger, was really helpful in coming to me and sharing information. So I put in bills about data brokers, about health data biometrics and eventually a bill like the one that you all are considering here, where the main provisions have to do with data minimization and protect data across the board. And there's some similarities, like Vermont, Maine has been willing to lead in a couple different areas and hasn't been afraid to do that. And we've seen that the sky hasn't fallen. That was true with, we had an internet service provider law that we passed and some things about facial recognition and warrants. So, about how it played out in Maine. The two bills that we had over the past two years were one that was submitted by industry. It was written primarily by the Facebook lobbyist and other industry players. And then there was a second bill that was based on Congress's Compromise Bill, and that was supported by consumer advocates and that was the bill that I sponsored.

I put in that bill in partnership with. I had reached out to someone that I think you've met, Caitriona Fitzgerald, who is with EPIC, because I had met her over the years working on different bills and was looking for some guidance on what would be good protections for Mainers. So, we had in our original bill data minimization just to make consistent rules that would match expectations of consumers rather than allowing privacy violations to continue and to put work on the consumer to stop them from happening. We just want to make some clear rules of the road. And like Vermont, we had a strong private right of action just because meaningful enforcement is really important. And that was something that I had taken time to research during law school. I focused on data privacy, and there are some different laws across the states. One has to do with biometrics, and something that we saw was that you had three states that passed a law, one had a private right of action, two did not, and the only state with meaningful enforcement was the one with a private right of action.

So that was important to me to make sure there was meaningful enforcement. So just kind of what happened over the past two years. So, I submitted the bill. We run on a two-year cycle in Maine. And so I submitted that bill. Somebody else submitted one on behalf of industry lobbyists. The Facebook, the tech kind of lobbyists weren't front and center. They did more behind-the-scenes work, not so public-facing, but they did approach me toward the beginning to see if I would be on board with supporting an industry bill that would have the basic consumer rights that were in the bill, but that really wouldn't have any meaningful data minimization or enforcement as they wanted to do, attorney general enforcement.

And in Maine, I'm not sure what your history has been in Vermont, but I'm just aware of different states having industry-led proposals that essentially reinforce existing practices so that those companies won't really have to change much or give rights to consumers. And that was something that we really wanted to avoid in Maine and make sure that we put meaningful protections in place. So over the past two years, we really had a methodical process of working both the industry bill and my bill side by side. We had a number of public meetings, upwards of 15 full-day meetings where we had there were available to the public. We requested input from internship parties and businesses and, the AG's office, and anyone else who might have relevant information to provide.

And I did see more lobbyists hired in the building than I have ever seen on bills before. And that's eight years of experience working on different measures. So, even though I knew that these companies were powerful and had a lot of influence, it still made an impression on me to see just how many folks got hired and were working the bill. And I think I'm guessing that what we saw in Maine was similar to what you have seen in Vermont. Their priority was to pass the bill that they had written and if that wasn't possible, their second priority was to minimize the most important parts of my bill, which were the data minimization and the enforcement. And also, we saw folks try to make it so the law didn't apply to them through exemptions.

And very rarely did we hear directly from a Facebook or a Google or an Amazon. There were organizations that lobbied on their behalf. I think their names were TechNet or State Privacy and Security Coalition. You could tell by a joke that we made when we were sitting in the committee room was you could just see the shoes and see who was from DC and who was from 'ME.' But I think Maine's like Vermont in terms of fashion. But people are pretty practical here. So something that we saw that was really hard to combat was that these companies organized local businesses and well-known Maine companies to speak on their behalf. In Maine, L.L. Bean is a well-known big company and they became a big spokesperson for the interests of the bigger lobbying groups. And they also organized local businesses and local chambers almost to scare them into thinking that they wouldn't be able to access the tools that they usually access with targeted advertising.

And I did find that when I sat down with a local chamber with the bill and showed them outward function and the exemptions and what data minimization actually meant, that it really brought the temperature down, and people could see that they could still place an ad on Facebook and promote their product or their service. But the degree of organizing was difficult to combat and the partnership with trusted names. Because in Maine, if L.L. Bean says something, people are going to respect that. And L.L. Bean did attend every single meeting that we had and also came for the votes and was lobbying on behalf of those industry interests. And something that was indicative of the partnership to me was that all of the concerns that were raised by L.L. Bean in the small businesses had already been addressed in our language in the outset because we made sure that folks would be able to access advertising and connect with customers and, have financial transactions and do analytics of their website, just basic stuff.

But, the activity and lobbying still continued. So we saw a lot of misinformation that was difficult. And I think that's about it. I mean, if you have specific questions, I'd love to answer them, but we have been following what Vermont has been doing from a distance and what Maryland has done too. And we hope to see you succeed so that we can point to you and say when we do it next year, that we can do it too. I know our experience in lots of different areas of law has been looking at places that states like Vermont has led, and we've said, Vermont's done it. We can do it too.

Rep. Michael Marcotte (VT)

Thank you.

Rep. Monique Priestley (VT)

Rep. O'Neil, thank you so much. I know you've been very busy, so thank you for coming on today. It's really helpful. I was curious at one point; it's really awesome to hear that you focused on data privacy and things like that. And so you mentioned that the only states that have the PRA are the only meaningful data privacy legislation. And I'm just curious if you could speak a little bit more to your thoughts there. As you know, we're still trying on that front, too.

Rep. Margaret O'Neil (ME)

Sure. This law had to do with biometrics, like using face recognition. And what we saw in that case was there was one state, the state of Illinois had a private right of action, and that private right of action, I want to note is much broader than the one in your bill. But that led to a number of suits that shifted behavior of big companies like Facebook and Clearview AI that had abusive practices. And there were two other states that enacted similar laws. It was Texas and Washington. And in those states, we saw either zero or no suits at all. And if there was a lawsuit, it was an exact copycat of suits that had been filed in Illinois. So, had that law not existed, consumers wouldn't have had their rights vindicated, and these companies wouldn't have changed their practices. That was what we saw for how it was very important to have that private right of action.

Rep. Michael Marcotte (VT)

So, in Texas and Washington, you said?

Rep. Margaret O'Neil (ME)

Yeah, that's my memory, Texas and Washington.

Rep. Michael Marcotte (VT)

So, in our bill, we have a cure period that gives I think up to 150 days for the business to fix the problem if there is one. So then nothing happens. And did the other, I know Illinois doesn't have a cure period, but did the other states have cure periods?

Rep. Margaret O'Neil (ME)

I'm not sure how the attorney general suits are structured, but really the point of sharing that was just to show that the attorney general has limited capacity to bring lawsuits, especially against the biggest companies. And there are so many different players here being regulated, all kinds of different data brokers or people that handle data. So it just shows how hard it was for those laws to actually mean something on the books. It's like having a speed limit in a rural area and just have no one to stop people if they're going too fast. So that was what I hoped to share with that.

Rep. Monique Priestley (VT)

I was just curious. So the initial reason that actually seeing an article with your story of what happened in Politico is actually what spurred this entire thing. So, thank you for going on the record there. And I'm just curious about a tie that I noticed that I just would love to know if there's anything that you saw behind this. So we ended up having a Vermont business that the CEO worked for L.L. Bean for 27 years and is the board chair of the American Catalog Mailers Association, which has on their website says it's a data privacy war chest to fight state privacy policies. And I was just curious maybe directly or indirectly, if the American Catalog Mailer Association or ACMA ever came to light. They also on their website reference a number of lawsuits that they partner on with NetChoice, fighting consumer protection in laws in different states. So, I was just curious if that came up at all.

Rep. Margaret O'Neil (ME)

That's interesting. I wasn't aware of that connection. I think something I wondered all through the process was I just didn't understand why L.L. Bean was so invested because the small amount of consumers it would protect in Maine were not people that they needed to market to in the first place just because we are the biggest and best customers. We live here and know that company. My mom worked for L.L. Bean growing up; a lot of people do. So I think just seeing that the provisions of the law protected the main activities they wanted, which were to send out their catalogs and to send emails to people and to do targeted ads on Facebook. It just felt like there was some kind of partnership that I couldn't quite put my finger on and that they were speaking on behalf of a wider group of industry folks in doing so.

Rep. Monique Priestley (VT)

Thank you.

Rep. Michael Marcotte (VT)

Any other questions for representative O'Neil?

Rep. Stephanie Jerome (VT)

Just a comment. What you are saying, we are seeing the exact same thing. This huge amount of investment in lobbying companies at the outfront, the face of so many of these things being these businesses that are well-known, well-respected Vermont catalog businesses. And like you said, they're well-respected companies in Vermont, and we are all loyal to them and respect them. And so it's interesting to see the same pattern and the same questions being asked in exactly the same way by multiple organizations. There is clearly a larger, some sort of infrastructure that's working together. Although they don't say it, but it certainly seems that way. Thank you. It's validating.

Rep. Margaret O'Neil (ME)

Absolutely. I'm glad to be here. And yeah, it's good to hear your experience as well, and I hope that you succeed.

Rep. Stephanie Jerome (VT)

We do, too.

Rep. Monique Priestley (VT)

Thank you. And please stay in touch. I definitely love to stay in touch on all of this. I feel like a big part of this was just getting more states talking to each other. Because the playbook, it seems like there are enough coincidences, state to state, from talking to people, that I don't know how we fight this unless we're doing it together. So I just really appreciate again your time. So thank you.

Rep. Margaret O'Neil (ME)

Absolutely. Glad to be here. Take care.

Rep. Michael Marcotte (VT)

Thank you very much. Delegate Love, good afternoon. Thank you for joining us. We appreciate your time and congratulations.

Delegate Sara Love (MD)

Thank you. Thank you. And it's my pleasure. Thank you so much for having me here. And I just want to thank Rep. Priestley so much because as I was going through my process over the last couple of months, I kept thinking, you know what? All of these tech folks are talking; I want to reach out and support the other legislators who were going through this. And I just never did. So I am so appreciative of Rep. Priestly and of you all taking your time to have this hearing. It is incredibly important because as we go through this, we feel like we're alone, but we're not. We're all going through very, very similar situations when trying to pass good privacy bills. So thank you all so much for doing this, for having me here. I really, really appreciate it.

Rep. Michael Marcotte (VT)

Thank you.

Delegate Sara Love (MD)

So, I'll dive right in. I really enjoyed hearing rep O'Neil's comments because my situation was very similar and similar to what you all have gone through. I've worked on this bill for several years. And at the beginning of this session, the speaker of the house and the Senate president put out a consumer protection package, and this is one of the bills that was in that package. So the tech industry was on notice that this bill was pretty much going to pass. So the question was in what form? And we started off really trying to work with them as much as possible. I circulated the bill prior to dropping it. We got 97 requested amendments and we took, I think it's 32. And then it was so interesting, the same thing as what Rep O'Neill said. At the hearing, only the industry reps came forward. The group reps came forward, the TechNet, the NetChoice, States Privacy and Security Council.

And what I loved is one of our senators had done his homework, and he knew that they all had the same core members. They all had Amazon, Google, Meta, or the Security Industry Association and the computer and communications technology. And all of these groups had Amazon, Google, Meta as their major players. And it wasn't until much later that Amazon and Google actually came forward themselves. They had the groups come and do the work for them. And I will tell you, I have not in my six years, in my second term, seen as hard a lobbying job as these folks did. They put so much money into pushing and lobbying me and the senator and all of the relevant folks. And meeting, after meeting, after meeting. Email, after email, after email. And it was also fascinating to watch those folks who, as someone said to me, didn't have the courage to sit at the table during the hearing, but sent emails afterwards.

And what was interesting is this group would ask for these ten amendments. This group would ask for these 15 amendments. This group would ask for these three amendments. And it was death by a thousand cuts because they all had the same members. So it was clear they were all talking. But they thought, well, if she'll take this from this group and this from this group and this from this group, in the end we'll get what we want. And early on their biggest talking point was interoperability. We have to be able to work among states. And to a degree, that makes sense. But I'm also not going to give up data minimization, which was huge. That was probably the driving piece. I wish I could have done a PRA. I hope you all can do a PRA. Like rep O'Neil, I had a biometrics bill, really wanted a PRA because that's how you change behavior. But unfortunately could not get it through. So, data minimization was big. They wanted to sell sensitive information, that wasn't going to happen. And there were just a couple of points where I said, okay, that I'm not going to go any farther.

But it was interesting, and I think the more they pushed, the more we said, and not just me, but other legislators said, enough. Okay, we're going to pass something that matters. So it's somewhat backfired from them. So, data minimization was important, not selling sensitive data was important. They wanted a HIPAA-level exemption, which absolutely was a full stop for me. I'm not going to allow that. And I'll tell you why. From my perspective, that is so dangerous. So when prior to my brother-in-law passing, he wanted to make an appointment with his doctor, and the doctor said, please do it through our online portal. So he did. The next day, my sister got an ad on Facebook for that doctor's practice because the information that he input on their online portal isn't protected. Even though they're a HIPAA-level entity, the doctor's office, that data isn't protected. So, some of those big exemptions were just non-starters for me. Unfortunately, we had to accept one. But it's a process. So, I'll stop talking now, but happy to answer any questions and just want to thank you again so much for what you're doing.

Rep. Stephanie Jerome (VT)

Thank you so much, delegate. I have a question about the selling of data. We've had very, very little discussion amongst the witnesses about actual sales of data. We know that selling data is an income stream. And do you get any information about that, about how important this income stream is to these companies in your state in Delaware or Maryland? I'm sorry.

Delegate Sara Love (MD)

I don't have any hard numbers. But when I was doing some research, the gathering and selling of data is a $6 billion industry in the United States. I believe this is the stat that I found. And they realized that they didn't actually have an answer as to why they wanted to sell sensitive data. So they tried to push on that, and then just they couldn't back it up.

Rep. Stephanie Jerome (VT)

Yeah, it's really interesting, because the selling of its sensitive data.

Delegate Sara Love (MD)

Yeah.

Rep. Stephanie Jerome (VT)

Awful that it's shocking. But yes, thank you. I was just interested about that because we really haven't heard a whole lot about the selling of. We know that it goes on clearly. We've heard sharing of data. It's in our bill, but we haven't had very few companies talk or organizations specifically talking about the sales of data. And we appreciate additional income streams for businesses. I don't want to begrudge an income stream for a company as long as it's not harming.

Delegate Sara Love (MD)

Exactly. And I think for us, one of the core things that we tried to really focus on is, it's our data. And it is absolutely unacceptable for a company to take it and to sell it without our knowledge. If someone wants to say, okay, I don't care, go ahead, sell my data, that's fine. But without our knowledge and our consent, that's absolutely unacceptable.

Rep. Stephanie Jerome (VT)

Our bill lines up with that as well. Yeah, thank you.

Delegate Sara Love (MD)

Absolutely.

Rep. Monique Priestley (VT)

Yeah, Delegate Love. Thank you so much again. It was amazing to talk on the phone initially, finally when, we connected and just share all of the similarities of what's going on. So what you just shared about the HIPPA, because we did a data level exemption, and as soon as the bill went to the Senate, all of the healthcare entities went down to ask for entity level. So your story actually is very helpful in illustrating a concrete example of why this is something to protect. So I super appreciate that. And then I guess hearing the death by a thousand cuts a piece, I can relate to. Actually, I guess I have a question there.

So definitely there was coordination between lobbyists, giving some would have shared clients or for clients and get questions from different ones. But I was just also curious and maybe where you had the moments where you're like, alright, enough is enough. Because there would be two requests, we'd go through them actually in some cases we're like, okay, yeah, no, that makes sense. That's fine. It aligns with Vermont state law or whatever. And then it would be like, well, we need these six things that are just references to random things that we track down, which is fine. But then it was like, well, I have a list of 40 that are coming at you next, and that kind of stuff. So yeah, I would just love to hear a little bit more of your experience with that. Just like the repetitive nature, the increasing asks, just the illustrative of the pressures that people are feeling state to state.

Delegate Sara Love (MD)

It's exactly what you said. And it built, so there were just a couple of folks at the hearing and then there were more who filed testimony and then there were more who came after that and the asks never ended. You try to work with TechNet. We asked for their top three and they gave us their top three. But then there were more. And then I don't remember if it was TechNet or NetChoice, we asked for their top three and this was great. They gave us their top three or several, but each one had subsections and those had subsections. So it turned out to be like 40. And then more people kept coming out of the woodworks and asking for more amendments. And so Senator Gile and I sat down with committee council and went through our binders for hours and hours and hours. I can't, eight, 10 hours, truly going through all of the requests.

And then they came back. And we'd say, okay, we will take this, but not that. And then next thing we knew they wanted that. It never stopped. And talking about small businesses at the very end when they realized this bill was actually going through and it was going through with data minimization, it was going through the way it was, that's when they pulled out the small business. Oh, this is going to hurt small business. And then they took out ads on something called Center Maryland. And then I know I'm going a little bit of afield of your question. I forgot to mention that they ran an ad during the Orioles opening game. They ran an ad against us on CNN. They ran an ad against us on MLB TV. I mean, they went out hard on our bill. So if you see anything like that, please know you are not alone.

Rep. Monique Priestley (VT)

Yeah, actually now that we're on the small business track, curious how that, more kind of expanding, on how that showed up. Again, in our instance, 3C, Connected Commerce Council I think started working with the chambers of Commerce. There was a webinar on Wednesday in which they held to talk with small businesses about the bill. And I was just curious, did you see that type of grassroots on the grounds going at network nodes of small businesses more or less?

Delegate Sara Love (MD)

They didn't do that for us. Like I said, they only brought out the small business card at the very end. Because I think they're learning that that's something that sways legislators. Because we care about, we all care about our small businesses. But it was fascinating to watch the evolution because that was not an issue early on. And then you could see certain legislators have that talking point near the end. And we would say to them, okay, what small business do you know in your district who is processing the data of more than 35,000 customers and we're not talking about payment? And they're like, well, it's going to hurt small businesses. So it isn't, just isn't. The one thing they did was they went after, I think, I don't have concrete proof of this, but I believe that they reached out to Marriott who is headquartered in my district and gave them a discreet issue to work on with me. And that was very clever.

Rep. Monique Priestley (VT)

And, I think that is loyalty programs?

Delegate Sara Love (MD)

You got it. You got it.

Rep. Monique Priestley (VT)

Cool. I'm curious about kind of the vetting process that you did. I started after having request after request after request in person after person and going to different reps. And so we started funneling people through me and then through a set of questions that I was asking to try to narrow down, what exactly, if somebody's claiming this is going to kill small business, what exactly in this law, like the verbiage, exact verbiage is going to do that? And then what would be the specific changes that you want to see? And I'm just curious about your vetting process for requests that you went through and did you ever, there were several times where, for an instance, there was a lobbyists did go through and highlighted a piece of the proposed statute that they wanted changed. And instead of striking out, it was a mix of, it might even been actually been from Maine and Maryland's pieces that we were trying to push here as well.

And they struck out a whole line claiming that we were doing a bunch of new stuff, but only two or three of the words of the 10 word sentence were new. And then the seven remaining had been in our initial draft and was super critical to actually doing the protective pieces. And the three words were just getting it a little bit further. But I'm just curious about the vetting process you went through and what you found as far as either bad faith and or misdirection type requests you might've gotten?

Delegate Sara Love (MD)

I'm trying to think if there were any sort of bad faith, not specifically like that. But more, state privacy and security council gave us a red line of our bill. It was not, do you have specific amendments? It was we are redlining your bill to be Virginia or Delaware or pick your other state that follows the similar industry model. And our vetting process was very similar to yours. It was does this actually make sense? Is this solving a problem that they have and do the language they propose create any other problems? And so there were some areas where we just said, no, I'm sorry. And there are some areas where, okay, that makes sense. We have a biotech industry in Maryland. So some of the language we took was to address the biotech industry. But all through, we still had our core, data minimization is key, you cannot sell our data is key.

To other definitional, they kept saying, we have to align the definitions with every other state. But I would not change our biometrics definition because that's in statute here in Maryland and it makes a big difference. They want data that is used to identify someone and our statute says can be used to identify someone. And you all as legislators know the very important distinction those two have. And I think the tech industry was hoping to just sort of gloss over that and be like, oh, we have to be the same as every other state. So our process was very similar to yours and throughout it all, we just had to hold on to what is core, what is it that we really want to do, where's our final line that we won't go any further.

Rep. Monique Priestley (VT)

Any other questions? And what was your final line?

Delegate Sara Love (MD)

Our final line was the data minimization, the no sell and biometrics definition. And then another one was they wanted known child and we would not want that.

Rep. Monique Priestley (VT)

Yeah, known child is the knowledge standard of whether or not a company knows who their target and all stuff.

Delegate Sara Love (MD)

And we stayed with new or should have known, and that was it. We would not go beyond that. So a lot of the other definitions that they wanted, that was fine. There were a couple other pieces that they wanted in there. In this state, if you comply elsewhere, you're considered to have complied here. Some of those things we were absolutely fine with.

Rep. Monique Priestley (VT)

I just was wondering, are there any specific areas that you did given that you really wish you hadn't? Or you just felt like to get it over the finish line, that kind of thing. I guess both as things to do later, but also things for us to consider when we're thinking about our line.

Delegate Sara Love (MD)

So, there is one piece in our legislation that I wish were not there and that is the insurance exemption. But the chair of the Senate committee is in the insurance industry. So that was important to her and there was nothing I could do about that. So I would prefer that weren't in there, but unfortunately it is. I don't know if you all have read the Connecticut Attorney General's report six months after enforcing their law. I found that fascinating because the Attorney General mentioned very clearly Gramm-Leach-Bliley is a gaping hole and the more entity level exemptions you include, the harder it is to enforce. So also I wish we didn't have the Gramm-Leach-Bliley entity exemption. We do. So I think those are two things that I wish we didn't have, and I hope that you all can have fewer entity level exemptions.

Rep. Monique Priestley (VT)

Definitely trying. Anybody else? Any other questions?

Rep. Edye Graning (VT)

Hi. Thank you. So looking back, is there advice that you have for any state going forward on how you would recommend that they tackle this if they're looking to put data privacy to protect their citizens?

Delegate Sara Love (MD)

I think honestly, what you all are doing is the exact right thing. You're trying to get the strongest bill that you can. You're listening and learning from other states. And I think knowing that it can be done helps. And it helps, the more of us that get these good strong bills, the more people will follow. So knowing that it can be done, I hope that you will push and still stay strong. Because it's interesting, after the bill passed, I actually had a lobbyist say to me, this is going to be fine. And I'm like, you were fighting tooth and nail against me.

Rep. Monique Priestley (VT)

I just want to say thank you again and I hope that we can continue to work offline and look at future stuff and maybe in across state things and just keep the conversation open. It was for me in particular, I think kind of in response to Edye's question, which is fascinating for me at this point, is that I think so much along the way, I was second guessing things that I was spending a lot of time learning about. And this doesn't feel right. And in some cases you just get so many of requests, you're like, maybe I am wrong about this. But then you read the articles about all the different states and the reps and they're like, no, that was not crazy. It was really just a tactic. I super appreciate you and your work. Thank you.

Delegate Sara Love (MD)

Thank you all. Really appreciate your time today.

Rep. Michael Marcotte (VT)

Thank you very much. We appreciate your time as well.

Delegate Sara Love (MD)

Great. Take care.

Rep. Michael Marcotte (VT)

You too. So former rep, Collin Walke.

Fmr. Rep. Collin Walke (OK)

I'm here.

Rep. Michael Marcotte (VT)

Good afternoon. Thank you for joining.

Fmr. Rep. Collin Walke (OK)

Yeah. Is now an okay time? Yes,

Rep. Michael Marcotte (VT)

It is.

Fmr. Rep. Collin Walke (OK)

All right. Well, good afternoon. How can I help you all beat back the horrible problem of surveillance capitalism?

Rep. Monique Priestley (VT)

Thank you, Colin, for doing this and connecting again. It's been so much fun to just connect with all of you. And I actually, I am curious, a slightly different approach here. One, I would love to hear experiences in general with the bill. But you have a background that is somewhat similar to others, but different in that you have privacy certifications and you're doing that right now. So I was just curious kind of the relationship or realizations and or if you had that at the time that you were working on the bill, the process of going through the bill and then doing work in the field and kind of your feedback as far as where things fall in the real world.

Fmr. Rep. Collin Walke (OK)

No, that's a fantastic question. So I'll tie it in as a, I'll give you the elevator pitch on my legislation, where it went, and then the role of being CIPP certified. So we began digging into this issue in 2019. And at that time, as you all know, only the CCPA existed and our bill was unlike any others because ours was essentially CCPA, but it had been converted to opt-in not opt out. And so fortunately, my co-author on that was the majority leader for the Republicans representative Josh West. And so because both conservatives and liberals appreciate their privacy, we felt a really good job of getting it passed. We did indeed in two, three years, but two years that I was there by overwhelming super majorities out of the house. It kept getting killed in the Senate. As far as the shenanigans from the lobbyists, et cetera, there were essentially two big issues.

The first one was one particular tech company here locally, they're nationwide, but here locally, kind of took the lead on beating this back, lied to the floor leader to buy more time before the bill got heard, and hired about 30 more lobbyists just to lobby on this one bill and against it. So there was a lot of procedural chicanery that went on. And then the other big angle that I just point this out to because it really pissed me off, was an organization, and I forget the name, it was something like the National Center for Nonprofits, some sort of good sounding group, but really what it was was an advocacy group for data brokers who service nonprofits. And so I was getting phone calls from even nonprofit boards that I sit on going, what are you doing Walke? To which I quickly responded, you're exempt because this doesn't apply to nonprofits.

And we can debate whether the propriety of that. But that was our simple way to try and get it going forward. And so ultimately what it came down to, the reason it never passed is because of the state chamber. We had afforded them the opportunity to go ahead and flip it to opt-in. But between the state chamber, Microsoft, AT&T, and everybody that kept coming to us and going, well, how about you do Virginia light or whatever. At that stage we were like, we're not going to weaken it more than opt out. So that's what happened there. And then as far as being CIPP certified, here's what I would say is that at that time when it first started, the first two years, I was just an attorney who became well-versed and well-educated in this realm. And just like, I don't know shit about cows.

When a bill about cows comes up on the floor of the house in Oklahoma, I go and talk to my rural legislative friends. And fortunately I had great relationships with the Republicans. And so they all came to me and go, who do I believe the lobbyists or you? And I went, believe me. And by the end of my last term, I had become CIPP certified, but I had already had their trust. So it didn't so much play a role into it, except the fact that I was an attorney and actually knew what I was talking about. So when lobbyists would come to me and go, hey, even the California AG said that CCPA costs $50 billion, I was able to go, that's not right. Read the actual opinion. And so the legislators had a lot of trust in me because I could actually fight back, but it was less about being privacy certified than it was just being a lawyer. So elevator pitch and let y'all take it from there.

Rep. Stephanie Jerome (VT)

Advice for us.

Fmr. Rep. Collin Walke (OK)

So here's my advice, and it's always kind of one of those things where the good guys never have money. I feel like.

The lobbyists, just like I heard your prior guests speaking about how they had run advertisements on MLB day and things like that, that never happened here. But if you ran a public service campaign and there's got to be people out there who will fund this, whether it's Consumer Reports or whatever that goes, if you've got a particular issue with a chair or a particular district and just lights that district up between everything with iPhone ads to whatever else you can think of. Because there's not a single person who you talk to in their district who goes, oh yeah, let's go ahead and just keep letting them do whatever the hell they want with our data. That doesn't exist. No constituent doesn't like this bill. And so what we have to do is get outside of the rotunda and get out there to make the legislators feel like, well, crap, I really got to do this, what they do to us all the time because they have the money. And so I think collaborating to get a pool of funds for a targeted marketing campaign, whatever that looks like in order to put pressure into your position, that's how to get it done. Because otherwise, I don't know of a way to convince the state chamber that they're full of shit because they know they are, but they don't care.

Rep. Stephanie Jerome (VT)

That's really interesting because I think we would agree with you. Our bill passed the House unanimously on a roll call vote. Every single person, no matter whether it was a Republican, Democrat, Progressive, Independent or Libertarian, voted for this bill. And we have said that over and over again, but the messaging still gets put out there. And I was just reading a messaging from one of our chambers about that same thing, that the news is what they're putting out is truth is not the truth. So I like your idea. I don't know how we do it as legislators, but it is a good idea.

Rep. Monique Priestley (VT)

Colin, I was just wondering, could you go through just a few examples because it's helpful to have these over and over, basically of the attempts to, you'd said a little bit of the timeline, which actually I don't feel like was covered a lot before as a stall tactic and things like that. I was just curious if there were specific provisions where there was tactics to weaken them, like data minimization, or if you dealt with targeted advertising, private right of action stuff, all that kind of the specific heart pieces, organs that they tend to attack.

Fmr. Rep. Collin Walke (OK)

No, that's a great question. And the answer is there weren't really particular angles that they had issue with. It was the entire concept of the bill. And what we tried to do was minimize those fights that we would have. So one, we didn't even include a private right of action, or if we did, we quickly amended it, not a big deal. And then the other thing though is that, we cut out internet service providers, because there's ostensibly a federal law that covers that. But we knew that Cox Communications here in Oklahoma was huge. And so we figured, well, if we can cut out the big lobbying efforts, do away with the PRA, because really what I care about personally is being able to get my hands on what those people have. I want to know what they have, and I want to be able to say, delete that crap. That's all I care about. And so those were really the only two issues that were specific, but those were kind of taken away early on. Otherwise it was get it from opt-in to opt out, which again, we would've caved on no harm, no foul. But then ultimately it was also just the issue of we want to be able to buy and sell your data, so we're going to kill your bill any way we can.

Rep. Monique Priestley (VT)

And then I guess when you passed it and you avoided some of those battles, are there battles that if you were doing this again, that you would pick up and run with or that you were even talking to legislators about, make sure you follow up on this piece, that kind of stuff, also to just advise where we're coming from and trying to go.

Fmr. Rep. Collin Walke (OK)

Yeah. I mean, no, because what we had done was the threshold applicability for the bill under the CCPA, it's something like $50 million gross or $25, we really restricted those lower. So in Oklahoma, for example, if you made $10 mil. or more, you were covered. So we tried to make it as restrictive and cover as many companies as we possibly could. And so I really don't know at the end of the day that there was a lot more that if I were to go back and tell Josh West, Hey, you need to run this bill, there's not a lot he would change or want to change, but to get it passed, he'd have to raise that threshold level to Texas. Unless you make $80 mil., it doesn't apply to you. So there wasn't really a ton of focus or anything. And again, in my conversations with Josh, there's still a chance in the next year or two, we'll pass something Texas like. And I told him, I said, at the end of the day, I just want to know what they have and I want the ability to delete it. That's what I want.

Rep. Monique Priestley (VT)

I'm also just curious as a professional outside of the building now, and I'm not sure what kind of what you cover, but I'm curious about just general reflections on the importance of businesses to take data privacy seriously, and that in 2024 it is the main source of, it is a data economy. And so I'm just curious of your personal thoughts on that.

Fmr. Rep. Collin Walke (OK)

No, you're absolutely right. And I think there are two angles to that. The first thing that I would say is as a cybersecurity and data privacy attorney and I deal with contracts and I deal with litigation all the time surrounding this, is that businesses are not protecting data. They're just not period, end of story. And I don't care if you're a healthcare entity or what, it's not happening. I don't know, unless you're Meta or Google, companies that have actually done data mapping of where they get data, where it's at or any of that. So practically speaking, I can tell you that enforcement is going to be a pain in the butt. And then the second thing is I will also say the argument about patchwork legislation is a real pain point. So for example, I was working with a group recently who's a nonprofit, so guess what? They're exempt from the CCPA, but they're obligated to comply with the Colorado Privacy Act. Maybe Virginia, I don't remember. But so they're costs are astronomical for all practical purposes as a nonprofit for what should actually end up being the case. But at the end of the day, until the feds do something, that's not our problem. But practically, I will tell you, it does come with a cost as patchwork legislation

Rep. Monique Priestley (VT)

And actually kind of a question to discuss spurred by your response, and then Delegate Love, talking about third parties and software, software that if a HIPAA entity is using a third party, even though they might be using HIPAA compliance software, in one case, they might be using a third party provider that isn't HIPAA compliant, and in another case, they want to entity level so they don't have to worry about that. And just curious what you run into in your practice as far as businesses not keeping tabs on their risks really from your legal perspective.

Fmr. Rep. Collin Walke (OK)

No, and I think that the risks are huge, and that might be one other small bite at the apple that you might look at, is the ability to bring a lawsuit for negligence in the event that a third party is hacked or something along those lines. And the reason I say that is because the way the law works right now, if somebody is hacked and my information gets out there, I really don't have a private right of action really for anything unless I can show that my data was quite literally then taken and used in a way that harmed me. Just because it exists somewhere in some third party's hands that may or may not be a bad actor does not give me a cause of action. And so to your point, there are so many of these business associate agreements, is what we call them in the HIPAA world, between the healthcare provider and some service entity.

That service entity, I promise you, the healthcare company is not expending the money to vet the quality of cybersecurity or compliance with that business associate. I guarantee you 80% of the time that ain't happening. And so I think if you think about that relationship and go, okay, well, we're going to change that. If a service provider is breached, then an individual has a private right of action against both or one or I don't care. But that might be something to think about because I will tell you that vetting, it does not occur. It just really doesn't. I've told a number of my healthcare clients and service providers, hey, you need to make sure you're doing this. You need to make sure you're HIPAA compliant. Sometimes they are and sometimes they aren't.

Rep. Michael Marcotte (VT)

Other questions?

Fmr. Rep. Collin Walke (OK)

By the way, I got to say congratulations to Westerfield. Congratulations on your bill and good to see you again. I met him a few years ago.

Rep. Michael Marcotte (VT)

Thank you so much.

Fmr. Rep. Collin Walke (OK)

Thank y'all. If y'all ever need anything, please feel free to reach out. I'm more than happy to help in any way I can, including contributing to a public campaign against data brokers.

Rep. Michael Marcotte (VT)

Thank you. Senator Westerfield, thank you for joining us.

Sen. Whitney Westerfield (KY)

Thanks for having me. Can y'all hear me okay?

Rep. Michael Marcotte (VT)

Yes.

Sen. Whitney Westerfield (KY)

You want me to start or do you have some questions off the bat? Well, first, thanks for having me. I appreciate it. I'm sorry. I'm coming to you from the confines, an old farm truck. One of my Senate colleagues, if you are a praying type, I'd ask you to keep Senator Julie Rocky Adams in your prayers. She's a senator from Louisville, a long time legislator, and her father passed away. And so I'm here at the visitation unexpectedly here in Louisville today instead of the home office. Well, Kentucky has passed a bill, but it's not very good. And I didn't get a chance to write it, because it was written by a lot of the same interest groups you just heard Collin talking about. It'd be hard for me to follow his act without simply saying do what he said to do. His advice was good, and his experience is very consistent with what I experienced over the last four years here in Kentucky.

Started working on a privacy bill four plus years ago, and at the time there was only California, Colorado, Virginia, and maybe one other state. And everybody said, California's crazy. You can't do California's, follow Virginia. Virginia is the model. No one could explain why Virginia was the model. That's just the model they all went with. And so I pulled Virginia's bill, made a Kentucky version of it, and then improved upon it in a lot of places. I went through and made the edits that I thought were important to make. I thought the threshold for applicability was far too high. I believe unconscionably too high in Virginia and other states that have done that. I believe that there were too many other places for data to still find its way into the hands of people that we don't want data to get in the hands of, certainly without the role or voice of consumers in that process.

I started working on the bill, didn't go anywhere the first year because they had a committee chair that was ornery and wouldn't move the bill. He's an attorney. I love him to death, but he's an attorney and his wife's an attorney and they have some legal experience in the digital space and they weren't going to budge. And so it didn't go anywhere. Last year, got the bill out of the Senate 30 something to two, and one of those no votes was just because a constituent called who was uninformed and said, I heard from the chamber don't vote for this. And so they didn't vote for it. They voted against it, and I managed to get that guy onto a yes vote. So it would've passed the Senate with all but one, if I'd gotten my bill out of the Senate. But the Kentucky Chamber of Commerce informed by a lot of the biggest players in the country and in the world who were parts of the State Privacy and Security Coalition, the AT&T's and others, Amazon's and the like, you had a lot of people that were demanding that my bill not advance or something like my bill not advance.

And you know how legislators are and how we're informed. Some of us are subject matter experts in the area. The rest of us deferred to the person who is the subject matter expert. And when you hear that person say, or those folks say, this is a bad bill. It's really hard to break through that first impression. And while I was busy trying to get my bill out of the House or out of the Senate this year, the chamber was busy with one member of my Senate leadership holding it back single handedly, which I resented and still resent, they were working hard in the House poisoning the well. So even if I'd gotten the bill over there, I'd have had a hard time making something go. And they found a willing sponsor in the House who isn't a student of the subject matter.

And I like him a lot and he's a great guy and I think he'll do a fine job as he continues serving in the house after I'm long gone. But he's a willing sponsor and filed their spec bill, which is Virginia more or less. And of course it sailed and my efforts last year and this year to try to convince House leadership to not pass that bill just on spec without at least encouraging or being willing to consider some amendments was unsuccessful. So the chamber is the biggest enemy of change here. And as you just heard Collin say, I can't speak for Collin's experience, but it sounded an awful lot like what I dealt with in Kentucky. I think they know that data is still flowing. Now, most of them can't explain the nuances and the technical details of how data is gathered, what data is gathered, where it's kept, where it's stored, how long it's stored, all the questions that any consumer would want.

And Colin is 100% right. If the general public knew what information was being hoovered up on a moment by moment basis, it would blow their minds and it would be the easiest vote and the easiest policy win you'd have all year. There's a graphic and it's now very dated, and I'm sure you can find far more offensive examples of this, but I shared this with my Senate chamber several times. I've talked about it. I've used it as a visual aid. There was a story, and I found it in the Dallas Morning News from 2018. It's a nice little graphic, and it showed a graphic map of the United States, and it said, where Chick-fil-A customers go for lunch on Sundays. Every state had a little logo filled, that state's silhouette or outline was filled with the logo of the restaurant of choice. And it was clever. I should have looked up what Vermont was. I can pull that and send it to you.

Rep. Stephanie Jerome (VT)

No, Chick-fil-A here in Vermont.

Sen. Whitney Westerfield (KY)

I'll text the map to you so you can see it. But Kentucky is a Cracker Barrel state. Kentucky is a Cracker barrel state, and everybody thinks all that's cute. That's funny. Cracker Barrel, there's a lot of Cracker Barrel in the south. Not going to, that won't come as a shock I guess.

But, when you stop, and I forced or asked my members to stop and think about how that day was gathered for a second. That means Representative Priestley, they had my phone, they knew where this device was on this time of day, on this day of the week, and then they knew where that same device was some other day of the week, at the same time. There's not a constituent you represent, not one anywhere that agreed to that. And I don't represent one that's done that either. And it's unnerving to know that that's sort of information gathered up. That's an entertaining, and certainly not at all scary example. But when you think for more than just a second about how much data can be gathered up, your constituents would love this. But as Collin very rightly said, our constituents, the consumers that we represent, and I'm a Republican and I think Collin's a Democrat, the consumers we represent, they don't have the voice the Chamber of Commerce does.

They certainly don't have the voice that Amazon, AT&T, Verizon, Walmart, Google, and Meta or Alphabet and Meta. Those folks are carrying what the biggest sticks money spent on lobbying can buy, and they're winning and they're getting to introduce bills that are watered down more than they ought to be. They're eliminating private rights of action. I'm not a student of your legislature or of your legislative record, but in Kentucky we passed private rights of action on every fifth bill we hear. It isn't a problem until it's on this bill. We enact all kinds of things that we're okay with until suddenly on this we're not, because the right lobbying group with the right muscle is getting people to not vote for it. Now, we passed the bill this year, like I said, and it's very much like Virginia. It's not my bill. It came out of the House and it does not have a private right of action. Even my hybrid private right of action wasn't acceptable. The chamber and the SBCA, no one was going to budge. Because they know that if they budge in Kentucky, they're going to be asked to be budging somewhere else. And here's the problem and why I implore you to do all you can and talk to your Senators to do all they can so that they stop stonewalling your bill.

It's so important that we give states that haven't done something yet, an example to look to other than Virginia, other than Colorado, other than Utah. And I love legislators in those states just like you guys do. They're our colleagues and our peers. But some states have really taken a really soft approach here and they get to go home and say they've done something nice, but they haven't really done a whole lot of meaningful work to genuinely protect consumers. And the argument about a 50 state patchwork, when I first was handed that argument, it was convincing and compelling again until you give it another two minutes thought. We have 50 states versions of a gajillion things. We have 50 different tax codes, we have 50 different personnel codes and other kinds of labor laws and policies that the companies that are gathering data that are big enough to operate in multiple states, they already deal with 14 or 15 different things.

This isn't new. It's not going to be new or hard to implement. For the ones that aren't big enough yet, it's obviously not a question or an issue at all. That's a red herring. It's another thing used to scare our colleagues around the country into thinking that we can't be different. One of the members of the House leadership who was deeply connected to the chamber told me on the phone back before session started, he said, Whitney, your bill makes us an island. And I'm tired of Kentucky being an island. He wasn't moved by the fact that we'd be an island in two or three, very small, but very important ways that protect consumers and that businesses wouldn't know about or wouldn't, wouldn't notice. And as again, to sort of build on what Collin said, once again, I think any companies that are gathering data, the draft that I had and what I hope you all will approach and adopt, these are table stakes sort of protections that any company that's even half responsible ought to be doing with the data that they're collecting. It's not overburdensome and remind those companies and remind the Chamber we're not, and your bill's not requiring any company to collect data anyway.

If they're worried about cost or cumbersome compliance efforts, none of which are true, then just don't collect the data. I hope you can get something strong passed and through the Senate up there that does better than what Virginia's done. And now what Kentucky's done. What questions have you got?

Rep. Monique Priestley (VT)

Senator, thank you so much again. Just super appreciate all of you and it's been great to connect and share these things. Actually, I feel like you illustrated, thinking back to everybody who've spoken so far, something you said about the second version that was mapped off of Virginia, which was a tech friendly Amazon written bill. It sailed through with no problem, but the one that actually protects people is the one that all of the lobbyists are jumping on. And so that's a trend, a good trend to just put out there. So thank you for highlighting that.

Rep. Jim Carroll (VT)

Good afternoon. You made reference to two islands that businesses wouldn't even know that they were missing. What are those islands?

Sen. Whitney Westerfield (KY)

So I think good question. In my particular bill's case, mine was the threshold for applicability and then the second was my private right of action, which was limited. I'd love to have just a full blown private right of action. Our constitution, our federal constitution, Kentucky state constitution provides courts to give us a place to find redress of grievances. I assume Vermont's constitution is very similar in that regard. And so I think just at a fundamental level for us to limit the ability to use the courts for what our constitutions made our courts for, runs counter to what we ought to be standing for. And again, that's not a partisan position, that's what our constitution says our courts are for. But knowing that I could not get a full blown private right of action through, I started with a PRA that was limited to equitable relief only. And I went out of my way to make it explicitly clear, you could not get money damages, you could only get injunctive relief.

And then an attorney for the SBCA, this was two years ago on a Zoom call, complained about how a PRA is very dangerous and we're worried about the road this takes us down. And this opens up to other liability and cost of doing business goes up, all the same generic arguments they give being opposed to it, but only on this bill. They mentioned California, and as you all know I'm sure, California has a PRA, but only with regard to data breaches, not regard to their privacy bill in and of itself. They cited a report issued by the California AGs office. I've actually run for Attorney General of Kentucky and narrowly lost. I'm a former prosecutor and attorney by trade and even I am suspect of an AGs office issuing a report saying what they do works. There's not an AG in the world that doesn't have a motive to put out a report saying they do a good job.

So let's just assume for the moment that the information in that report is correct. They said in the report that 70% of the cases that come to the OAG, so if we use just a pure OAG enforcement model, so when a consumer's got a problem, they fill out a complaint online, it goes to the AGs office and as a practical matter it's handled digitally. No human sees that a form letter is sent out, stop this, you've gotten a complaint. Here's the substance of it. Knock this off. It's the bare minimum government can do and I think it's too little for government to be doing, but in any case, they say 70% of the time that form letter works. So I even went in one step further. They didn't suggest this, I offered it. I said, okay, fine, let's delay my PRA until after that OAG letter is sent. So now we're talking about equitable relief only and only for the 30% of cases that you think that OAG letter won't fix.

They weren't interested. They weren't. If you take anything away from this, it's not that my idea was brilliant and I can't take credit for it. I'm the only one that's come up with that. But I got help coming up with that solution with some brainstorming I did with others. It's that they weren't interested in negotiating. They're not going to give up on that. That's one thing. The other one was my threshold. Virginia's is unconscionably high. If you're talking about a company that's got a hundred thousand customers, you can do a lot of damage with 99,000 customers worth of data. And I think it should be, I think the number should be one. If you're going to collect data on one person, you've got a duty to their data and to protect it.

I was willing to compromise and I had tried 10,000, 25,000, and 50,000 at different times in different negotiations, but a 100,000 is what we just passed in Kentucky. There's also a revenue benchmark in there. Interestingly, I think Texas has adopted some language that follows an SBA standard for the size of your business, and it only applies if you hit a certain threshold based on those small business administration standards. I can't quote that off the top of my head, but I'm pretty sure Texas has something like that. And if I'm not mistaken, I was at an ALEC event a year and a half ago or a year ago, and they were holding that up as an example. That is better than what Virginia and other states have done with this 100,000 threshold. There were other smaller things. Those were their two biggest complaints.

Rep. Michael Marcotte (VT)

It's interesting that in the PRA that we put forward, we have a cure period built in there 150 days before anything could even happen. And so they have plenty of time to fix whatever problems they have. And in my view, that's actually business friendly. The business is finding out that they have a problem and they better fix it. So it's not injuring any other people and then they go on their merry way and continue to do their business. But we're seeing the same pushback that you were seeing as well.

Sen. Whitney Westerfield (KY)

I think that's an exceedingly generous cure period and one that if you manage to get through, I hope you'll shorten it over time. Because again, I'm willing to accept that there's a great [illegible], because I see it both in my legislative colleagues and I'm sure you all do too. And in the business community writ large, there's a lot of ignorance about the technologies involved, the services involved, and just how data is gathered and frankly, how much further metadata or even information about any individual user you can glean from that data. Whether it's their location data, their time at a location, so forth and so on. Age and shopping habits, browsing habits, and that sort of thing. So I'm willing to admit and concede that there's a deal of a great deal of ignorance and we can accommodate that up to a point, but at some point, that's not going to work anymore.

And the standard needs to be that if you're going to do business, large or small, and part of your business model is to collect data. And that's fine. And I've said this repeatedly, publicly and privately, I don't have a problem with you collecting data. Not a problem at all. I'm a Kroger Plus customer here in Kentucky. I shop at Hux Gas station and I'm happy to share that information. I'm willing to do that. I get a benefit from it. I think I ought to be entitled to some rights though and have a voice in that process. I just think if you're going to be in the business of collecting consumer data, you need to be in the business of treating it responsibly and carefully.

Rep. Michael Marcotte (VT)

Yep, agreed.

Rep. Jim Carroll (VT)

With respect to the private right of action that you mentioned earlier, you said that as a part of injunctive relief, there would be no monetary damages. Is that right?

Sen. Whitney Westerfield (KY)

Right. That's right.

Rep. Jim Carroll (VT)

And is that a blanket? I mean if somebody is damaged, personally, physically?

Sen. Whitney Westerfield (KY)

Yeah, but that would be a different cause of action. The PRA in my draft, and again, this is not what was enacted in Kentucky this year. The PRA in my draft would've been limited only to the enforcement of the rights set forth in the draft. And the rights are pretty consistent from one state to the next. I think I may have had one or two extra things, but it's a right to know what data is collected, a right to a copy, a readable copy of your data, a right to delete your data. You could only get relief, equitable relief with regard to those specific rights. So if you had a cause of action, outside of enforcing those rights, that's a separate lawsuit which you could file today frankly, based on fraud, products liability or whatever. We didn't do anything to interfere with claims that exist today.

Rep. Michael Marcotte (VT)

We're having the same issues with the thresholds as well, and we started out at 6,500. I think the Senate now settled at 25,000. For our state, that's pretty good, pretty high level. But we are thinking of maybe doing something similar to what Maine did in their bill, was start out at the high and then year after year, whittle that down.

Sen. Whitney Westerfield (KY)

I think that's a winning strategy. I feel confident there will be a day, I won't be there since I'm not running for reelection. But I think there will be a day when Kentucky's threshold comes down and I'll be advocating for it until it does. If you can get 25,000, like I said, I'm coming from a place where a 100,000 is where we went and I was trying to get anything beneath 100,000. Anything beneath a 100 would've been a win for me, a big win. 25,000 is a huge win. It may not feel like as much of a win for you all, but remember, and this is true, and we all know this, we're all state legislators. We look at what other states are doing. There's some comparison, red state to blue state, there's some comparison based on geography or population size.

I don't think this is going to be one of them. I think if you can be bold and set a standard that is anything south of what these other states have followed, you give the next legislator in a state that hasn't even dropped a bill yet, encouragement to do something less than them too. And then there's not just that one model that everybody's followed. We are doing a disservice collectively, all 7,500 of us around the country. We're doing a disservice to the people of America by continuing to set a bar that's so high that we're leaving exposed just a huge number of our constituents. And keep in mind also, this is not always universally true, but in my experience, just anecdotally, the smaller companies tend to be the most reckless with the data

Or they're, or they're doing something or they're partnering or signing some sort of a service as a product, sort of an agreement. We'll give you this data for free if you'll do this thing for our website for free, just because they think that's a cool widget or cool feature they can offer their clients or customers not realizing how much customer data's being taken up. And they don't have an independent IT department or software developer in-house to check the specs on data and the agreements involved. They might not even have a lawyer look at their contracts or agreements with these companies. And they are most apt to be taken advantage of by bad actors. It's because of those factors alone that lowering the threshold should be the responsible thing to do.

Rep. Michael Marcotte (VT)

Any other questions for the Senator?

Rep. Edye Graning (VT)

I have a question.

Sen. Whitney Westerfield (KY)

Yes, ma'am.

Rep. Edye Graning (VT)

Thank you. Hi, I'm just wondering if I have your consent to pull some clips from the audio from this so that I can share it far and wide, because I can't even tell you how much I appreciate your words today. This has been incredibly helpful.

Sen. Whitney Westerfield (KY)

Of course. Of course. I should have known you guys are a Ben and Jerry's state. Oh my gosh. Look at that Cracker Barrel owning the southeast, guys. I'm going to send this to you, Representative Priestley.

Rep. Monique Priestley (VT)

Thank you. Thank you so much, Senator Westerfield. Again, super, super helpful and would love to stay in touch.

Sen. Whitney Westerfield (KY)

Well, you got my contact information and feel free to share it with the other committee members if they have any questions by email or by phone or text. Hopefully you guys can get something well done, good and strong for your people.

Rep. Michael Marcotte (VT)

Thank you so much. Please give our sympathies to your colleague as well.

Sen. Whitney Westerfield (KY)

I really appreciate that. I'm about to walk in and I absolutely will. So thank you.

Rep. Michael Marcotte (VT)

Senator Zolnikov, are you with us?

Sen. Daniel Zolnikov (MT)

I am. I thought I was at three, but I can go if you want me. I should turn on my camera too, huh?

Rep. Michael Marcotte (VT)

You're our last legislator that we're set to hear from and if it's okay with you, we're fine with taking you now.

Sen. Daniel Zolnikov (MT)

Well, thank you for having me. Daniel Zolnikov out of Montana, Republican Senator. Fun fact, like Vermont, we're part of the United States and not part of Canada. I think some people say that about us and maybe about you as well. So I want to go through a little bit of history. So my first session was 2013 where I attempted a consumer privacy bill.

And so I attempted this consumer privacy bill. I was 26. I worked with a friend I went to college with who we both had information systems degrees. And at the time he was a professional hacker getting paid by companies to find their security flaws and whatnot. And so here I'm a freshman legislator and I'm like, whoa, there's no policies protecting my data and your data and our data nationally or at the state level.

So naively, we wrote a bill and it did not go anywhere because there was no models. There was no national definitions. The ball was not rolling. But it was mind blowing that there was a huge policy vacuum in that area. And we were about 15 years behind the eight ball in the policy. That was a decade ago. And technology has advanced greatly since then. So again, it was locally written. It was a little bit more amateur at that time, but it was a fascinating lesson of how many entities came in to oppose that legislation. Today's timeframe, there are so many proofs of concepts that are in play that we can look at and model after.

So I'll just do a little quick background. It'll take a minute. But over the last decade, I have worked on a lot of privacy and technology bills that includes the first warrant requirement for GPS information in the country, warrant requirements for devices and digital communications, the nation's strongest freedom of the press law that protects the digital communications of the press.

Let's see, just past legislation where consumers own their energy data. The nation's strongest DNA ownership bill, there's nothing like that one. And of course, why we're here today, the Montana Consumer Privacy Act. So it's kind of funny though because a lot of people don't think of Montana as a tech advanced and privacy focused state. I definitely wouldn't. But in 2021, the legislature passed a ballot initiative to the voters that amended our state constitution and required our government to obtain a warrant in order to access private electronic data communications. The voters supported that with 82% of the state. What's fascinating about that is I had already passed the laws in previous sessions that enacted the new constitutional amendment. So the cart was really ahead of the horse, but it was very functional in a good way. You don't usually have the laws in place and then a constitutional amendment to ensure that those never go away.

So let's get to the meat of the issue though. In 2023, I ran a consumer privacy bill that was based on the Connecticut model. And I'm not here to vouch for any model or whatever, but the first one that was suggested was the Utah bill, which was not a very strong or great piece of policy. The Connecticut bill was much better than the red state policies, which all red state bills were watered down and lack teeth. What's the point of legislation if you can go home and say you did something but you really did nothing. The Connecticut bill also passed where Charter was headquartered or whatever their, I think it's charter, they changed their name too often. But basically that proves that's a functional policy that works within the industry. I don't want a bill or legislation that would create lawsuits, couldn't be enacted, and would be problematic.

But on the flip side, I wanted to pass a meaningful bill that gave Montanans the rights to their most sensitive data and to own their data. So that was kind of the one that I settled on. So the quick story on the bill is the draft started again with that Connecticut bill and I was introduced to an organization that I was told I could work with to ensure the bill would work well with the industry. I'm not here to accidentally break something, right? But I want to have something pretty concrete. And just a little tangent, but in Montana we don't have personal staff. So I was working on about 20 bills in all different policy worlds, including zoning reform for housing. And I vice chair the Senate committee, worked on tax reform, simplifying transmission lines, creating short-term housing programs for human trafficking victims and domestic violence survivors.

I'm working on 20 bills, right. So those all move forward and everything. But at the beginning I'm working on this Connecticut bill and I kind of put it to the side. I'm like, okay, yeah, let's work on these amendments. Those sound good and everything. I love working on policy, but I also know how the steps work. You can get something moving and make it better throughout the process. So while I'm working on all this, the State Policy and Security Coalition reached out and worked with me to make some amendments. I was informed that these were just allowed or that these were meant for functionality of the policy. It doesn't actually get to any of the meat of the policy at the time. So again, I didn't really have the time at the beginning of the session to work through the details. And as these bills move, again, you can make changes in amendments as you learn more.

It's not really traditional, but it works well for us. So for example, the right to cure legislation was set in perpetuity. And that's extremely problematic because if you give entities a right to cure and they get caught not following the law, then they have to be identified, called out, and then they have a six month period to fix their law. Well that's like playing whack-a-mole, because they can always be caught and never actually be held accountable. So the bill was amended to allow that to happen in perpetuity. Another change they requested that I made at the beginning, was removing the universal opt-out mechanism. One change I didn't make that was requested by the tech association was changing the definition of sale, and that was extremely important. I kept the much stronger definition of sale, but those were the three main items I could think of.

So as our session continued, I was able to watch a Maryland hearing on their privacy bill, where the same organizations that was watering down my bill said, can you change your bill to the Connecticut bill? We would be supportive of that bill. So that bill in Montana isn't good, but that bill in Maryland is good. Then I am like, do my people, do Montanans not deserve those same protections, but it's perfectly fine on the East coast. That's a little bit insulting to A Montanans, and B, my intelligence. Right? So I was able to find the time to better focus on this legislation. By then it had passed the Senate in its weaker form and it went to the House. And that's when I realized that a lot of this stuff, I just did my homework at that point, was weakening the bill. So in the House, my bill was amended back to its original form, the right to cure has a sunset. The universal opt-out mechanism was put back into the legislation and the customer threshold was lowered from 100,000 to 50,000. Although I already heard you ask this question to somebody else, if I could, I would've lowered that threshold lower, especially since we're such a small population state.

I cut off communication with the tech association. The bill was then amended and sent back to the Senate where the amendments were confirmed by the Senate and the bill went to the Governor's office. The best part about this bill is it passed a 100 to 0 through the House, and 50 to 0 through the Senate. It had unanimous votes throughout the entire process. Committee amendments, everything. And I've served again now a while. It may not look like it, but I've been around. And that is a pretty rare thing for a 20 page bill, which I would say almost nobody understands. Like when you're working all this stuff, you work across the aisle, you work on these issues, you build trust as the former speaker said, and that is very important.

So this is in Montana, right? You don't think of Montana as one of those states working on this. And at least at that time, we had the strongest consumer privacy bill in a Republican state. Was it perfect? Are there better ideas and concepts and do you have smarter people working in the nitty gritty? Yes, I already know that. And am I saying to do what I did? No, I want you to do as a former presenter said, do more. Obviously be reasonable, I like a threshold of at least 5,000 to 10,000, because when you're starting up something, working on a new business, you don't want to spend all your money on lawyers and compliance and not have a dollar to put into hiring software engineers or something along those lines or the technology. So I'm a conservative Republican out of Montana, so that's my viewpoint. We can all have different ones, that's fine. But I do think a threshold allows for the small guy to start to move the ball and then once they hit a decent customer base, then they have to comply. Or else, in my opinion, I think the big tech companies actually can comply with this easier than the small guys coming up. And those barriers to entry make it harder for competition in the future. So that's just my little take. You can have a different one. I appreciate different perspectives.

So here's one thing I did put in my notes. If a red state cares more about the data property rights of our consumers more than states like Vermont, then we have a problem. You guys should be pretty consumer focused, typically. That's maybe a little stereotype, but I think it's a good one. So I'm hoping you guys keep moving that ball forward. All I needed to do at the red state level was increase the bar, right? It was really low for our red states, which helps the folks in Kentucky and wherever else say, yeah, we can do better. Look at what Montana did. Their sky did not fall. So at the end, why do we have to pass this? I firmly believe the federal government or Congress has been co-opted by lobbyists, money, power struggles, Democrat, Republican, doesn't matter, but they're no longer legislating. Last session, in 2023, they passed 27 bills including appointments to the Smithsonian.

So I have no faith in Congress and my wife's in the House and I'm in the Senate, and we passed into law 27 bills between us. We're not in the federal Congress, but I'm saying we're moving things and they don't. So they keep saying, let's do a federal policy. And I heard that 10 years ago. There is nothing. It's not happening. So I think our data is our property. It should be ours. And federalism is alive and well. And that's why we're having these conversations in the states. So basically we got to, by you acting, us acting their excuse to slow roll the states is no longer feasible or viable. So with that, I hope you guys move the ball forward and either something functional happens at the federal level or we'll just do it at the state level as we should. So there's my quick and dirty.

Rep. Monique Priestley (VT)

Senator Zolnikov, thank you so much again for this and for all of the conversations about all of this and help on this policy. I'm curious. So I know I reached out to a number of you because of the articles that you were all in and that kind of stuff, and one of the Politico pieces that you're in where you say kind of the efforts of lobbyists to try to say different things. And at one point you're quoted as saying something that's loosely, I have four business degrees, I'm not an idiot. So I'm curious just to get the trend of the pressures to weaken and if there's anything else in particular that you saw just also, so just we can illustrate to colleagues and folks in other states and the public, the little efforts that just build up over time and that you don't really, until it builds up, you don't realize along the way what's going on. And then at one moment, you have a moment that it's like, oh, these were all tactics and I'm just curious.

Sen. Daniel Zolnikov (MT)

Well, it's being smart and acting cocky. There's two different things there. So I think it actually was beneficial to work with people and then catch them, versus say, no, I'm not going to work with you. And then they say, this guy we can't work with. Because in the end, they got caught with their hand in the cookie jar to say it nicely and everything got put back in order. But yeah, they definitely underestimated, I guess. I understand the policies pretty well, but I understand the process very well. So once that bill was in the House and testimony went, they thought that they had a watered down bill that they could live with. They didn't expect those amendments. Those amendments got published I think the day before, they got put on the bill, and they got charged through within I think a week through the entire process.

That thing was a train moving fast. They could have pulled a few votes, but that thing was going. And I told the local guys, the local lobbyists like, hey, they were playing me and that was not appreciated. So it's not your fault, it's the national people you connected me with, and you don't know what they're telling me. But it was basically an insult to my intelligence. I mean, the other fun fact is that my wife chairs the committee that the bill ended up on in the House, and the Democrat vice chair was the one who actually put the amendments on. And, it was a great collaborative effort of functional politics, something we don't always see these days. So yeah, very cool. I know again, it's not perfect, right? You guys can do better, but we need to raise the bar from the Republican side, especially when the US Senate and House on the Republican side are going to say, well, look at what Kentucky did and Utah did. That should be our national standard. Now I want them to say, well, look at what Montana did. And again, it's not the best, right? But I think it's pretty good. So that removes a federal argument that's going to divide the caucuses.

Rep. Monique Priestley (VT)

Yeah, I want to actually just spin off that for a second. That is a super, I feel like that is one of the most critical points in this entire process is that the more states that the federal one is going to be based largely off of, or end up largely off of as far as states can go. So if a majority of us are passing watered down versions, that's where we're going to end up federally and it takes more states working together to raise the bar. So I just super appreciate that point. I think it is one of the most critical pieces here.

Sen. Daniel Zolnikov (MT)

Well, if the Democrat states have the better bills, which they were actually better for consumers and giving them their rights of their data, then why are the Republican legislators in the US Senators going to be like, well, why are we going to do, that's a Democrat bill. We want a Republican one. Well, now we have a pretty good Republican one. So that argument is null and void, right? I'm not saying it's going to change the world and everybody's going to go home happy and they're going to pass a great federal policy, but at least we can remove bad arguments at that level. That's it. So this is awesome. I never got to speak to another legislature, so thank you again for having me. You guys have any other questions or anything? Anything else?

Rep. Stephanie Jerome (VT)

Incredibly insightful. Thank you so much. Thank you. And it's been really helpful to see this sort of theme. These themes reappear with every one of the experienced legislators that we've spoken with this afternoon. And we are really thankful for what you've said. And it just sort of affirms all the work that we're doing. And then not working in a vacuum and that you've all been through so much of the same experience. And it's actually disconcerting to see how many similarities are the same level of lobbyists that are being as spoken, however we've been working with throughout the course of this legislative session.

Sen. Daniel Zolnikov (MT)

They think we're all decentralized. Luckily we have their technology we get to use to our benefit, right?

Rep. Michael Marcotte (VT)

It's really good to know that this is a bipartisan effort. It's not a Democrat or Republican issue. It's an issue that all legislators need to be aware of and need to be working on to protect their citizens. And I'm the chair of the committee. I'm the only Republican on this committee and I'm glad to know that I have fellow Republicans that feel the same way.

Sen. Daniel Zolnikov (MT)

It's so important to keep it bipartisan and the fact you guys are cordial and functional. I try to be the opposite of DC honestly. As you can tell, I'm not a big fan. You're a lot closer to it than we are.

Having you all communicate and care and want to hear these stories. I tell people I started out with privacy stuff and then other people took it like Democrats from the town that's very liberal, conservative, small town. It was like, this is a big Smörgåsbord or buffet and we can all come here and do it. This isn't my issue and stay out of it. It's our issue and it is huge. The amount of bills we hear is just awesome. And I support the other side of the aisle's efforts and we do it to protect it on the government side and the private side and that that's key. So thank you guys and get it done right, get her done.

Rep. Monique Priestley (VT)

Thank you, so much.

Rep. Michael Marcotte (VT)

Thanks Senator. We appreciate your time.