 Yeah. Okay. Good morning everyone. It's a convening of the Massachusetts Gaming Commission and because we're holding this meeting virtually, we'll do our roll call. Good morning, Commissioner O'Brien. Good morning. I am here. Good morning, Commissioner Hill. Good morning. Good morning, Commissioner Skinner from DC on college drop off. Good morning. Good morning. And then Commissioner Maynard. Good morning. Good morning, Madam Chair. Okay, we'll get started. It is August 8. And it's public meeting number 470. And we're going to turn right to Interim Executive Director Grossman for an update. Good morning, Todd. Good morning, Madam Chair, commissioners and all who are joining. In the interest of time, there are a few issues I'd like to mention today, but plan on offering a more robust update at the future commission meeting. Sorry for the noise if it's loud. It feels like my house is about to blow over with the rain here, which leads me into my first area, which is the progress of the Boston office. Just real quick, environmental tests have been performed in the office and confirmed that the space is dry. They've also tested the air and results as to that will be available shortly. By the end of this week or early next week, we should have some construction plans available for our review. As you know, our team has been working remotely largely for the past couple of weeks, and there are likely a few more to come. So I will certainly keep you apprised of that particular situation. Secondly, as it pertains to our sports wagering division with sterile carpenters departure, efforts are well underway to ensure the division is properly constructed and staffed. There are of course a number of moving parts there, so that there are several internal units within the commission that are addressing this matter. Our plan is well underway and coming together, and I'll certainly report back to you as to progress and status on that front very shortly as well. Finally, I just wanted to offer a few words about daily fantasy sports. Of course, as you well know, the law requires the commission to collect taxes on such operations in the Commonwealth, and we have constructed that program to do just that, and it is up and running. I'll report back to you as to the details of that shortly. Of late though, it's also been a great deal of activity surrounding the boundaries of sports wagering relative to daily fantasy sports, and whether there's actually some overlap between the two. That is to say whether there are certain activities that are offered by DFS operators that may be considered sports wagering activity that's been addressed in a number of jurisdictions now, and it's been discussed publicly. So I just wanted to note that we are certainly aware of this issue, and we're in the process of reviewing it. And I will of course keep everyone apprised as to any thoughts we have, and it's certainly an issue that the commission may need to address directly itself. So that is an issue before us that is starting to take shape. And with that, I'll stop there. I'm happy to field any questions about that or any of the other issues. But again, in the interest of time, I just wanted to mention those topics. Commissioners, any questions for Interim Executive Director Grossman? Okay, thanks, Todd. And then we have a legislative update from Commissioner Hill and Grace Robinson and her external relations manager capacity. Good morning, Grace. Good morning, Brad. Hello, Madam Chair. I think we're going to turn it over to Grace first. Yeah, I'll kick it off. So for starters, as everybody knows, or most of you should know, last week on Monday, the legislature passed and the governor subsequently signed a supplemental budget that included horse racing and simulcasting extension. And so the extension runs through December 15, 2025. So that's a two and a half year extension, which is great news. Within that supplemental budget, there was one other piece dealing with the gaming which racing, which includes language amending section two of chapter 128 C to allow horse racing and Greyhound dog racing meeting licensees in Suffolk, Bristol and Norfolk counties to simulcast at any location within those counties approved by the commission. So that was one other piece in the sub. So pause there on the supplemental budget if there's any questions on that. Just a quick question Grace, it's topic Norfolk in the third one, please. Bristol. Thanks. Any questions commissioners on that legislative update? All right, thank you. And there was one more piece. The legislature also sent the budget to the governor last Monday as well. So she has 10 days to review the budget and sign it. So I'm going to turn it over to Commissioner Hill for just a quick update on the budget. You're on mute, Commissioner Hill. I'm usually pretty good about that. Sorry. So within the budget, there was an outside section. And I'm just going to read it to you because it's very short and sweet. So section 26 of chapter 23 K of the general laws is so appearing is here by amended by inserting after the word commission in line 37 the following words and it says provided, however, that the division of gaming, liquor enforcement of the alcohol beverage control commission in consultation with the commission shall for violations of said chapter 138 enforce, regulate and control the distribution of alcoholic beverages to be drunk in a game in establishment, but not within a gaming area, including but not limited to restaurant and bars. So this language was adopted by the legislature. It was sent to the governor. And as Grace said, she has her 10 days to look at these outside sections and send either sign send back amendments or veto. So we are currently waiting to see what she does. But we're also digesting what this language actually means. We have reached out to the legislature and to the governor's office because we all want to be on the same page. Should this language be adopted? My hope is that by Thursday, which is the 10 days that we will have a good answer of what this actually does and what it will mean for the gaming commission. And of course, G you and others when it comes to how we're going to handle alcohol beverage incidences at the casinos. But I hope on the next meeting to have a better answer for you or what that language does and how it affects us. But it is there and it's currently before the governor. Any questions? Yes. Thank you, Commissioner Hill for that update. And Grace as well. I was wondering in terms of getting a better understanding of what that language actually does for us on the alcoholic beverages piece. Could we also have something similar with respect to the simulcasting legislation that allows any existing operator to simulcast from anywhere. Um, within South County, I think there were a couple of the counties that were mentioned. And I think we all might have an idea around what that's about, but it would be good to have something internal as well on that. We will get something for you in memo form if that's what you're asking. Oh, it doesn't have to be in memo form just in terms of just, you know, the overall analysis of those. Sure. Thank you, Commissioner Hill. And that's our update for the for the week, Madam Chair. Great. Thank you. Okay, we'll move right on to some. Thanks Grace so much. Move right on to the Sports Wadring Division. We've got Director Band this morning. Or we've got Manager Bushman. Good morning. Good morning. Director Band is actually unavailable this morning. So taking this one. Great. Thanks. Thanks, Crystal. No problem. So the Sports Wadring Team is presenting a pretty straightforward request today from the MGM to extend the original temporary waiver of 205CMR 255.03 through November 15th would be the new effective date. The former waiver expires in a few days on the 10th and they're seeking about a month longer to implement their specs. The Sports Wadring Division doesn't have a concern with this request as we had reviewed it and would support the commission's approval. But I am available if there are any particular questions based on the waiver that they submitted. Crystal, did you say November or is that my year September 15th? September 15th. Yeah. Thank you. I don't know if I said November, but it is September. Thank you very much. Madam Chair. Yes, and everybody knows that there's a memo in the packet. Yes, Commissioner Hill. So my only question is, and I think it's one we all care about, are they actually going to be able to get this up and running by September 15th? Or are they going to be coming back again, looking for another waiver? Is that a question for me? Yes. Okay. I believe so. This is because it's tied into a release that was a little bit delayed and will be launching. So that's why they have a particular date in mind. It's just it's available in other jurisdictions. It's just the rollout here has not happened as they anticipated, but they anticipate before November 15th. September 15. I am saying November. I'm ready for fall, I guess. September. Yes, nine to 15 23. Okay. Thank you, Madam Chair. Thank you, Crystal. Of course. Any other questions? Commissioners? The chance to read, I see Commissioner O'Brien saying no. Anyone else? I'll say that. Okay. And you do need a vote today, correct, Crystal? Yes, please. Thank you. Madam Chair. Thanks, Commissioner. I move that in accordance with 205 CMR 202.03 to the Commission issue a waiver to bet MGM from the requirements outlined in 205 CMR 255.033 through September 15, 2023, as granting the waiver meets the requirements specified in 205 CMR 102.034 and is consistent with the purpose of GL chapter 23N. Second. Thanks. Okay. With a second from Commissioner Maynard. Any questions? All right. Commissioner O'Brien. Hi. Commissioner Hill. Hi. Commissioner Skinner. Hi. Commissioner Maynard. Hi. And I vote yes, five zero. Excellent. Thank you, Crystal. Nice memo, very, very clear and helpful for us. Thank you. Okay, have a good day. All right, now we're turning to item number five on our agenda. And we're going to turn to Regs. Good morning, Attorney Theresa. How are you? I'm well. Thank you. Good morning, Madam Chair and commissioners. So we have five regulations coming back to you today following a public hearing and comment period for review of those public comments and possible final adoption. Those regs are 205 CMR 138 internal controls, 238 additional internal controls for sports wagering, 247 uniform standards of sports wagering, 248 sports wagering account management, and 257 sports wagering, wagering data privacy. And just a reminder here that those first four 138 238 247 and 248 are currently in effect by emergency. 257 is not that one is working its way through the ordinary promulgation process. And so with that, I will turn it over to Nina Macarius to walk us through the comments we've received. Good morning, Madam Chair and commissioners. So as Attorney Theresa just mentioned, we have five regs. These are all ones that came before you as a group before with regards to data privacy and confidentiality of patron information. We're going to take them one by one. And I will defer to you, Madam Chair, and how you want to do the votes. We did receive comments on some but not all. So starting on page 211 of your packet is 205 CMR 138. We actually received no additional comments on 138. As you'll recall, 138 is the uniform standards of accounting procedures and internal controls that governs both gaming and sports wagering. In some respects, the red lines that are shown throughout the packet, for instance, on page 13 are the additions that were made as part of the emergency regulation. There is there are no new changes proposed and no comments were received. So that's that's the easy one is 138. There's there's no changes contemplated here. Any questions commissioners? I think in this case, it makes sense to vote after each one. I think that's right. So any questions on this one? Haven't been any further comments? Commissioners, right? Are you prepared to move them on this one? Everybody's just looking up hearing the thunder. Madam Chair, I move that the commission approve the amended small business impact statement and the draft of 205 CMR 138 as included in the commissioners packet and discussed here today. And further that staff be authorized to take the steps necessary to follow the required documentation with the secretary of the commonwealth to finalize the regulation promulgation process. Second. Okay, great. Thank you. Any questions or edits? Okay, Commissioner Brian. I, Commissioner Hill. I, Commissioner Skinner. I, Commissioner Maynard. I, and I vote yes, five zero. Excellent. There we go. Next. Turn right. The next regulation is 205 CMR 238. That appears starting at page 92 of your packet. In this case, we have no proposed changes, but there were a handful of comments. The comments, by the way, appear at starting on page 171. There's a matrix of comments. So I know that's a lot to look at. So I'll try to instead tell you where in the reg each comment would show up and discuss and discuss the comment that way. So there are three sections where we received comments. Again, 238 was promulgated by emergency with with the additions shown in red line starting on page 92. These are the sports wagering specific internal controls. We received no comments on the new definitions in this case. But we did the first set of comments we received were regarding 238 11, which is on page 101. These comments suggested that the layers, three layers of staffing, as was suggested for ticket writers and the kind of oversight was unnecessary. We are not proposing any changes. We did not propose any changes in this regulation this time around. This portion of the regulation has been in since prior to the most recent emergency adoption in April. So we would recommend no change, but just wanted to note the comment had come in. The next area that received some comments was in 238 25, which appears on page starting on page 109. We received comments on a couple of portions in here. Again, these comments had to all came actually from Caesars all four of these first comments having to do with the operations of the of the ticket writer and their handling of wages and at this point, the the issue here is again, there were no actual changes proposed in 238 25. The comments all relate to sort of the day to day management of ticket writers and what they can and can't do. But these are rags that have been in place. And so my suggestion would be again, no comment no changes. However, this may be an issue for further discussion between the operator and the sports wagering division to figure out if there's an issue of just understanding that the rags and how they might work in practice. It's the only only operator that commented on. Finally, we did get a handful of comments as well on 238 35, which appears on starting on page 115. But really, the comments were regarding the section on 160. This was a change that was made in the emergency regulations in in April. This had to do with the ability of a sports wagering operator to cancel a wager that they believe to be an error and in what's called obvious error. Both, I believe it was Caesars and Fan dual both suggested restoring some version of that. The the Commission had talked about this at some length when this came out in April. I would point out that there are still there's still the ability to cancel an error, an obviously wrong wager by request of the Commission. However, from what I recall of the April conversation, I believe the consensus was that it it left too much discretion in the for the operator to be able to to decide what was a human error versus a bet that was placed on purpose. And there are of course, many examples of bets that are unauthorized or shouldn't have been placed, or those are those still can be canceled. That's the rest of the 238 35 list. But 238 35 I is what came out, which is the the obvious error portion. So I don't know if there's further discussion on that. Our recommendation is to maintain the deletion in the former 238 35 by commissioners questions. So you're saying that from the it's the eye, the new little eye that really picks up that. No, the that that new little I was always there as a one, it's what the some of the operators to the operators asked for is restoring some portion of the old eye, which is right, I understand. I'm just wondering. I know we spent a long time on this. Mina and commissioners jump in. I just want to make sure that I if you could just recall, remind me if there is an error made of the process that we have secured with the with the deletion of old eye. Right. If the patron has requested a cancellation due to an error, or the ticket writer has made an error has made an error in taking the information in, you know, I said, I'd like to bet on the, I'd like to wager on the Patriots, they put in the chiefs instead. And it's obvious that they can change that. And they can also an operator can also come to the commission under number two for to cancel any wager. But the ability to cancel on the operators from the operators perspective on their own for what they deemed to be an obvious error is what was removed to avoid a potential abuse of discretion on that. So it is original J one and two that really address obvious errors completely. That's what I wanted to make sure that there wasn't anywhere else. Okay. Any questions on that commissioners? Okay. And with that, I think that's all the comments for 238. Commissioners, any questions? All right, then I think if we're going to vote, we'll do it on an individual motion again, please. Commissioner Hill, you look ready. I'm having issues with this with my mute button. That's okay. Commissioner, either one. I am ready. If Commissioner O'Brien's ready, go ahead. Certainly. I move that the commission approved the amended small business impact statement and draft of 205 CMR 238 as included in the commissioners packet and discussed here today. And further staff be authorized to take the steps necessary to follow the required documentation with the secretary of the Commonwealth and finalize the regulation obligation process. Second. Any further discussion? Okay. Commissioner O'Brien. I, Commissioner Hill. I, Commissioner Skinner. I, Commissioner Maynard. I, and I vote yes. Five zero. Thank you. Excellent work. Okay. Item C. All right. 205 CMR 247 appears at page 126 of your packet. This is the uniform standards for sports wagering. The April updates were largely about exclusively to address data privacy and confidentiality issues. We did receive a number of comments here, and we are also proposing a few additional edits from the last go around in the, in the regulations. In this case, what is shown in the red line and highlighted is what's new, as opposed to what's just shown in track changes, but not highlighted that that would have been the changes from, from April. I apologize that you have both. It's, it's a facet of how we have to file them with the secretary of state's office to show changes from the non-emergency version. So the first proposed change, I'm going to change, appears at 247.03. This was actually discussed, but did not appear to have been captured 247.031 in the, in the emergency regs. The decision from the commission in April was that only an operator could request approval of an addition to the, to this, the, the wagering catalog, or to their, and to approved events. So that changes made, there are corresponding changes in number three in 247.033. And that really takes care of that. And it's, I don't know if there's any further questions on that. That was just a, a clean up from the last discussion. Any questions on that? And the operator is the Massachusetts operator, correct? That was by definition. Correct. Yes. By definition. Yep. All right. I'm hearing no questions, Mina. So do we have a motion commissioners? Oh, sorry, Madam Chair, there's more than two points. Oh, so sorry. That's right. I wish it was that simple, but we have a move. I got Commissioner O'Brien's vacation day on my mind. I understand. No, we're, we're making good project. I'm hoping there's a movie in her day today, some there already. 247.0311, which appears on page 131. Did Garner at least one comment. This was the issue that I think also came up at that same meeting. We're not proposing any new language, but this was a question, there was a question raised, I just thought I'd rest here regarding, this is the new language as added regarding cancellation of portions of a wager, for instance, a multi event parlay or a multi part parlay, that only the part that is canceled, the only the part that's unauthorized is canceled, not the whole thing that goes out. And the question was, does this only refer to limited events, for instance, LIV golf was the example used or wager categories like wagers or injuries or is inclusive of all unauthorized or prohibited items, for instance, known outcomes. And the short answer is it's both. It's any unauthorized that that would be canceled. So that's just a question we got. There's no request to change the to change that. Moving further down, we did receive a few comments on the proposed language in 247.07, the acceptance of sports wagers, and that appears starting on page 138, although the changes really appear on 139 here. There are a couple of comments on subsections 10 and 11, suggesting one in 247.0710. This is actually linking back to the section regarding cancellation of wagers for obvious error. And we're sort of a corresponding comment to the one we addressed in 238 that was asking for reconsideration of that. Obviously, as you just voted, you're preserving the languages voted in the emergency. So no changes warranted in subsection 10 at the bottom of page 139. Subsection 11 is similar. It has to do with the cancellation of wagers. And again, no change was actually proposed there. And we're not, I think the recommendation was to give ticket writers more ability to cancel wagers in line with our discussion of 238. We're not suggesting any changes there. Moving downward to 247.09, which appears on same page 140 is where it starts. There are a couple of changes made in the emergency reg in April to add in disclosure requirements, especially with respect to data privacy and in the terms of limitations of offers. There were in two comments on 247.09.03 with respect to the ability of how long an offer, how long a patron might have to stay signed up essentially to redeem an offer. The prior language prior to the emergency regulation said 90 days. We had comments, including from the Attorney General's office, and in conversations with responsible gaming that suggested actually a shorter period is better. The goal here was to avoid having a patron who decides to close their account really have to keep it open for a very long time or be encouraged to keep it open just to redeem an offer. That was the reason for the change in 247.09.03 at the bottom of page 141. There was, DraftKings thought the 90 days was preferable and suggested that it be kept that way. Again, we're not recommending a change. I don't know if there's further discussion on that topic before moving on to the other one. Mr. Sears, looks like they're all set. Okay. Thank you. 247.09.04, which has an analog in 257 when we get to it, was new language added in the emergency regulations that would ban promotional offers that reward or contingent on referral of patrons to the operator. At least two Fanduil and DraftKings both commented that they believe it is appropriate to allow those kind of promotions and in other places of their comments defended and advocated for the ability to be able to use referrals as part of their business model. Again, it's a policy question for the commission whether to allow that. The reason it was, this was another one that was vetted with the responsible gaming team and felt appropriate before the emergency ranks with the idea that the ability to, you know, the sports wager operators should be able to reach folks if they need to reach them without giving folks an incentive to sign up all of their acquaintances, friends and acquaintances. Any concerns with that, Mr. Sears? No concern. I just had a question for Mina. Are there any other jurisdictions who do not allow promotional offers based on referral? Who do allow or do not allow on that? I'm sorry, who do, what did I say? Who has a similar regulation to the one we are proposing here? Let us check my colleague, Annie Lee, is on the line. Annie, I don't know if you remember off top of your head, but we can confirm during the call. I don't recall, if I don't recall specifically, Commissioner Skinner, it is something that we propose both here and in 257. Annie, do you know if there was off top of your head? I can't remember off top of my head, I'm sorry, but we can certainly follow up on that. Yeah, I'm just curious. I do understand, you know, the purpose of it, the policy behind it. On our end, I'm just wondering whether any other jurisdictions have gone down this road. And when we get to 257, I think a lot of the comment that we received suggests that Massachusetts is a first in a lot of these regulations. And so I'm just interested in kind of hashing that out a little bit and understanding exactly what other jurisdictions do along the lines, along this line, and on the data privacy line. I do remember when we were presented with 257 in particular, and I don't want to get ahead, but, you know, you did say that you had surveyed, your team had surveyed other jurisdictions. So I'm really interested when we get to 257 and what your findings were relative to that. Thank you. Yeah, and commissioners, can I apologize? I just, I don't have that survey in front of me, but this was one of the ones I recall we were, we had looked into to see because this was an issue that came up. I will add, in this particular case, this is a promotional offer piece, not simply the use of data for referrals. And I think one of the reasons for this went beyond the concerns about referral and actually the concerns about the very careful balancing you had done to regulate and allow some third-party advertising, but not others, but that if this were sort of opened up that way, that it could allow less regulated third-party advertising and less transparent third-party advertising, which was the subject of a lot of the 256 conversations on that with third-party operators. Commissioner O'Brien? So yeah, just also to chime in and correct me if I'm wrong, you know, but cannabis doesn't allow the referrals. It's statutory in that circumstance, but it's not inconsistent with how other industries in the Commonwealth are being treated by other agencies. I believe that is correct, yeah. Okay. Madam Chair, I believe that is it. Let me just double-check that there's no comment I'm missing, but I believe that is it for 247. Okay. Commissioner, is any other questions? Commissioner Skinner, I think it's going to take a minute for NK to find out if that is in fact a provision in other jurisdictions. I'm not sure if it came from Ohio. It might have come from Commissioner O'Brien's points out the cannabis rags that may have been where we saw at first Commissioner O'Brien, I don't know if you have a memory of that. Well, and when the Attorney General came to us as well in the first instance, they were pretty visciferous in asking for this. Yeah. I do recall that the Attorney General's office did ask for this. I just wanted to check if another state also has this. So that's correct. Yeah. So Commissioner Skinner, do we, do you need more information before this to move on this, or are you satisfied now with that input? No, I'm satisfied with that input. Again, my inquiry relative to other jurisdictions is going to become more relevant when we get to 257. Okay. Any further questions? Okay. Do I have a motion? Excuse me. Bless you. Madam Chair, I move that the Commission approve the amended Small Business Impact Statement and draft of 205-CMR 247 as included in the Commissioner's packet and discussed here today. And further that staff be authorized to take the steps necessary to further, to file the documentation with the Secretary of the Commonwealth and finalize the regulation promulgation process. Second. Any further questions, comments? Okay. Commissioner O'Brien? Aye. Commissioner Hill? Aye. Commissioner Skinner? Aye. Commissioner Maynard? Aye. And I vote yes, 5-0. There we go. Nice work. All right. 248? Thank you. So Madam Chair, this one begins at page 146. This is the last of the four regs that were updated by emergency in late April. These have, again, these are the Sports Wage or Account Management, so there were some data privacy updates. Like the prior one, changes that are shown in just track changes were ones made as part of the emergency reg. Highlighted changes are new, and we did receive a few comments here, so I'll just walk through those. The first comment, and there's a corresponding change, is on 248.03. This is account registration. This is on page 148. There was a concern from at least two of the commenters that the, or perhaps it's just one, may have gone cut, that the ability to verify the account holder's name on a debit instrument is not always possible. And that has to do with the third parties. The explanation was that it has to do with the third parties who view the information, and there's actually a little bit of a block between payment vendors, like PaySafe was mentioned, cannot always retrieve the name on the card. The suggestion was to add a sort of feasibility standard into this to say, and if possible, to verify the account holder's name. We think that change is appropriate in this case. There are other protections to make sure the account holder is the one registering. There's other verification throughout the process under 248, so we are recommending making that addition. I mean, is that language too broad? And if possible, I guess I'm suggesting that we should narrow it a little bit to sort of only consider in the possibility whether the third-party vendor has the functionality available or the capability to do that. I don't know if we could sort of tighten up that language a little bit. I mean, certainly the intent is clear. I just worried that, and if possible, would encompass a number of scenarios that might. Sure. So could you say unless impossible? I mean, you could do it in the presumptive. You could say unless you can show me you can, as opposed to the other way. We can definitely say if the account holder's name and you could say unless impossible or unless infeasible something. Rehibited, barred, you know. Well, so the issue isn't simply that it's barred, Commissioner Bryan. I think one of the concerns that came up, for instance, is if. Just factually impossible? Yeah, or that just doesn't come up as a hit. So, for instance, if somebody enters their account as Dave, I'll use my colleague Dave Mackey, as Dave Mackey, but their debit card says David S. Mackey, that would come up as a non-match and it may not be possible to confirm all of that because the account holder may not have entered all the information the same exact way. That's one of the other concerns that came up. So I think one way to say, might be to say and unless technically or infeasible. Or. When I say impossible, when I just saw unless impossible. Yeah, we could say that it has the same meaning, but I understand the desire to sort of shift the presumption. So, right. And unless impossible, whether the debit instruments, we can make that change. Yeah, I think that works. Thank you. Looks like you've got an extra ad there too. Yes, we'll take care of that. The next section that we receive comments on, quite a bit of comments, is 248.04. These were the agent identity verification sections in particular. We added, had added in the emergency rigs a requirement to have identity authentication questions and security questions or to allow an alternate method approved by the commission. A couple of operators suggested that they had in their experience security questions and some of these measures were not effective and that they did not really go far in adding to age verification. Of course, I'm balancing those comments with, with comments from the Attorney General's office that had recommended letters similar to this. We're not recommending a change here because the language already allows an operator to identify other alternative methods. And so if an operator believes they have other methods that are effective, the intent here is to ensure proper identification. So if they don't want to use security questions because those are a problem or other methods that are more commonly used maybe outside of sports wagering, it is our view that they can come to the commission with that proposal and ask for approval of it and that would actually lead to good innovation to have better methods. Would they be able to do that? They haven't, we haven't because it's not effective. We haven't had that inquiry yet. We haven't seen any alternatives, right? Well, this has been effective as an emergency reg. That's right, okay. I am not aware that there have been any requests to do this. I'm interested, you know? I think they bring up a really good point. So I think it's clear there's an alternate song. And the AG's office approved that. Yes, I believe this may have been their suggestion initially if not the exact way it was the concept. Excellent. Thank you. Any questions or comments? And then my clarifier. Okay. Um, 248.06 is the next section that is both edited and received comments 246.03. 248.063, I should say on page 150. These changes were largely to add in the cross-references and defined terms for personally identifiable information and confidential information. There were some comments. First, there was a comment that suggests personally identifiable information is not defined in the statute to regs. However, I think this comment might be a bit outdated because it is defined in 257. And we had also cross-referenced it there. It also includes all the statutory definitions. The other significant comment that we got was about 248.063H. This language was in here actually before the emergency regulation but added to include confidential person identifiable information regarding required notice to a patron to file a complaint concerning the use or storage of their information. The concern that was raised was that this might lead patrons to some confusion with state law or knowing what their rights actually are or overstating it. Again, this is language that was worked on with the Attorney General's Office who does handle these issues under other areas of state law. We believe that changes actually clarify what information is protected. There's always been an ability or requirement to let patrons know how to provide notice to an operator if they believe their data has been misused. If we think it's a valuable tool and the reality is I think folks realize there are probably overlapping ways to deal with to deal with data security issues and this is not intended to be exclusive. So we're not recommending a change in response to that comment. Commissioners, any questions on that? I'll set you know. Okay. And then the last comment sorry on 248.063 were actually this was language that has not changed since the Immersive Reg but BEDMGM noted that automated decision making and profiling this is regarding subsection J and profiling our terms of art and there is a concern which we'll talk about again in 257 that the state should come up with a uniform privacy law before addressing automated decision making or data privacy for just sports wagering. As you'll hear me say again when we get to 257 our view is that if there is state law that ultimately supersedes this it of course will govern. These are regs so you'll have an opportunity to update them. There are unique concerns for this for data privacy in this industry and I think the commission has recognized that before and certainly has been encouraged by responsible gaming advocates to include this as well and data privacy advocates. So we would not recommend changing that we understand the concern about dueling laws but we think those ample opportunity to affect that when the legislator is going through it for the same kind of interactions that Commissioner Hill mentioned a couple of minutes ago as well as during future regulatory drafting. So with that I'll move down to 248.10.3 there was a question not a request for change there were no changes in that section that there's a question who's asking if patrons deposit money with a credit card in jurisdictions outside of Massachusetts travels to Massachusetts will those funds be available to them and the short answer is no. So that is but it was a question asked by an operator who I believe says they don't actually allow credit cards anywhere there was just just wonder I guess so that's the answer. 248.16 does include some new language including some language suggested here for the first time that I'll let Annie explain the new language there were a couple of but I'll explain the comments real quick 248.16 had a couple of comments requesting clarity and in some cases pushing back on the conspicuous display of self-imposed limitations there was some concern that this might be too much may cost too much friction for the patron when they go into bed I think I don't want to put words in director Vanderland is about I think from from the responsible gaming standpoint that's kind of the point is to have a second guessing or an ability to just to pause and reflect if needed we did already kind of come up with a compromise when this was drafted to make sure that it was prior to allowing registration into account or first deposit or first placement of a wager as opposed to every single time to try not to to balance the user experience for those who do want to legitimately wager with those who might need the reminder and so that's really the change in one and why we don't recommend the change that was made during the mercy right and why we don't recommend changing it 248.16.2 has to do with the interplay between 248 and 255 with respect so with respect to responsible gaming and so Annie I'll let you take that. Thanks Meena as Meena just said the comments or the suggestions that we're making in 248.16.2 are in interplay with 255 on play management the changes that we're suggesting here are not substantive but rather to have the same language across these sections there was language in 252 that meant a decrease was actually making it less restrictive and then an increase means it's more restrictive and here while the concept is the same the language is flip-flopped and it takes a little bit of reading to parse it out even though they are in harmony with each other for after discussions of clarity with legal sorry this wasn't in response to any comments raised by operators we thought it would be more clear to just employ the same language across the two regulations to get ahead of any confusion and to hopefully make these easier to parse for the operators the changes that we made besides instead of we replaced the decrease an increase language was just less restrictive or more restrictive to make it as obvious as possible what it means the other change that we made aside from changing that language is to clarify that more restrictive limitations will take place immediately and so we struck that or at a point in time that was clearly indicated to the patron to bring that into conformity with 255 we also added the next business day so when a change becomes less restrictive it takes effect the next business day after the time period so if you had a day a week or a monthly play management limit it becomes effective the next business day after that admission that period concludes and so again that language was added to conform this section with 255 so there are any substantive changes between what is proposed here and what the commission has already approved in 255 so if there are no questions on that I can move on to the next section or I don't know folks need a minute to digest all that any questions for Annie commissioners on that clarification I'll set thank you thank you Madam Chair the last comment on 248 was on 248 19 this is a section that was not changed with the emergency regs so we're not recommending any further changes but there was a question I think had come up in the past questioning whether this language regarding abandoned and dormant funds was consistent with the state achievement practices we had looked into this before confirmed that it did this has been out there now for several months and I don't believe we've gotten any concerns and from the treasurer's office and I believe we actually have confirmed that this is appropriate I don't recall I don't know Todd I'm sorry I was going to try to I was going to butcher your full title these days and and Carrie if you remember if we've gone anything further from that but I think we are content that the language is appropriate under the relevant statutes yeah I think that's what you said I think it is accurate period although I do see it's missing a a symbol of the section symbol and so 30 for 7A oh thank you so we will correct that all right this was of course initially brought to our attention as an issue by the treasurer I think Commissioner Ryan may have flagged it on her own as well but we you did just say I mean that the treasurer's office did see this language correct I think it's been operating under that presumption I believe that was right that's what I was trying to confirm yeah I think that's right it's been so long that I also know that's exactly right but I've been in place since their midwinter or fall the last time the weather was was exactly like this different form of precipitation with that Madam Chair I think that's that's it for 248 so we will just to recap we will change the one change we're in 248 and let me just get the exact site but we're saying if if possible to to say unless impossible make the type of graphical correction there as well as at the section symbol in 248 19 and I think subject to that it's ready for vote any last questions or comments commissioners before we move all right I'll take a motion Madam Chair I move that the commission approved the amended small business impact statement in the draft of 205 CMR 248 as included in the commissioners packet and further discussed here today and also the staff be authorized to take the steps necessary to file the required documentation with the secretary of the commonwealth to finalize the regulation promulgation process second thank you any questions comments okay commissioner bryan I commissioner hill hi commissioner skinner hi and commissioner maynard hi my vote yes five zero excellent so we're on the last one 257 we are madam chair so this the you have disposed of all the ones that were in by mercy regulation this is 257 is being promulgated in the normal course not as an emergency so this was out for public comment we received comments starting on page 187 of your packet 257 itself starts at page 161 in this case as we did with the advertising red I believe we annotated in summary form because there a lot of comments on the same section within the reg itself the comments and so that way I'm hoping makes it a little bit easier to walk through you'll see again there's a couple of places where we are suggesting additional language but we also have a couple of responses to the comments and I think in general we're pleased to see that overall there there's a desire to or a commitment to to doing this I think the first question that'll the first comment starting on page 161 is the one that I referenced earlier which is that some operators have suggested striking this entire section at the moment relying instead on state data privacy laws and data breach laws that exist including chapter 93H and waiting for more comprehensive online privacy data privacy laws such as are in progress I believe in California the attorney general's office on the other hand is urging doing this and they of course are heavily involved in that as well as I said before our view is that there are some unique circumstances for sports wagering that warrant moving forward it in a thoughtful and deliberate way of course but moving forward with with 205CMR257 recognizing that one if it is superseded by state law that is what it is and if it's not entirely superseded or requires clarification as a result of future state law there'll be ample opportunity for that so that's our reflection on the sort of moving forward general Adam Chair Yes, Commissioner I agree would mean unique circumstances of this industry and there's no reason why we would not keep 257 in place I don't think we need to wait for the legislature to come up with new laws when we have the ability to do it ourselves to regulation and I think moving forward at this time keeping 257 would be the prudent thing to do so that would be my suggestion Commissioner Bryan thank you Commissioner Hill Yeah, no I agree the fact that I feel that the industry does need it we have I think an obligation to do it and then can perhaps inform the legislature if they want to then move forward on something that's more comprehensive I'm gonna agree with that that perhaps this will inspire and and I'm sure that across the commonwealth and different industries this is an issue everyone's facing so the legislature is probably gonna be collecting from agencies like ours on this so I wouldn't wait either Commissioner Hill any questions on that Commissioner Skinner sorry A comment I've been totally agreeing to and I've just suggested in one of the comments is can you hear me okay I just wish you Commissioner Skinner I'm sorry how's that that's better okay the only thing I would say and this was suggested in the comments is perhaps we should look to see which portions of this 257 can be adopted on the gaming side under 23k and we could kind of put a pin in that for further discussion and down the line but I do think that there are some aspects of this regulation that lend that lends itself to retail and retail gaming in terms of the use of consumer data any reaction to that Nina no I'm happy to to help obviously the legal team work on that is moving forward I think there definitely are some things in here that that could be applicable with respect to consumer data I think it's easy to think of the category three sports wagering platforms because the data is entering directly but it is true that when all of us shop at brick and mortar stores or folks wager at brick and mortar gaming establishments that there may and often is data collected about them as well so certainly some something that could be alive question maybe you want to weigh in I think that Mr. Hill Mr. Brian after that I agree with commissioners going with with something that can potentially be bridge and I I just support my fellow commission all right let's continue all right so with that general comment next comment next section that received some comments was within the definitions of personally identifiable information and confidential information there were a couple of comments suggesting that the definition is too broad and should both of personal identifiable information and confidential information should really just be limited to what's covered by 93H and 201CMR17 I think as we discussed when we first presented this a lot of what is really of concern in terms of consumer protection and data privacy here has to do with data about the patron's use of platforms or patron's wagering activity as I as kind of commissioner Skinner is common let me to allude to so we don't think unnarrowing is necessary we also are not concerned that there will be confusion between the definitions here and 93H because this was worked on with significant input from the attorney general's office who regulates 93H so no changes suggested for 250702 oh one excuse me I can move on to 02 250702 had a couple of comments this is again just as a reminder kind of the meat of this regulation the data use and retention several operators expressed some concern that 250702 one was too narrow and could unintentionally restrict operators ability to use data in legitimate ways and including for instance catching potential fraud catching the malicious uses as well as legitimate loyalty programs rewards programs etc that they might have in place we intended the language before to be brought to include all of that however we do think some clarification which is what's in yellow is warranted this language was suggested by one of the operators more or less I think it might be slightly tweak but essentially to list out some of the other things that might be not just a legal requirement but good best practices to avoid malicious attacks to an operators software or data etc so we would recommend adding that I guess my only question on that we're at or what the section is it again coaching one yes so the section that says defend against legal claims is that those actually filed or it could be either PR well I mean the wording legal claims suggests it's actually filed however I think the issue here was twofold as we understood it from the operators comments it was not just when let's say a patron file suit and says you did something wrong and the operator wants to respond but also to the extent that let's say the operator is trying to defend themselves from an enforcement action by the commission or commission elsewhere another regulator elsewhere being able to show that the data they retained allows them to show that they've been using data correctly or treating patrons correctly under various regulations so I think this was always something that frankly I think would have been part of necessary to operate a sports waging platform so it's not necessary I don't think it's a change it was a elucidation on it that was requested that's the only phrase that gives me pause given the fact that it's any other applicable laws regulations corridors civil investigated demands not so sure they need it if that's what it means but I guess from my view I would make clear any vote I give any affirmative on that language would be to that purpose and not for PR purposes if someone just makes a broad allegation that's not what that's for Michelle Bryant do we need to change it or do you I mean I don't know because the language that precedes it in terms of responding to any other laws regulations court orders penis civil investigated demands of a governmental entity would seem to incorporate that so I guess I'm wondering what it was above and beyond that they felt they needed to defend against legal claim if it's within an investigative thing which is already set for the above or in the context of a court case so commissioner Brian just to be clear I think the above language actually starts with to comply with any of those and I believe the concern was more of a defensive posture in the future so if you are as a practice as an entity retaining information or storing information in case you do get a a subpoena or in case you do get a or in case you do get a claim filed against you I think their concern was that it might not be required to keep the the data up front to comply with it but it might be a best practice to have have it for that purpose that's that's why they added some of these other ones yeah that's the only one that I feel like maybe goes further than I'm this government entity apply to everything and so are they concerned about private legal claims that they need to access there is that what you're getting at Mina both I think that the comply language was really meant to say you know if because I come complying with it could include a court order or subpoena that's a private subpoena or an investigative demand of a government entity was was sort of a separate category I think that the defend against the respond to and defend against legal claims are records that they might want to keep as a business to be able to show compliance in the event that compliance is challenged in the future in the event okay yeah so I understand I hope you does that help Commissioner O'Brien that it's for that purpose sorry yeah I just want to make sure we're not giving an inception that swallows the rule Commissioner do you have I mean they're keeping it regardless right so it's the use question that's addressed here so Commissioners do you have any concerns Commissioner Hill Commissioner Skinner Commissioner Maynard he's all set I think Commissioner Maynard you're all set yeah he's all set Commissioner Skinner I'm all set just in reading the comments I thought that this was definitely one that we should probably accept from operators so I'm glad to see that it isn't but I uh want to also uh respect Commissioner O'Brien's concern so however we can tweak this language so that our concerns are satisfied I support that if it's helpful the uh perhaps small tweak that might address Commissioner O'Brien's concern might be to say he after legal claims before that comma um or actually before um just say it gets filed legal claims which would avoid this being we sort of open up to sort of public court of public opinion battles which I think is your concern right so I didn't know whether it would be changed to either litigation or filed legal claims I think either one of those I think gives me it addresses sort of the the concern that I have with that phrase on its own I'm okay with filed everybody else okay with filed we can add that in thanks if we're ready I can move on to the the next comment the next two comments really on bottom of page 161 and page 162 had concerns about first on for 250702 we had this has been drafted as an opt-in for data use and storage a consent being needed for for the patron some operators expressed concern that opt-in would be too burdensome and that instead opt out mechanisms that a patron should be able to can opt out but sort of is automatically agreeing to opt in similar concerns about having another separate data privacy agreement presented to operators or data privacy requirements presented to excuse me to patrons as they're setting up their account in both these cases our recommendation is to keep the language as is at least this is a measure that was proposed partially to acquire again some informed consent from from the patrons and the concern I think that's been expressed about these kinds of in the opt-out is that if it's buried within other information it may be very difficult for and it may not be apparent to the patron when they're signing up that what they're choosing to opt in to just by signing up so that it would sort of up and the framing to have it be an opt-out as opposed to an opt-in 250702 to see had to do with there's language here regarding intervening pages which says a patron shall not be required to confirm withdrawal of consent more than once and no intervening pages or offers will be presented several offers noted that there may be intervening pages to take you to if you're on a third-party site or if you need to fill in information to fill out your opt-out that that should be okay so we added the language actually I apologize it wasn't highlighted in this case I think that the red lines are just red lines because they're new other than those needed to confirm withdrawal of consent that is the idea that you're not going to say you're not going to get something that says you know before you go let us give you one more offer but let us try to keep you as a customer patrons understood that they weren't supposed to do that they just want to make sure that if they need to if that way if someone clicks accidentally they don't lose their account consent the change so then the next comment in subsection three this was a you know there's a number of comments here about the use this was again one of the more discussed as you know and we when we talked about this and probably we expected a lot of comments and we did get quite a number the first was sports waging operators may not you know the whole setup is not they may not use that information for a variety of purposes one is a or based on to target users based on particular information the period of dormancy or non-use there were some commenters that said you know this is kind of standard marketing practice it should be allowed the concern of course is that as you know this this is it might be standard practice in some industries however I think the concern here was dormancy or non-use may suggest somebody is not not looking to re-engage sports wagering and encouraging them could could lead to more addictive behaviors our view is that this change here is not necessary folks who want to engage with the sports wagering operators or actually or place a wager I have no shortage of more general advertising letting them know how to do that and where to do that especially if they already had an account they presumably know how to go active if they want to the idea here is to not be allowed to use the data to have push advertising to folks who are promotions to folks who have not use their platforms for a while so madam chair just before we get a lot further along so I actually have some questions about lockdown versus opt-out peace and the question is whether one of the questions anyway is what other jurisdictions require opt-out versus opt-out and I you know I'm not intimidated at all if massachusetts is the first to do that I know that this language has support by the attorney general's office I just I want to understand to what extent these regulations are modeled after the other two jurisdictions that were mentioned and I believe it's California and then there was a there's another jurisdiction that was heavily mentioned in the comments GDPR I believe so I guess could you just give us an understanding of what other jurisdictions have this opt-in versus opt-out and how the comments relative to the privacy consent excuse me how a consent to a privacy notice compares to the opt-in versus opt-out options and ultimately the reason why I'm asking about that is there seems to be a suggestion in the comments that some of this might be a challenge technologically and I want to understand that a little bit yeah so Commissioner Skinner we we did look and we also looked a little bit at the question you asked you're right a lot of these recommendations came initially from the initial comments that came with the advertising regulations actually from the Attorney General's office and then updated further comments from them my understanding is I do not believe and any can correct me if I'm wrong on this that other jurisdictions have gone to this level of detail on data privacy with respects of sports wagering in particular however the California regulations that you've mentioned have to do with data privacy generally and data privacy for consumer data in general that is one of the reasons I think that came up quite a bit in the comments is that some of the operator suggestion is you should wait until Massachusetts does something similar to California with data privacy generally that being said I think the you know we've talked about the reasons why you know that may not be preferable so you are you are doing something that is not done by most jurisdictions if any at this point at this level of detail some of the exceptions have to do with it would be where it will get later to sort of the use of data for interventions both foreign jurisdictions outside the United States I believe in the UK as well as in New Jersey have started to do things along these lines so most are that's one exception but for the most part these suggestions come from data privacy best practices that have been implemented largely in California and in Europe are the two places that have kind of pushed this the furthest so far that were suggested if you are going to do to sort of regulate on your own initially to model after in terms of the data in sort of the difficulty of opt-in versus opt-out I just want to add that these like Mina said we are going into detail here but in terms of other states that have strong data privacy protections in the realm of sports wagering we're building upon states such as Connecticut and Colorado that also events a strong intent to protect data privacy of sports wagering to consumers and so those states don't necessarily go into the same level of detail here but it is sort of within they are we sort of have a strong scheme of protection for sports wagering patrons and their data privacy so it's not as if other states are taking a more a more cautionary approach as the operators would like here there are other stick I think a lot of states are in concert in recognizing the data privacy of sports wagering it's a hot topic and something that is very important and needs to be regulated we are expanding upon that sort of general movement and providing more detail that will hopefully make it clear to the operators what and what is what is not allowed so sorry for that interruption I'll hand it back over to you that's right thank you thank you that was sort of that was really helpful I so I appreciate your commentary if I could just jump in we we have heard from the office on this as it's been repeated and it's possible that there might be movement across the country in this area because the attorney general's offices are recognizing their impact in this particular space for gaming I have raised in the past a couple of times where I felt that we might be going too far Commissioner Skinner and wish that we could just get a little bit of research done before we adopted a couple of provisions in this case I'll tell you just my personal view I'm comfortable here notwithstanding the comments because it is so much the AG space and so I feel that we can lead this conversation knowing that their expertise has really informed this and Mina I'm not overstating it that A&K really worked closely on the wording with the attorney general's office correct? We did and this is one of the you know one of the reasons this took you know a long we did this on the longer cycle was to be able to get their initial feedback if you know just to recap that history they you know they gave us some of the comments along with the advertising regs we agreed with the commission and the discussion of the commission and with the AG it made sense to put this in a separate reg so the first draft was heavily informed by A&K and the legal team worked with the AG's office further in drafting and then through and then they also submitted a comment letter largely supportive of this reg with actually one addition that we'll get to in a second so this is something that's been vetted by them and I think they understood pretty well and actually helped had a lot of input in which just gives me some of that confidence to Commissioner Skinner's point and Annie's the other states have definitely addressed this at a broader level I personally think we're fortunate we've had the opportunity to work with another agency here to be able to get into more detail on some of it with respect to the question on opt-in versus opt-out Commissioner Skinner that was a comment that has as well some of these others made by the some of the operators that I don't believe that they are suggesting or I did not read their comment suggest that it's technically difficult to create an opt-in versus opt-out we all clicking on different websites get the little alerts that say you know cookies will you accept the cookies or not etc there are different ways to do that pop-ups themselves are not hard to program I think their concerns had to do with the balancing of the user experience and what I think was referred to in some comments is the friction for the user versus the utility of getting those notices and I think that's a legitimate policy question for the commission that being said I think they're the flip side of that is you know we worked closely not just with the AG's office but also in developing this initially with the responsible gaming team and the sports wagering team to make sure that there's a balance between inundating folks with notices and disclosures that would become meaningless and just frustrate users versus giving informed consent so I think that's that's why we're recommending in this case the opt-in language thank you for that and madam chair thank you for your comments I you know take absolutely nothing away from the expertise of the AG's office in particular we had you will all recall chief jared rinheim here last time to to give his comments and lend his support to the direction that the commission is going relative to these data privacy regulations looking forward to continuing the relationship and furthering the common goals of the commission this commission and the attorney general's office in projecting consumer data so but where I want to be more mindful here is if there is some kind of barrier technologically for operators to adhere to these regulations when you know if if they I believe they are in effect today should we vote to promulgate them Harry can correct me if I'm wrong but they become effective in short order relatively and I don't think that I'm misremembering a comment or two that indicated that the operators would have to build essentially build a different process for opt-in for Massachusetts because that's not something that is required in any other jurisdiction so you know I want to at least put on the table should that should there be a need for an operator to request a waiver for a period of time or to come into compliance with this regulation that we give them the opportunity to do that and that we fully consider that request there was a lot of material here and I you know I could be misremembering or misinterpreting what was communicated in the paperwork but I don't think I am so that's that's where I am I'm in full support of the regulations as they're written I don't think that we should be reverting to any opt-out I just want to be mindful that this might be the more more challenging than we realize to implement if should these regulations become effective tomorrow but Commissioner Skinner I can just add to the effectiveness question if that's helpful so the next filing deadline for final promulgation is next Friday so you know should you vote on these today or even next Thursday if we don't get through everything today we could file these next week and they would go into effect on September 1st so that would be the effective date should you you know come to a conclusion on these rights today so to Commissioner Skinner's point though if we all agree on the policy which might be stretching right and it might be onerous on the operators they do have the waiver I know that crystals here process that they could engage in it's just I'm not sure when they say you know build you know what that what that really means in terms of rebuilding yeah that's why I wouldn't I wouldn't I'm not suggesting a blanket waiver at all I think I think the onus should be on the operator to demonstrate the need for it so I agree I don't know what what that language means I don't want to misinterpret it but I do want to have the opportunity available should to an operator to face a real challenge in getting this up and running but that would be the process right with no with the waiver should they come across it a significant challenge I'm I'm I think Commissioner Skinner and I are looking for that that's right right that's that's that's that's that's correct yeah they're going to have to show that it's you know feasibility the difficulty of it and there's there are is a process to do that so Commissioner there's any comments on this so far no other than I think the the opt-in is certainly I think the way that we should go okay with that Madam Chair if I can I I'll move back to 257023 and if I could let me describe there's sort of a this is again the list of ways in which information may not be used and it's it's really again when we talked about this last time this had to do with the use of of data or what we know what a operator knows about a patron through their personal identifiable information or confidential information to target further promotions advertising you know encouragement is to use to them the list is the one you have before you when we first proposed a couple of months ago and there were some comments on virtually all of these the period of dormancy as I as I started referring to is this you know this this concern about being that operators would like to be able to actually if someone has not used your account a while or for instance one of the things I think came up was if they know somebody is a seasonal player or they play a particular sport is that considered a period of dormancy and should they be able to talk to advertise directly we the counterbalance of that is I think that again there's folks who who want to engage have plenty of knowledge on how to do that I think both the commission and the operators have done enough educating of the public to know that how folks can get to get engagement so the concern here is about using the data for that but that that was the concern raised on dormancy I can stop after each one or if you want I can maybe go through a few of them and maybe get blank reactions whether one's lined up or not be this kind of is a related one to the third party one Commissioner Skinner you had asked us about in 248 wagers made or most offers accepted by patrons are known or predicted social connection to the patron the this one along with D there were questions about one would that cover demographic information if folks of a particular ethnic social background etc are more prone to to engage in particular kind of sports wagering and should they would that be allowed as well as sort of referral and kind of social interaction if I know that my friend is if the operator knows that my friend has placed a wager on the last five Celtics games and I also have an account should they kind of be able to tell me about that as a way to get me to to wager more again you know these are these rags I do not know Commissioner Skinner we went back and it does not look like there's another jurisdiction that has gone as far as as outright saying no to referrals or to to looking at data this closely this was something that was recognized as both by the Attorney General's office and I think when the commission talked about last time as a new step in the amount of detail that would be that the commission would be putting out there about how data is used or not used there is I think concern about how much we know of what the operators are doing in other jurisdictions with the exception of the somewhat limited program in New Jersey to target interventions there has not yet much regulatory coverage to cause public disclosure of exactly how this data is used and I think that was one of the places where some of your other regulations started pointing to what in some of what we discussed in 247 and 248 so this policy you know I think we knew these potentially work concerns operators did express you know concerns about the limitations they would have on that relative to other industries of being able to use demographic data personal data to really push advertising to individual folks similarly item E I think I want to just pause on that one per second this is about computerized algorithms automated decision making this one has a very important language here which is known or reasonably expected to make the gaming platform more addictive it is not simply a way to I think we use the terminology before tailoring versus targeting this doesn't limit tailoring for the person who would engage in responsible gaming in a responsible way the patrons fan who you know is gets advertisements more about those games than they do about the you know lacrosse league game that they may not have any interest in that this doesn't limit it what it does limit is intentional use of that data or knowing use of that data that could be expected to make the platform more addictive and so we're we're comfortable with the limits we've set I will note there were a few suggestions in the in some of the comments both with respect to this as well as with respect as for the friction issue and this I mentioned before that I think some of the operators have suggested that if you make it if the user experience on these sports wagering websites has these limitations or you're getting fewer targeted ads that perhaps the unregulated or you know offshore markets illegal markets might be preferable I have to say this is you know just my own reasoning through it I am not we did not find those comments terribly persuasive in this context especially now that you do have an established industry in in the commonwealth and and it is still far easier for the person who might be dissuaded from betting because of an extra screen or because they're not getting a push at for them to go identify trust and and use an offshore betting account seems not plausible from my perspective it just I'm not there was no real citation to any researchers a suggestion that that might that would happen but it's in our in our view at least in case view that's not a credible argument to mean a director Vandal and then have the opportunity to weigh in on these regulations I understand I guess I you know I hear I hear what you're saying I I'm struggling just a tiny bit here in in drawing the line um between you know so we'll let me back up is there in a so should the operator assume are we are we asking or suggesting that the operator must assume that there's a break in play because it's intentional because someone is struggling with gaming when they have a period of dormancy for instance from one season to the next one NFL season to the next so we are we are we asking the operator to assume that that is because that individual wants to take a break from gambling because they may be struggling with with with a gambling you know related harm I how are we thinking about that and so I you know I'd love to hear from mark on that point not to put them on the spot I just I think that they're there's some validity to that dormancy question in particular you know you have you have someone who is only interested in sports wagering during the NFL season no other time and they take a break or it's not a break but they just they're you know it's no longer the NFL season Super Bowl has happened and they're done until until September rolls around so is that the situation that we envision where we're saying we cannot reach out to that individual once the season starts up again and offer you know a promotion so before director vandal and if he's still here I'm not sure I see him on the screen but it weighs in I think not exactly and I think the the language here is that it's using that personal information about their dormancy to promoter or incur specific wagers or promotional offers and so if the person has clearly signed up for and has only been on the Patriots and made my example before wasn't wasn't great but if they've only been on the Patriots and they've only been on sport on the NFL season it's not the the reason that they're getting an ad is because they've shown an interest in sports region on the NFL it's not based on their dormancy and the fact that there was no NFL games for the two weeks a year when they're now no NFL games it's the it's it's because they're the activity they're interested in is now being re-advertised them with this language is intended to do is to say to operators it is the commission's policy and the commission's rules that you will not set up whether it's algorithms or research departments doing it manually ways to figure out how do we re-engage the person who hasn't bet in a while we have you know that you know we've all I don't know I'm thinking of just sort of the basic you know stores online that will send you the we haven't seen you in a while ads now that's the sort of external facing part of it for them to know that about me has some data loaded it what we're suggesting is don't use that however if if let's use the same kind of plain vanilla example that's not sports wagering if I seem to buy a new phone case every time a new iPhone comes out and a new iPhone comes out and that company sends me hey we've released some new phone cases there's no problem with that just like there's no problem with saying there's a Patriots game this week the NFL season has restarted that's different than targeting someone for a period of dormancy and because of their non-use of the platform and that's what we're saying should not be built into into the advertising that's what this language would be saying should not be built into the targeted advertising someone hypothetically who will only bet on the Patriots during the NFL season so an operator cannot send me in your scenario cannot send me a promotion or a welcome back offer dealing with the Patriots but that operator can send me a promotion or welcome back offer just because it's the general start of the NFL season correct I mean what what these regulations are intended to do are to alter or hopefully not alter if the regulars of the operators aren't doing this already but to make sure that the operators are not using what they know about patrons in a way that causes a greater likelihood of irresponsible gaming they can't know for sure the intent of why someone has been dormant or not but they can tell if someone has been dormant and if they're going to bake that factor into the data that they're looking at to figure out who to get advertising to that's a problem as opposed to figuring out what they do wager on and what they are interested in that's completely legitimate to get people tailored wagering opportunities tailored promotions for what they do wager on that the concern is really in the back and in the back room creation of of the advertising and the targeting of the advertising to avoid it going to folks based on criteria that in our conversations were responsible gaming in the attorney general's office suggest are more likely to suggest wanting to take a break or potential for irresponsible gaming there was a comment and I think Reinhimer made that suggested that whatever that data is that the operators have that that should be reported to the commission and so I I can't remember if that's something that was adopted in this draft regulation it's not in 257 but the I believe it's in either 238 or 248 with respect to the information regarding how you know what their practices are for the use of data and how they use and how they use it because I think ultimately that is the the part that is going to require some work is figuring out how the commission can actually tell the difference right if if I if all I get at the end of the day is the email of you know you should you should bet on this Patriots game it's a is it because data was pulled about me that suggests that I enjoy the NFL and I enjoyed wagering on the NFL or is it because of something that is not allowed if this rag were more in place right my use dormancy my use of responsible gaming feature etc right I see it's very nuanced the distinction and it's hard for me to understand and I think dormancy is the the simplest way to talk about it or a way to apply the distinction that you know you can kind of see it but on these other categories I wonder to your point how obvious it is it's just to just you know to understand from an operator's perspective what what you can you know what you can do and what you can't do so I think we should think about that a little bit and and just I'm going to try to kick it back to or kick it to director Vendor Linden because I think that I'm interested in hearing his responsible gaming perspective Madam Chair if that's appropriate and if Mark is amenable so I don't see director Vendor Linden here today think he might be returning today for some reason that's in my head I thought he was on earlier sorry I thought he was I did see him on earlier okay don't see him he was definitely on earlier but he's not on now you are correct yeah my apologies any further thoughts to commissioner Skinner's points commissioners O'Brien commissioner Hiller commissioner Maynard I see both commissioners Hill and Maynard not shaking their head no no I don't have the same concerns necessarily that commissioner Skinner has expressed but I don't know about Mark's availability today before we continue though to commissioner Skinner's earlier point crystal has followed up with grace and has raised an important sort of scheduling issue with respect to the waiver crystal I'm not sure if you're able to speak to this or grace either one of you crystal hi hi sorry relocated so this is to the earlier opt in opt out but I just want to make sure we don't lose track of it crystal yeah sorry so I think in general and I think Kerry might be here as well we're just chatting about the timelines on some of this that particular component if the commissioners are concerned about having real timelines on what the impact might be we would need a little bit of time because I think what are our meetings coming up the 27th before Kerry is this the first you said the first of September is when this would go into effect yeah if they're finalized by next Thursday with the file at the end of next week and they would go into effect September 1st so yeah we'd want waiver requests reviewed before the first right so we would need to get those in for the 27th meeting and then that would require us to have them probably by the end of this week so scope and development might take a little bit longer for that but you know it's certainly your process we were I was just letting grace know that the 27th would be the timeline for that and that's the 24th oh sorry the Thursday the last the that Thursday yeah which I know we do have a busy agenda already but we would need to get those on before that expiration date of the first so the process would be that they would have to submit the proper paperwork to you by the end of this week if they were interested in a waiver so commissioners of the alternative would be some kind of a universal waiver even though we don't know the extent of the challenge for all the operators unless you have more insights on that crystal I don't I mean I've had only one operator raise anything and I think it's probably where Commissioner Skinner was discussing that particular comment but I usually do once we've passed or we've discussed what the regulation will look like send out an operator update and let them know and in this case that that would be the case here's what the language looks like if you need to present a waiver I would need that by the end of this week I just I think in this case it might buy us a little bit of time if you were considering to put out some extension on that where we could get the waiver and later but that being case I haven't had any feedback so you know I normally I'd have a little feedback for you because I would have put that out but in this case I don't so I'm not sure how many we're looking at or the extent of them just as a kind of brief update on what we'd be looking at Commissioner Bryan was just going to weigh in Mina I was just going to ask Mina or Kerry how long this language has been out it's been out for quite a while actually I think we talked about this and now I want to say late May or early June and it's been out for a couple of months the other just no and this is I think we're going to talk about this as we're going through the reg you got through the four emergency regs that were set to to sunset and so needed to be filed this one even if you voted today doesn't have to be filed immediately because it's a new regulation so again this is up to the commission with policy matter but perhaps rather than a waiver you could hold filing or direct us to hold file or direct Kerry really to hold filing for some period to allow waiver requests to commit so this one doesn't that big while we'd like to see it keep keep moving forward as our recommendation overall there is you know an ability to manage the timing more so than when we've done emergency topics yeah but they've had this language since yeah for a couple of months now so I guess the fact that only one operator has voiced issues I crystal I laud the fact that you you know point out things specifically to invite for their comment but for me this has been out there and so if they wanted to get more specific they could have I'm not feeling like I want to delay this or put some sort of blanket waiver out well I'm definitely not in favor of blanket waiver but I do think we should explore the the option of we vote on these regs today to hold them from filing we've done that and at least at one other instance I mean it doesn't have to be an extended pause in filing but I do think it's worthwhile to to consider a little bit on the timing here you know if that meeting and I guess that August 24th meeting is is not going to allow for a comprehensive request from any operator for a waiver then you know I think let's talk about what date we should be looking at and what that looks like in terms of holding to file my concern that my concern that commissioner scanners is a lot of speculation it's one one licensee who voiced some of these issues and now we're potentially delaying implementation on this idea that maybe they need a waiver maybe it won't be substantive and fulsome not inclined to delay based on that conjecture based on that one comment that's my view yeah and I understand that I just I just can't ignore the comment that you know they have to build out their system or you know and I don't remember what the exact language was and as I said I don't want to interpret for the operator but there was mention of the need to build you know that they're they're often processed to satisfy the Massachusetts regulation so I don't want to ignore that madam chair you're muted sorry thank you can I turn to Carrie Carrie I just want to make sure I understand the timetable again do we have flexibility in the filing date so I guess that's one thing I wanted to confirm with Mina and Annie because the four that are in effect by emergency we do need to file next week so that they'll go into effect before those emergencies expire and I know that there are some there's a bit of overlap on some topics and some cross references in 257 with the other four so and I apologize and I'm sort of stepping in here on Caitlin's rag so I'm not as familiar with the data privacy rag but I just want to make sure that if we hold 257 for a couple of weeks or however long that that won't impact the filing of the the other four that we would need to file next week yeah so Carrie and I think the short answer is there's definitely a preference if they do go all together because there's some of the definitions do do play into you know each other however the emergency rights have been out as an emergency without 257 promulgated and so I think they've already been in place the real really the only effect of not having 257 in place is that it does leave some technically some ambiguity on what confidential information and personal identifiable information means however I believe in at least some of these regs we redefined it so that's okay and you you may have and you clearly the commission has taken a view on will have taken a view on what those words mean because it might have voted a rag that's not filed yet so I think that's a it's a matter of preference to try to get all of them in at the same time you could do a blanket waiver on one section you could do partial waivers that's as another option so with that I'll just remind everyone that we do have they do have a process for a waiver to get something in by the end of the week so just that we would roll it into the 24th so that we could keep this rag going that's not necessarily optimal but it's doable right Crystal doable yeah I think what you might be looking at in that case which is fine is some people needing to extend their waiver because at this point it'd be a bit of speculation as to how long implementing this might take and I'm sure they'd get something in for a reasonable amount of time but then we just might have to extend some and right now we only know of one that has really raised a concern concretely like I haven't reviewed everything but I only know of one concretely I think it is only one yeah so you know in that case I mean I I don't want to I don't want to you know put myself out on a limb here and so I'm okay I mean if that one operator is unable to comply when the with the regulation wants it takes effect and they only have until the end of the week to get in a waiver request then they should be required to do so yeah and Madam Chair I can just confirm 238 does include the definitions I mentioned so they are in either way and then they there's only one cross reference to 257 and the other rights that actually could hold this if they wanted to if that's the decision yeah I think there is a way to hold it it would require a little tweaking to get that cross reference for the Secretary of State's office's role but that's and there's a little practicality in me that we would be going through this process again reviewing this regulation one more time the Commissioner Skinner I'm hearing you and you're concerned but I also do hear that it sounds is the only one operator is keeping track of this at this point yeah and I don't want to ask my fellow commissioners to hold this and review it you know a second time in a couple weeks but just a clarifying question the waiver requests needing to be in by the end of the week where does that come from that's that's essentially process because you guys would need a memo next what Thursday I'd need to write it Monday and they'd need to get it in so I could review it it's just timeline okay if there's any flexibility in that timeline at least perhaps we could consider extending those timelines a little bit but I'm good thank you okay should we continue then um sure Madam Chair if that's okay with you um I'm on Madam Chair yes yes Commissioner Hill do you need a break I do I was looking at my timeline this watch and I was thinking nobody's asked yet it's noon and we have been going since 10 I just need like a five minute break is all Mina is that okay with you yep I'm all yours today so okay great commissioners will take um it's 1205 how about we return at 1250 thank you Madam Chair thank you the thunder and the rain have slowed down a little bit our backyard was seemingly flooding and now it's all dissipated so that's amazing weather huh Brad it is good old New England good old me well apparently it's happening though a lot down south is really bad right but and Nikisha was in the heart of it so yeah she drove she drove down I think what we just got today right she drove through it yeah oh no I got here on Sunday night Sunday afternoon brother I think Dave's reminding us that we're in public so we'll take down the screen now we very rarely have the chance to catch up Dave so there we are okay we are returning now and I think I've got everybody we're returning now from a short break convening a mass game commission we're holding this on public meeting virtually so what do our roll call commissioner bryan I am here great commissioner hill I'm here commissioner skinner I'm here and commissioner I am here okay so we'll we'll turn back turning I'm curious I may have scrolled so I probably need to be reminded exactly where we are are we still at subsection three correct Madam chair it's on page 162 of the packet so we were I had summarized subsections a through e which were the existing prohibitions on use of data I think we we then had a discussion about the opt-in procedure and then just generally the these procedures which may require some programming but in general it's we you know this is where the operators own opera operations and how they do their marketing I think will be what's directly affected so I don't know if there are further comments on this with respect I think there are comments just a question that commissioner skinner asked before and I don't know if I gave a clear answer on director van der Linden's review of this he certainly reviewed this language and a through e beforehand I do not know if he's had a chance to really take a look at the comments from operators however I don't think the operators any of the operators suggested that these would be counter to responsible gaming practices they they were really reflecting on the requirements for them to change how they operate so so if I could I'll then move on to that there is new language in F and G and a new subsection H of 162 to 163 these were the only new recommendations from the attorney general's office in their review of this post during the common period as well as during the and as they were seeing comments from others they have added F G and H all really get into uses of measures to promote plain management so so this seems in a lot of ways as a fairly obvious one but I think to their their preference was to have it stated was that operators can't use the fact that someone has signed up for cooling off periods and responsible gaming measures as a way to target promotional offers or particular wagers to them this was actually I think consistent with the concern the operators brought up a long time ago with the play of management regs that they wanted to to be careful not to be sending additional notices to folks who have put themselves on cooling off so we thought this language made sense to add and I think you know as as my colleague Lawn would would probably chime in to say you know we this is an iterative process and I think this is a kind of more detailed portion that might be helpful to see and may actually give greater clarity to exactly what kind of data not to use as operators figure figure this out as well oh sorry I'll set commissioners with them this is 257 subsection 3 we've completed that I think so and this is an addition correct FG H are all additions FG and H F yeah I guess yeah yeah sorry I'm sorry I was trying to make sure my alphabet was correct for a second so um four and five there were comments about this is uh there was a section four provides that an operator can only retain confidential information as necessary to operate sports wagering et cetera is a sort of similar repetition of the one before and the there's also a question about the ability to retain data is kind of came up with commissioner in the conversation you and I had commissioner Brian earlier about the ability to retain data in order to comply with unforeseen legal issues in both cases we believe this is already allowed and allowed by the prior section as well so I think just to clarify that for the question legitimate operations include retaining data for as long as needed to to be able to answer requests and make sure you're in compliance not just here but in other states as well there was in subsection five this has to do with this is the sort of intervention section or you know the sort of threshold to potentially being able to use data for interventions to promote responsible gaming both the operators and the agio you know I think welcome this as an opportunity but also wanted further clarification on it the for implementation I think what we have discussed this in the past this was a project that we thought was rather than having a misregulation might be something that as as this process moves forward working with director Vandal Linden and his team to also think about what what that might look like what to do with this and perhaps get further feedback from the operators and what they think might be a good waste to to use this so this is the reporting we think that will come in on every six months base this will help elucidate what might be the best way to move forward so we we would are on the side of not being too prescriptive in this in the regulation itself questions that's where I'll set 250703 I think this is a familiar comment about the you know the again the use the sort of ability to collect this data and the purposes it's used for again I think a patron confidential personal information can be used really for anything that's necessary shared if needed for the purposes necessary to comply with laws but also to operate the sports wagering facility or platform so I again more comfortable the language as is if if you were to add anything it would be to add the highlighted language in 250702 one that we talked about before although keep in mind that this is now data sharing not use so it feels a little less necessary here I mean now in another six months to two years is that going to be confusing that has changed that's why we didn't add that on well about like an error or you know that's the only thing I'm thinking by not but the point sharing is different I get that yeah Madam chair even as I'm describing it today I do see that point I actually might I would you know if I was I'm sort of 6040 and for adding it so I might suggest adding it for that reason to avoid having you know why doesn't look different in one section than another so they don't have to come back to August 8th 1230 p.m. and find out why we left that language out yeah well 26 because if they do 1230 it'll be too oh yeah I was rounding up I because I it's a subtle difference but I understand the difference so that would be my suggestion for consistency would be to add it in on the two places but I don't know what my both commissions think don't all chime in at once so the language if you recall Commissioner O'Brien we added the word filed before the legal claims language that they felt that it was a little bit too prescriptive but can use and sharing is the distinct this distinguishing factor mean is are you suggesting putting me at that entire string list in both places in both places for consistency or at least have an explanation because I'm just thinking it will just look like we missed it or saying or or we unintentionally added in the other place yeah I I also think it would avoid having sort of trying to explain why there's a difference you know yeah to be more intentional so I would I would actually advise putting it back in to both places so I need to be above to correct on subsection or well that's just retention right that's retention the other sharing and then the other was use right I think it probably belongs in all three frankly because you have to retain it to be able to share it or use it so just to make it easier so I apologize that that's not before you that way but no that's I think we've got it right commissioners can I see commissure over I am nodding your head is everybody else okay with it all right that makes sense that's a thanks not commissure Skinner you're all set with that all right I think that's a good all right and then Madam Chair down to page 164 is the next set of the next comment 257.034 there was a there was a comment that encryption generally is not commercially reasonable more not inclined to accept that comment you know we know of many entities with smaller you know data protection requirements that have encryption however there was a suggestion of maybe allowing encryption or hashing and if you're wondering what that is because I was so I had to figure that out a little my understanding and if there are more advanced IT folks here than me which is pretty much anybody then hashing is one way encryption that cannot be undone on the others it's not rather than sort of encryption that can be unlocked so it's essentially walking and throw away the key versus walking with the key so I think that allowing hashing I think is a fair thing to allow there's some reasonable business judgment there whether that's more protective while being able to comply with all of your other requirements including being able to produce information or data to patrons who asked for it etc so it's you know I think we're comfortable allowing some flexibility for folks who want to take it to what they believe to be a more secure data step without having a requirement to do that again as long as they're complying with all of their other obligations here and in the internal controls regs and everywhere else where they might have to be able to access data so no objections right like Trisha Brown you're leaning in you're thinking okay page 165 this is 250704 is a section dealing with patron access so we're a couple of comments on this section the one of the question there was a question not a request for change whether this section applied to de-identified data and I think the answer is most likely no we can't envision a way where a patron would have a right to access data that's been de-identified and aggregated if especially if they can't be pulled aside as their data to see what's been said you know what's being held about that so the answer there would be no we did make one change consistent with the above about the intervening pages to make requests or consent again if the intervening pages are necessary to complete the job of doing that that's fine the idea is that you're not getting offers or promotions in the way of sort of to lure you out of doing what you started to do with patron access with getting your data the there was also a comment in 250704D and I think I reference this earlier because it came up by one of the other sections of 247 or 248 that some operators expressed a concern that this may suggest to patrons that they can sort of add whatever restrictions they want on their data that I think that is not true because of the rest of this regulation which sets out a process for responding to those requests including letting the patron know you know I'm sorry that you know you want us to commit to never give this to in response to a subpoena that's just not something we can legally do you know that's that's a kind of a silly example but there are you know whatever the reasons you might have to protect your data or retain data not dispose of it that's a valid reason to tell a patron sorry we can't delete it at this point or not tell a patron in some cases if there's an investigation ongoing as we talked about when we first drafted this so we understand the concern but I think it's addressed by the other sections subsection 2b if I could go there some at least one operator but maybe more express concern that this may be duplicative of the complaint process this is to the AGO and could conflict with statewide privacy law again given that this I believe came from the AG's office we're not terribly concerned about interaction with their process and if there is a superseding state law we obviously will be keeping an eye on that and perhaps revisiting all of us um so uh 2507043 is a list when the patron's request to impose a restriction or a race information is necessary so these were phrased as all or as I think one of the comments which was a helpful one was to insert to have a sort of a threshold that um that the data does not need to be retained in the first instance and then the rest for that this really applies more for deletion than um um the than imposing a restriction so I would say I guess two comments to edits I would make if that's okay you know on a little bit on the fly here one we do recommend adding the end this should be a threshold consideration do we need to keep the data to we probably should add here the the highlighted language we discussed earlier for consistency because this is another place where that list shows up although actually you know you can add it or not because it's kind of covered in B through E as other reasons the third is just a slight tweak is to add at the very beginning where it says it's no longer necessary to retain the Patriot's confidential information or personally identifiable information I would just put in parentheses or to retain it without the requested restriction just to be clear that we're talking about adding a restriction or a deletion because it it supplies to both kinds of requests neither I lost you there I'm sorry at the bottom very bottom of page 165 madam chair yeah yeah in subsection A where it says it is no longer necessary to this is the threshold this threshold makes sense for deleting data it doesn't as much sense just grammatically and logically for imposing a restriction on the data so I'm just suggesting a parenthetical to make it clear that you know the same threshold principle applies that if imposing the restriction um causes the operator uh you know it is inconsistent with the operator's ability to operate the facility or the platform or to comply with the law same as if deleting it would cause a problem that that's an issue so I would say the words would be A would read it is no longer necessary to retain the Patriot's confidential information or personally identifiable information parentheses um or to retain it without the the requested restriction got it can I make a just a grammatical or functional suggestion so everybody understands it truly was a threshold and that the and was meaningful just like to do like a 3a and then do the other ones like little i or sure yeah I think in fact you can make 3a part of the first part of three and then that's true too mm-hmm A through E E through D yeah yeah then putting an A in front of it yep and then have A through yeah D yep commissioners any questions on that commissioners thank you and uh and I appreciate the indulgence to to make some edits while we while we speak mm-hmm that's good yeah um in what was C will now be be um there is a question on from operators or an operator on whether the overriding legal interest who makes that determination and I think as with everything else in the compliance initially the operators have to make these judgment calls for themselves they have to figure out what uh and there they there was a suggestion to include reasonableness standards I think the idea is always there's an implied standard of reasonableness in all of this but um it's really up to the operators to to prove if pushed that there was if there are a less to have no overriding legal interest to explain themselves I don't think we could ever fully anticipate all of the possible reasons here on the flip side the subsection four there was a request to add a reasonableness standard to get in confirmation of the lesion to from vendors registrants etc I think that the request here was to make sure that you could use commercially reasonable steps that if if someone especially who is not any longer under the operators control is being unresponsive is out of business is you know for whatever reason that you know reasonable steps are taken to do this or reasonable contractual provisions but at some point it may be impossible to prove that something is deleted especially if someone's lying to you can't help but they delete it or not 25705 shows up as a change it's really a spacing change so no new language there so nothing nothing there and then we are all the way down to 25706 on page 168 this is the final set of comments several operators suggested here that this section be struck and in chapter 93 age govern entirely instead there again we're not suggesting that and this has been reviewed by the attorney general's office they're comfortable with this approach there may be multiple obligations to notify I think other industries have that same issue where they there might be subject to different different data breach rules and again the issue is not the idea is not to supersede or override state law but to make it clear within this set of ranks that they're covering this industry now I'm chair commissioner again Mina is where did the where did the five days come from again so yes I was going to get to that one next commissioner Maynard I believe that initially came from the attorney general's draft and the the thought process was on the completed is that there are sometimes where they have experienced and this is you know my recollection of the conversation so is that they've experienced folks sort of dragging their feet to try to actually investigate the issue and hoping it kind of goes away that being said and you know I think you know for if these things can't take a while to really resolve themselves and to figure out what exactly happened and so we thought it was reasonable to require that the investigation start right away you know that there is not sitting on heels and there is consistent communication with the commission I think the expectation is an operator that's had any kind of significant bridge would do that so we adopted something that we view that's sort of a contractual term you have to start curing up by a default usually in a contract within x periods and then diligently prosecute the cure and in this case it's the same is start the investigation within the five days and then complete it as soon as practical if for instance data is not accessible during that time or if you know as you start pulling on the thread it becomes a much deeper investigation into a data breach we don't want folks to rush their investigation either so we thought it was reasonable to have a starting point with a you know that diligent completion standard as opposed to having folks constantly come in for a waiver while in the middle of this asking you for more time for sure mayors point I can't remember is it I think it's 93 h or I'm just a 93 i 93 h one for a data breach one would an entity have to notify the ag's office so I think it is also within about the same period as came this language was modeled on that I don't want miss speak because I from what I know from 93 h is a sort of complicate somewhat complicated triggers of exactly when the ag finds out versus potentially affected parties but it is within a matter of days of finding out 10 days stands out to me just in my previous for my previous life 10 days stands out to me so but mean of by all means please you can't hear me madam chair no I just missed the word the one word that I needed to hear I miss 10 days I believe is what commissioner Skinner said that's what I'm remembering I could be wrong it was some time ago since I've dealt with 93 h issues but it would be good to confirm that if to the extent that it's not consistent with 93 h I think you know we'd want to understand why yeah so there's sort of two things here recall that this is this is for the investigation piece the actual notification to the extent that they have to notify under 93 h they will still be governed by that and that's to the AG or to the public I think the idea was the five days I know came from the AG's office partially to have that initial conversation sooner with the with their you know with the operators regulator the commission and it is update the 10 days I believe commissioner Skinner has to do with sort of the public notifications 10 business days so in so are you saying that you mentioned that's the investigation but it does say shall immediately notify the commission so that's what we've said in the elsewhere immediate right yeah and I guess my question was when does in our in our past worlds I think we're all thinking when do we have to notify the AG's office and I couldn't remember if it was precise or was it immediate I believe it is immediate as well for a state it's probably if you're thinking past lives of state agencies now for I think what we've heard from the AG's office is this is one area that is a little bit of a challenge on your 93 age because companies and their legal teams I think spend a lot of time thinking about when is our suspicion of a data breach rise to the level of knowing enough versus worrying about potential data issues so I think this is it's a constant sort of and if recall also that under 93 age there's a smaller subset of protected information than there might be here and so sometimes what happens from my from our understanding with that with that is that someone might know there was technology breach but not necessarily a breach of anything that falls into data the data breach under 93 age I understand yeah I think my practical point was I didn't want it to be and maybe that was your point Commissioner Maynard didn't want it to be really an outlier with what's required to for the AG's office and I think Commissioner Skinner said same but it sounds like it's all consistent thanks for that so the last comment here and it's one that we are not recommending is in oh six three um this is just suggestion that so this provision will allow the commission to acquire a forensic report basically from a qualified third party there's suggestion to limit that to where there's medium or high level or high risk data to be involved I think that is not a way that we would recommend the commission tying its hands up front you know especially because one of the reasons you might want a forensic report and again I'm not suggesting you know bad behavior by any current operator just if you have an operator in the future saying we had a breach don't worry about it nothing big was impacted it was just very low level stuff and you have reasons to suspect that you should be able to request somebody to prove that to you and and so I seems unnecessary to limit that language here especially given all the other ways that you have to regulate here this doesn't seem to be too on risk relative to any of that questions commissioners Mina yes so that's that's all I have for today so Harry and Annie are you all set all set yep Annie so that was a great reveal and at this point we had quite a bit of discussion about timing and whether we should move on this commissioners are you comfortable now to allow the process to continue by moving I see commissioner Hill nodding I see commissioner skin nodding Mr. O'Brien okay then I'll I'll take a motion please Madam chair I move that the commission approve the amended small business impact statement and the draft of 205 CMR 257 is included in the commissioners packet and discussed here today and further that the staff be authorized to take the steps necessary to file the required documentation with the secretary of the common wealth to finalize the regulation promulgation process second questions comments okay commissioner O'Brien I commissioner Hill I commissioner Skinner I commissioner Maynard I I vote yes five zero excellent work thank you to our legal team and thank you to and Kate for getting us through our regulations Grace are we all set for right now I'll set anything commissioners any updates that you want to but well Mina already left I we barely could say thank you to him he's out of here you're welcome Madam chair thank you I just figured your face is on the screen I'm teasing me now thank you very much for me now thank you and the weather has shifted so time for you to grab lunch outside your eyes I think this installing privacy regulations may have opened up the skies so that's exactly right we're all about transparency even with the weather okay so thank you Mina I'll set commissioners any updates before everyone okay commissioner Skinner good luck on your daughter's transition to college it's exciting time and commissioner Brian enjoy the rest of your your vacation this is nice weather for you now commissioners do we have a motion to adjourn move to adjourn second thanks okay commissioner Brian I commissioner Hill I commissioner Skinner I commissioner Maynard I and I vote yes thanks everyone thank you Todd thank you everyone thanks the team bye bye