 So can we, we need anything up on the screen? Okay, we're good. So, Charity and Veronica, do you both wanna come up for us? Sure. Great. In case you have any hard questions for me, Ryan will help. No, I wrote you a memo, but I'm gonna summarize it and I'm just gonna leave it at your leisure. So I think when we left here last week or a week before, we had asked the attorney general's office to put the stakeholders together and have a discussion on 595 and some of the proposal that your office presented on modeling and the Illinois law. And so I guess we wanna find out what that meeting brought and where we go from here. Okay, for the record, I am Charity Clark, chief of staff to the Vermont Attorney General and with me is Ryan Krieger, an assistant attorney general and our subject matter expert on data privacy issues, as you know. So we did have the meeting you requested at our offices on Wednesday. We invited everyone we could think of who would be interested in coming and encourage them to spread the word to others who might be interested. I have submitted a memo to the committee that lists all of the people who we believe were there. Some folks were on the phone and he struggled a little bit to hear some of their affiliations, but we did our best and included a list. We also invited Orchid Media, who's our local cable access channel to come and film the meeting. And they did, which was wonderful. They sent me a link. I've included the link in the memo so that you can actually view the meeting if you want to hear what folks had to say. What we heard were various opinions, but a common theme and developed among the business community and that is that this concept of trying to pass a VIPA biometric information privacy act bill before the end of crossover was ambitious, but didn't allow for enough time for meaningful input from all the stakeholders, which is a fair and reasonable perspective, given how quickly things were moving. And although not everyone felt the same way and we certainly feel there is some urgency to the issue, which I can speak to in a moment, we agreed with that perspective and so our proposal is that the attorney general's office study the issue over the summer and hold public meetings similar to those that he held in 2018, which led up to S110, which the governor recently signed. So we would envision public meetings in which stakeholders were invited to provide comments. The public would be invited. We would have a variety of locations and also at least one of those would be towards the end of the work day for most folks so that regular people wouldn't have to leave work to come. It wouldn't just be those of us who make our living doing policy and these kinds of issues. So that is essentially what our proposal is and kind of summarizes the memo other than I did wanna read the scope of what we would propose this study include. So it would include appropriate protections on biometric data, including facial recognition, which was the topic of H595. Second, whether Vermont should adopt all or parts of the California Consumer Privacy Act, the CCPA. And three consumer protections that better address the privacy concerns of Remanters. We would also want to confer with the Secretary of State's office regarding the inventory that they are working on or will be working on under S110, I don't think it has an ACT number yet, so I'm just calling it S110, which is an inventory of the sale of Remanters data that the state of Vermont does. So we would wanna make sure that they were a part of the conversation and we got an update from them on that topic. So that's the summary of what we would think a good scope would be for the study over the summer. I do also want to make an announcement that relates to this topic. This morning, the Attorney General's office filed a lawsuit against Clearview AI in Chittenden Superior Court for violations of the Consumer Protection Act and the Data Privacy Act. I believe is the first lawsuit that's been filed under the Data Privacy Act on the Data Broker Act, excuse me, which of course is a very new law that we can thank this committee for being a true part in passing. So the Attorney General made that announcement at 10. We posted a press release on our website that's there right now. There's a link on the press release to the complaint as well as a motion for preliminary injunction which we also filed this morning and a cease and desist letter that we had sent Clearview last week asking them to stop collecting and storing the biometric data of Vermonters and they declined to do that, so today we sued them. The motion for preliminary injunction asks the court to enjoin Clearview from collecting and storing the facial recognition, the photo, the photos of Vermonters. So we will have to see how that plays out but if this is a topic that you are interested in, I want to know more about. It's on our website or the press release section. Where are, as Clearview, where are they getting this information? Are they getting photographs of people's driver's license? I mean, how are they getting it? Ryan, he knows, he's better at the technology of it but my understanding is they're just getting it from the internet and the sites that they visited include Facebook, Google, Venmo, places where people put photos. And what, if any, intention do they have? What is their intention? They're, I mean, my understanding is they're intending to make money. So they collect these and then they sell the information to businesses, to private individuals, to law enforcement. Yep. Go on, be along. Thank you, Ryan. Go on, be along. I was curious about sort of the frozen cons waiting versus, I mean, there are the implications of waiting worse than getting it wrong the first time. Do you know what I mean? What if we don't take action now? But is it, is it, because they will continue to build this database and if they have another year they can make quite a bit of progress on that, so. I mean, we definitely share your conundrum. It's tricky, you know, we don't have time to hear from everyone and keep in mind something that we heard which resonated with us certainly. The folks in the room at the meeting last week, they were representing in some cases other people or other businesses and having to go to those folks and say, hey, what do we think about this? You know, we're allowing them time to do a process even amongst themselves. And we heard that loud and clear, particularly from the folks locally here in Vermont, the Vermont Tech Alliance. And, you know, it's tricky. I would say that having more time would allow us to not just look at VIPA, but also some other possible options that we think are worth looking at at this time to make sure that Vermont's choosing the right path for data privacy. And keep in mind, I mean, there is a tension between the pace of technology and the pace of policy making and law making. And we're really lucky in Vermont. We're very nimble here in a lot of places. It doesn't work so well. And I think one of the reasons why it works well is because we're very collaborative and respectful. And I think the process that we're proposing really keeps with that spirit that we have in Vermont. And I think it works well. But yes, we agree there's certainly some urgency given that the review is continuing to do what they've been doing that we feel is in violating Vermont law. And so having that, so you don't feel like, if we were able to get something out this week, even if it wasn't perfect, you'd still have the Senate side for the next through May to work on it as well. And that doesn't feel like enough time either. It did to me. And I said almost the exact same sentence when we had our meeting last week. And it was not, that was not, how do I say this? It wasn't well received. People didn't share my optimism about that. Just a question about a clear review. So that the attorney general's office has sued them for violation of consumer protection. I'm trying to think, is it currently prohibited to collect biometric data? I don't see that it is in statute. So we have this, our Consumer Protection Act is it's very broad, it's very flexible, it's very nimble. So yes, they can't do what they're doing under the Consumer Protection Act because of the Consumer Protection Act. Our two things, one, it helps businesses know what they can and can't do if we're more specific. So we do have laws and rules that provide a lot of specificity on what the Consumer Protection Act is saying, for example, in other areas like the Fair Debt Collections Practices Act. We get really specific to help businesses. Secondly, when we go to court, when Ryan and I are in court and we're approving up something under the Consumer Protection Act, so say I'm approving deception, there's different elements, it's the consumer, they relied on it, the reliance was material, the misrepresentation was there, so we have to prove all these different things. That's harder than say a case I recently had where someone violated the requirement that telemarketers register. I literally just called the secretary of state and said, did they register? No, I won't my case. I mean, it was literally that easy. So when we get specific, sometimes it's a little clearer for everyone, it's clearer for the business, it's clearer for us, it's clearer for the court to interpret. So did you have something to add? Yeah, I would say you asked specifically about collection of biometrics and the core of our argument is that the combination of collecting information on a mass scale through screen scraping, okay? Basically just going on the internet just grabbing all the information you can and then applying biometric and facial recognition to that screen scrape data by the nature of how they collected it, no one knew it was being collected, they didn't have the option to consent or opt out. So it's kind of the combination of the two things that we are alleging is unfair, violates public policy, is unscrupulous and immoral. And so that's kind of the core of our, not just the biometrics, not just the screen scraping, it's really kind of the combination of the two. But these are databases which are open to the public, correct? From what's there, scraping up? So this is going to be one of the big arguments that comes up in court. Our position is that when you post a photograph to Facebook, you are granting Facebook a license to share that photograph in certain ways. You were doing it with the expectation that other people who go on Facebook would look at your photo through Facebook. You're doing it with the expectation that if you want to change your photo from public back to private, you can do that. These are all options you have. You are not doing it with the expectation that someone is going to come on to Facebook and just collect all the photographs with no opt out, no opportunity to change. And then again, apply facial recognition to them and sell that information so that you can be identified in any context. Any interesting case? We believe it will be, yes, yes. Privacy issue is at the heart of this. And a violation of constitutional right to privacy by a business. We are arguing that there is this constitutional right to privacy within the penumbra of a number of other rights, yes. So is it fair to say that even without passing anything this year that the Attorney General's office, your hands are tied, that you're not stuck in a water that you still can go after bad actors? Yes, we already have statutes. And we are certainly using those statutes in this case, two of them. So yeah, that's fair. So I think it's probably proven that we do our best to take our time and put something in place in Vermont that fits us well. That's how we've approached this in the past. And I think we're better off doing the same thing here again. So how does the committee feel about the recommendation from the Attorney General's office? I think probably what we could do is write a letter and I'll talk with the chair of Senate, economic development and then probably we could write a letter from the chairs and vice-chairs, just asking you to convene over the summer and then bring us a recommendation for legislation back on how we deal with this next year, if that makes sense. Yeah, you're recommending a study. Yes. And your stakeholders, the broad group we had for the school privacy group. It's really a self-selected group. So it's anyone who would like to come. It's a public hearing. It's not a named group. We do try to spread the word as best we can. We have a list of folks. If anyone is interested, they're included. We try to publicize the event to do what we can to get people there. Well, thank you. Sorry. I appreciate the AD's office recommendation and I think it makes sense. But I also, I wish that or I hope obviously up to the discretion of the chair that we could put in a lot of time to try to do this. I think you pointed out that we are in nimble state and that we can address these things quickly. But I see this as a major issue right now and I think it will continue to grow and I think that we have a responsibility to put some time into this to try to figure it out. And so that's my personal thought about it is I would like us, you know, we're gonna have some late nights this week, I know, already trying to get the crossover. And I am also, I do have faith in the Senate that they can do good work as well. But I personally would like to see us try to see what we could at least get done even if we don't get something out by the end of this week. Question about the data collection. Are they limiting to adults or are they going after children as well? They're going after children and that's part of, you know, why we got where we are. And in fact, this was one of the precipitating events. They filed with our data broker registry and in it we asked you collect information of minors and they said, yes, we did. And so that actually was part of our function and fortunately we had the broker registry that gave us that additional information. Really creepy on the record. I forgot to mention that we, Ryan and I were sorry that we couldn't tell you this information that we were planning to sue Clearview when we were here two weeks ago. And I also wanted to note that we did not decide to sue Clearview after we were invited to testify in 1995. We had been thinking and talking about it for a few weeks since we learned that when they registered they clicked the, yeah, we collect the data of children box. Because you're going to have case law as a result of the case that you're bringing unless there's a settlement outside of court or length of time. If you had to say, it's going to take a three years, six months, two months. It all depends on how the case is. We filed a motion for preliminary injunction so that hastens some of the guidance from the court, but it really varies and it varies on a lot of factors. I don't know if you have any more clarity than I have. It's not going to be three months. I mean, the preliminary injunction will be within three months, but a year. It's very hard to say what the time frame would be. I think that when we sued a patent troll a few years ago in MPHA, we thought that would move a lot faster than it did. So it's very hard to guess. I'm only asking because the outcome or the substance of that would inform the discussions between now and the next legislative session. We will be back here before the case, unless it settles. There definitely would not resolve in court, I would imagine, before next session. We may have a decision on the record, but we may not. This bill, 595, just talks about that the facial recognition technology being used that they have to have a person that they're collecting. Wouldn't that be like something that could be, and you have to talk to me through the legal process of this. The case, if you're going to clear your case at some time, I don't know, we don't think. But this could, in effect, at least force companies to let people know that they're collecting it and give people the option to say, it still doesn't answer the question, perhaps, that they're collecting it anyway for the use of it. Ryan's finding, are you finding the bill? Yeah. It's been a while since I've read it. I think, well, I mean, as the language currently stands in the bill, it says a business shall provide notice to a consumer that it uses facial recognition technology in its physical location or through an electronic interface. So I would imagine that means that when you walk into a business, there would be a sign, or you log on to their website, they would disclose that they do that. But Clearview did not have any interaction with the people whose information it was collecting. And they do on their website. Very clearly, they say they use facial recognition technology. So I don't know that that would, without some sort of a, and you must, I don't know that that would have stopped this practice. Bear? Can I go back to the question about case law in terms of you have cited Illinois before as an example. What is the body of case law that exists now or what's going on there in terms of determination of the constitutionality or just the findings of the court? Well, I mean, it is really interesting. Clearview has been sued in Illinois under their BIPA. And I can let Ryan speak. He's been crunching out the complaints. If he knows more of the details than I do. I mean, those complaints, their class action complaints, the AG has not sued them. So those are, in fact, I'm not sure there has been an AG. I think it's only class actions or private action. Those are very, very early days. Those cases, but there have been a number of BIPA lawsuits filed all over against a number of large tech companies. And there was a lot of case law that actually came out that said that the injury that was being alleged was unconstitutional. And then the Illinois Supreme Court weighed in January 2019 and said, no, no, it is constitutional, which actually kind of undid a lot of the law that had come up before. So there's a lot of case law on there, but it's still being developed, I would say. But there definitely is people who are saying, we think that this file is BIPA because they're suing under BIPA. Sorry, I'm rereading my notes. That Texas, Illinois, and Washington have already, last time you spoke to us, they've adopted a biometric information agency that acts similar to this. And some of them are up to 12 years old. Illinois is up to 12 years old. So I guess, how different is our legislation from what they have done? What we were proposing is we liked Illinois, so we would start with Illinois and then we would put the Vermont touch on it. So for example, it's 12 years old. I'm sure they've learned a lot. We would try to make those changes that are an upgrade or, oh, this didn't quite work well. Why don't we do this instead? So we would try to make those adjustments and hear feedback from all the folks who, in Illinois, have been working with this law and I'm sure could give us some tips on things they would do differently and that kind of thing. Just as a final comment, thank you to the AG's office for at least going after companies that have been filing legal strengths. It's a pleasure. If they had not checked the box that said that they were going to select children's data, there would have been no red flag at all. What would have happened? So your review was on our radar. We read the articles, just as many, many of us did, but yeah, we're really unique. We have this registry. Well, not California has one too, but it gave us helpful information that signaled to us, well, this is something worth looking into. This doesn't sound right. Yeah, and I would say, we're alleging what we're alleging, we are taking issue with the collection of minors, but what we like does go beyond just collection of minors. And I think what I should clearly say is, we saw that, that caused us to do a lot more research into them and a lot of other things turned up. For example, two weeks ago they had a data breach. So we started paying a lot more attention at that point and realized that there was a lot of things problematic about the business model. Oh, and I should also just note, we did invite Michael Lee, who testified two weeks ago and who raised this for the committee. And he wasn't able to be there, but he is involved with the Vermont Tech Alliance and they were there. So I just wanted to mention that we haven't forgotten about Mr. Lee. Thank you very much.