Legislature(2021 - 2022)BARNES 124
02/04/2022 09:00 AM House LABOR & COMMERCE
Note: the audio ![]()
and video ![]()
recordings are distinct records and are obtained from different sources. As such there may be key differences between the two. The audio recordings are captured by our records offices as the official record of the meeting and will have more accurate timestamps. Use the icons to switch between them.
| Audio | Topic |
|---|---|
| Start | |
| Overview: Infrastructure Investment and Jobs Act | |
| HB159 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| + | TELECONFERENCED | ||
| + | TELECONFERENCED | ||
| += | HB 159 | TELECONFERENCED | |
HB 159-CONSUMER DATA PRIVACY ACT
12:18:47 PM
CO-CHAIR FIELDS announced that the final order of business would
be HOUSE BILL NO. 159, "An Act establishing the Consumer Data
Privacy Act; establishing data broker registration requirements;
making a violation of the Consumer Data Privacy Act an unfair or
deceptive trade practice; and providing for an effective date."
12:18:54 PM
REPRESENTATIVE SCHRAGE moved to adopt the proposed committee
substitute (CS) for HB 159, Version 32-GH1573\G, Bannister,
2/3/22, as the working document. There being no objection,
Version G was before the committee.
12:19:11 PM
CO-CHAIR FIELDS reported that since the bill's last hearing work
has been done with insurance companies, the Alaska Bankers
Association, Lynden Inc., and Lynden's attorney to make sure
that a couple of negative unintended consequences would not
happen from the bill. The intended target of the bill is online
companies that sell consumers information without their
knowledge or understanding of what the impact of that might be.
The intention of the bill was never to affect a logistics
company, a bank, or an insurance company. Work was done with
these stakeholders to make sure that these companies are not
affected. An important example is private right of action to
protect consumers information in the online environment.
12:20:26 PM
The committee took an at-ease at 12:20 p.m.
12:21:59 PM
CO-CHAIR FIELDS explained that one important change in the
proposed CS for HB 159 is the language worked on with Lynden to
make sure that the private right of action to protect consumers
in an online environment is not wielded by an unscrupulous
attorney against a business that doesn't buy and sell consumers
information. A look was taken at other states. Version G sets
parameters around the private right of action to prevent small
businesses from being targeted by plaintiff-side lawsuits and
sort of bullied into settling at great expense. However,
preserving the private right of action in the online environment
is important.
CO-CHAIR FIELDS said another important change is an entity level
exemption related to the Gramm-Leach-Bliley Act which affects
insurers and banks. This was language requested by the bankers
and insurance companies. There are federal protections around
consumers information in the Gramm-Leach-Bliley Act, and entity
level protection ensures that the provisions of this bill do
affect buyers and sellers of data online but are not
unintentionally and inappropriately wielded for a "gotcha"
lawsuit against a bank or insurance company; that was never an
intent of the bill. Co-Chair Fields offered his appreciation to
stakeholders for working to ensure that the bill's language is
as tight as possible to fulfill the intent of the bill.
12:23:32 PM
TRISTAN WALSH, Staff, Representative Zack Fields, Alaska State
Legislature, reviewed the 11 changes included in the proposed
committee substitute, Version G. He explained that the first
change is the deletion of [sections 1-5 of Version I] regarding
biometric information. This is to avoid unintentionally
sweeping businesses that are using day-to-day items such as a
company phone with a thumb print scanner or face identification.
MR. WALSH said the second change, [page 10, lines 2-4, AS
45.48.840(c)], is the addition of language to make sure that
employers using things such as just-in-time delivery, locations,
and things that are within the scope of service that a consumer
requested and are in the course of business, would be exempt
from the bill.
MR. WALSH stated that the third change, (page 14, lines 25-
27)[AS 45.48.865(5)], is the federal pre-emption regarding the
Gramm-Leach-Bliley Act. A conforming change, the term "person"
is used rather than "covered entity" because it is an Alaska
legislative drafting standard, but it is within the intent and
scope of the amendment.
MR. WALSH related that the fourth change, (pages 14-15, lines
28-8)[AS 45.48.865(6)(A)-(C)], is a clarifying exemption for
employers, contractors, and their employees on the use of
personal information related to job applications. Someone
sending in their information to apply for a job would not be
swept up in the bill. Also, the use of personal information of
an employee during the course of business would not be covered.
MR. WALSH conveyed that the fifth change, (page 17, lines 15-
31)[adds AS 45.48.865(g)(1) and (2)], clarifies exemption for
consumers requesting services, consumers using a global opt-out
signal, and businesses using or sharing personal information
with proper notice and within business purpose.
MR. WALSH specified that the sixth change, (page 19, lines 11-
21)[adds AS 45.48.875(b) and (c)], adds additional protections
for businesses undergoing mergers and acquisitions. In part,
the intent here is that when a business is working with a third
party, such as a consultant, to understand the scope of a merger
or an acquisition, any consumer personal data that is shared
will be held confidential and cannot be used for additional
business purposes of which the consumer is unaware.
MR. WALSH stated that the seventh change, (page 21, line 22), is
a conforming change that replaces "buys" with "collects" under
the definitions section at the end of the bill.
MR. WALSH addressed the eighth change, (pages 26-27)[AS
45.48.940(13)], which is under the section regarding consumers
employers. He said this change [expands the definition of
consumer] to exclude the employer-employee relationship if it is
being used in the context of business.
MR. WALSH turned to the nineth change, (page 30, line 24)[AS
45.48.940(25)], and said it includes language to exclude
employer-employee relationship from geolocation data. This
would be something like the employer using a company phone or
geolocation device to track a product.
MR. WALSH explained that the tenth change, (page 32, lines 12-
14)[AS 45.48.940(31)(a)], is a conforming change. It adds two
more definitions to the government identifications that should
be covered for various aspects of industry and business "known
traveler number" and "unique identification number issued on".
MR. WALSH said the eleventh change, (page 33, lines 4-14)[AS
45.48.940(33), adds the definition of "share".
12:29:42 PM
REPRESENTATIVE MCCARTY, regarding the tenth change, requested
clarification on what constitutes the unique identification
number and what is being addressed in that.
MR. WALSH replied that this was suggested by Lynden. He offered
his understanding that it's something truckers and people in the
shipping industry need for crossing borders. It's a government
issued identification, but it wasn't captured in the original
scope of the bill.
12:30:24 PM
CO-CHAIR FIELDS added that the Alaska constitution protects the
right to privacy but was written before the existence of the
internet and the centrality of the internet to how people
socialize and conduct commerce. He stated it could be left to
the courts to figure out what protecting the right to privacy
means in the context of the internet; but, he opined, that isn't
the best solution. If [the legislature] has the ability to
provide some definition around that, it is to the public benefit
and the benefit of business to minimize the risk of collateral
damage to businesses that don't engage in this kind of activity.
The goal of the bill is to protect both consumers and Alaska
businesses. He thanked the many people who put in significant
time to make sure that the bill is targeted and accomplishes its
purpose without unintended negative consequences.
12:31:44 PM
REPRESENTATIVE MCCARTY recalled Virginia and Colorado being
referenced as examples of this. He asked what has happened in
this evolution of development in referring to those.
CO-CHAIR FIELDS responded that California, Florida, Virginia,
Colorado, and Illinois have passed seminal data privacy laws.
Elements of each of those state's laws are included in this
bill, along with elements that are stronger, particularly around
enforcement. This bill is also different in that it's as strong
as possible in protecting local businesses from unintended
negative consequences. For example, some of the strong
biometric provisions passed by Illinois may have to be clarified
because those were used against businesses that weren't actually
focused on the sale of data. Therefore, the language in this
bill has been made as narrow as possible to ensure that local
businesses are not targeted for "gotcha" lawsuits. This bill is
not precisely the same as what any other state has passed but
builds on the experience of those other states.
REPRESENTATIVE MCCARTY recalled it being stated in testimony
that Virginia and Colorado have done the next step of making it
cleaner. He asked where this bill is in reflection of that.
CO-CHAIR FIELDS answered that he doesn't think 50 states are
going to pass the exact same law. He deferred to Mr. Walsh to
answer further.
12:33:49 PM
MR. WALSH explained that use of a global privacy signal is being
adopted more by industry and becoming more prevalent as
technology moves forward. It is a toggle on a phone than can be
switched to request to all applications on the phone and the web
sites visited that the consumer's information not be shared
beyond the service for which the consumer is immediately using
that device. Then, to use the consumer's information for an
additional service the company must get the consumer's consent.
There are some protections built into this bill against the
"Dark Web practice" of a company using attrition and making
somebody click through to get to the service they are expecting
to use, such as watching a video or ordering a pizza. There are
many efforts to ensure that the use of a global privacy signal
is something that is seen in other states where a consumer can
easily with one function opt-out of the sale of their personal
information, and that is in Colorado's law. In Virginia, one
major difference is the lack of a private right to action.
12:35:27 PM
The committee took a brief at-ease.
12:36:23 PM
CO-CHAIR FIELDS pointed out that many other states have worked
on this. California's bill was groundbreaking at the time it
was passed, but it didn't have a global privacy control because
the technology hadn't gotten there. So, iteration will continue
by the states. This is a complicated bill and it likely will
not get to the House floor this year or become law this year.
It is important for other states to work on this legislation and
learn from one another. He said his interest is to advance as
strong a product as possible and continue to learn from other
states and arrive at a consensus in the not-too-distant future.
12:37:33 PM
REPRESENTATIVE KAUFMAN said each piece of legislation that is
done tries to bring benefit while doing no harm, but all the
potential areas of harm may not have been polished out. He
expressed his concern with trying to do at a state level what
needs to happen nationally, but he respects the comments about
the need to act as a laboratory. He questioned whether the bill
is there yet given that which is unknown. He said he respects
the need for privacy. He noted the growth of the digital sector
of the global economy, all the hazards that it brings with it in
terms of privacy, monitoring, surveillance, and on the flip side
the bias imposed on who is allowed on and who is not. This is
an area to put partisanship aside, he opined. There are great
concerns with the way the system performs, what it does, and
what its capabilities are, especially going forward.
12:39:35 PM
CO-CHAIR SPOHNHOLZ moved to report the proposed CS for HB 159,
Version 32-GH1573\G, Bannister, 2/3/22, out of committee [with
individual recommendations and the accompanying fiscal notes].
There being no objection, CSHB 159(L&C) was reported from the
House Labor and Commerce Standing Committee.
| Document Name | Date/Time | Subjects |
|---|---|---|
| GuideBookDataset_FINAL 2.3.22.xlsx |
HL&C 2/4/2022 9:00:00 AM |
|
| IIJA GUIDEBOOK 2.3.22.pdf |
HL&C 2/4/2022 9:00:00 AM |
|
| HB 159 Summary of Changes from v. I to v. G 2.3.2022.pdf |
HJUD 2/7/2022 1:30:00 PM HJUD 3/18/2022 1:00:00 PM HL&C 2/4/2022 9:00:00 AM |
HB 159 |
| HB 159 v. G Sectional Analysis 2.3.2022.pdf |
HJUD 2/7/2022 1:30:00 PM HJUD 3/18/2022 1:00:00 PM HL&C 2/4/2022 9:00:00 AM |
HB 159 |
| HB 159 CS (HL&C) Ver G 2.3.2022.pdf |
HL&C 2/4/2022 9:00:00 AM |
HB 159 |