HB 159-CONSUMER DATA PRIVACY ACT  3:17:32 PM CO-CHAIR SPOHNHOLZ announced that the only order of business would be HOUSE BILL NO. 159, "An Act establishing the Consumer Data Privacy Act; establishing data broker registration requirements; making a violation of the Consumer Data Privacy Act an unfair or deceptive trade practice; and providing for an effective date." 3:18:00 PM REPRESENTATIVE SCHRAGE moved to adopt the proposed committee substitute (CS) for HB 159, Version 32-GH1573\I, Bannister, 1/14/22, as the working document. There being no objection, Version I was before the committee. 3:18:38 PM CO-CHAIR FIELDS explained the changes that were made in the committee substitute. He said that the exceptions were adjusted to ensure that businesses providing tangible goods and services in Alaska would not be unintentionally covered under the bill, which would include everything from logistics to construction to retail companies. He noted that that would not be the intent of this bill, and therefore it was rewritten to ensure that there were no unintentionally burdensome regulations. The second change that was made, he continued, was the strengthening of the language around individuals' biometric information. He said that this is an area where there's been rapidly evolving technology in corresponding changes to necessary laws to protect people's biometric information. He added that the language regarding protection of minors has also been strengthened, in addition to the language around enforcement. He stated that the importance of these topics has been communicated by consumer rights and privacy advocates during 2021. 3:20:15 PM TRISTAN WALSH, Staff, Representative Fields, Alaska State Legislature, offered the Sectional Analysis on behalf of Representative Fields, prime sponsor of HB 159. He presented the Sectional Analysis [hard copy included in committee packets] which read as follows [original punctuation provided]: 1. Sec 9: p 8, lines 21-26: Consolidated AS 45.48.805 (a) and (b) into (e); renamed accordingly. (It is now (c)) 2. Sec 9: p 12, lines 9 and 10: Conforming change. Inserted "share or disclose" following "sell'. 3. Sec 9: p 13, line 19: Conforming change. Insert ",disclose, use or" following "sell". 4. Sec 9, p 19, line 14: AS 45.48.865(e) expanded exemptions to include all business types. 5. Sec 9: p 22; line 28: Replace "On or before January 31 following each calendar year that a business is a data broker" with "Before a business begins operating as a data broker". This eliminates a period where a business could engage in these activities without having to register as a data broker with the department. 3:24:22 PM REPRESENTATIVE SNYDER asked Mr. Walsh to explain the distinctions between excluded business types, and to provide any specifics regarding the characteristics of impacted businesses, such as the size and location of the business. MR. WALSH responded that if there was a one-time transaction in which the business is using the transaction to fulfill a consumer's request, the business would be exempt from this legislation. He said that there are protections within the legislation for services that are reasonably related to the service that the consumer is requestion. For example, he said, if a consumer joins a rewards club for groceries, it would be reasonable to expect solicitations for grocery discounts. He explained that the explicit exceptions in the legislation were intended to ensure that the internal conduct of companies and corporations that are not necessarily involved in the outward sale, share, or disclosure of consumers' information is not impaired. 3:26:16 PM CO-CHAIR FIELDS added that the first version of the bill, which was introduced by the administration, had some dollar and volume figures of individual's private information that was being "shared". In Version I, that threshold was changed to only cover companies that primarily deal in buying and selling consumer information, or specifically perform a high volume of data activity. Companies that simply have a lot of consumers' private information would not be impacted by the legislation in its current form, he explained. 3:28:28 PM REPRESENTATIVE KAUFMAN asked for an explanation of how it will be ensured that the most up-to-date standards are being satisfied by this legislation, and that it won't soon become obsolete. 3:29:06 PM MAUREEN MAHONEY, Senior Policy Analyst, Consumer Reports, responded that the bill would provide strong protection for the consumers and would be at the "cutting edge" of these protections because, by default, it would protect consumers' privacy. She added that companies would be limited in the collection and sharing of data to what is reasonably necessary to provide a consumer's request of service. She expressed her understanding that the unnecessary collection and sharing of data is the source of many of the problems of consumers online. She said that legislation in other states like California is based on an "opt-out" model, which requires consumers to reach out to every single company that is collecting and sharing data, which she said is seemingly not worth it for consumers. 3:30:58 PM MICHAEL GARVEY, Director, American Civil Liberties Union (ACLU) of Alaska, testified in support of HB 159. He spoke about the critical need for civil rights protections that legislation like this offer. He said that committee members may have read about discriminatory advertisements for housing or employment as companies collect more and more personal information, and as the use of automated decision systems grows, he expressed that the potential for harm caused by the use of that personal information can increase as well. He shared his understanding that, ideally, consumer privacy legislation should prohibit companies from using personal information in a manner that discriminates against people on the basis of race, gender sexual orientation, gender identity, and other protected characteristics, ensuring that civil rights are protected online and everywhere. He noted that examples of this can be found in strong consumer privacy legislation elsewhere in the country, like the People's Privacy Act in the State of Washington, or in the State of Massachusetts, the Information Privacy Act. MR. GARVEY continued that the legislation also contains many key concepts related to consumer privacy that ACLU finds important, such as the private right of action, attention to biometric data prohibition of dark patterns, and retaliation provisions to prevent preferential pricing and economic conversion of customers. He shared that the ACLU is still reviewing legislative language of these provisions expressed appreciation to the committee for its hard work and recognizing the importance of those provisions. He added that he would also second the importance of an opt-in model versus an opt-out model. 3:33:31 PM CO-CHAIR SPOHNHOLZ announced that HB 159 was held over.