Transportation, Technology & Legislative Affairs - Senate
Video
Transcript
1 document
Bills discussed (5)
| Bill | Title | Sponsor | Status |
|---|---|---|---|
|
SB258
· 4 mentions in chapter, transcript, agenda
Matched: “SB258 C. Penzo TO CREATE THE ARKANSAS DIGITAL RESPONSIBILITY, SAF…”
|
TO CREATE THE ARKANSAS DIGITAL RESPONSIBILITY, SAFETY, AND TRUST ACT. | C. Penzo | Died on Senate Calendar at Sine Die adjournment. |
|
HB1536
· 3 mentions in transcript, agenda, chapter
Matched: “with you. House Bill 1536. Thank you committee. uh, this bill just adds some teeth to…”
|
TO WITHHOLD STATE TRANSPORTATION FUNDING FROM A SCHOOL DISTRICT THAT DOES NOT REQUIRE PASSENGER RESTRAINT … | M. McElroy | Died in House at Sine Die adjournment. |
|
SB261
· 1 mention in agenda
Matched: “…TRUST ACT. RE-REFERRED TO COMMITTEE Number Sponsor Subtitle SB261 A. Clark TO AMEND THE LAW CONCERNING THE OPERATION OF AN AL…”
|
TO AMEND THE LAW CONCERNING THE OPERATION OF AN ALL-TERRAIN VEHICLE ON CERTAIN ROADS; AND … | A. Clark | Died in House Committee at Sine Die adjournment. |
|
SB330
· 1 mention in agenda
Matched: “…RESTRAINT SYSTEMS IN SCHOOL BUSES UNDER CERTAIN CONDITIONS. SB330 J. Scott TO AMEND THE CONTENTS OF THE WRITTEN DRIVER'S LICE…”
|
TO AMEND THE CONTENTS OF THE WRITTEN DRIVER'S LICENSE TEST AND THE DRIVER'S INSTRUCTION MANUAL; … | J. Scott | Died in Senate Committee at Sine Die adjournment. |
|
SB96
· 1 mention in agenda
Matched: “…INSTRUCTION MANUAL. DEFERRED BILLS Number Sponsor Subtitle SB96 C. Penzo TO AMEND THE LAW CONCERNING DETACHMENT BY A REGION…”
|
TO AMEND THE LAW CONCERNING DETACHMENT BY A REGIONAL AIRPORT AUTHORITY; AND TO REPEAL REGIONAL … | C. Penzo | Died in Senate Committee at Sine Die adjournment. |
Machine transcript
May contain errors. Verify important quotations against the official video.
About transcript accuracy
- Source
- SliQ live captions
- Model
- SliQ live ASR
- Processing date
- October 2, 2026
Senator Ricky Hill
Unverified
0:26
Let's call a meeting to order. Representative McIlroy, we're gonna start
Representative Mark D. McElroy
Unverified
0:46
with you. House Bill 1536. Thank you committee. uh, this bill just adds some teeth to a bill that I passed in 20017, a local control bill and all it
does is just if, if you don't comply with the law, it withholds your state turn back money. And that's the short of it. I could get deeper into the weeds if you need me to, might as well. All right. Hang on just a minute. Oh great. My wife does as well.
Representative Mark D. McElroy
Unverified
1:44
This bill adds teeth to a bill I passed in 2017. The original bill was a local control bill that allowed patrons of a school district to petition the local school board. As they uh As they replaced older buses with new buses to include seat belts.
If 10% of the voters of the school district signed a petition. Asking for seat belts to be placed on the school bus. The school board can figure the millage it would take to cover the additional cost of the seat belts, which was about $12,000 back in 2017. is now about 20,000. They would place the question and the mileage increase on the ballot at the next regular school board election. Or they could forego the
election process and just purchase as a replaced older buses with new buses, they would just place seatbelts by buses with seatbelts already equipped. I carried a petition and my school district and gathered the signatures. Presented them to the superintendent in 2018. The superintendent chose to forego the election process and save the mileage increase for a larger project like a cafeteria or a football field.
Rather than on a $12,000 purchase. Now the life expectancy of a diesel school bus is about 12 to 20 years, so I waited patiently until 2024. They purchased a new bus with air conditioning which costs more than $20,000. Power steering automatic transmission but no seat belts. I contacted my local school board member with my concerns in
November. I've heard nothing back until as of now, as fate would have it, my grandson, 11 year old grandson, actually rides that school bus. It's not just about the safety of the children, but the 300 people that signed that petition. wanted to vote on whether they had seat belts or not. We complied with the letter of
the law and a school district needs to be compelled to do the same. I think they thumbed their nose at the legislative process. The bill simply withholds the state transportation money until they comply with the law one way or the other. They either have an election or by the next bus with seatbelts on it. Any questions, Senator Johnson. Thank you, Mr.
Senator Mark Johnson
Unverified
4:34
Chairman. Uh, Representative McIlroy, it sounds to me like what we have
here is a case of someone not following the law. And not following the procedures set forth in the bill that you passed. So what we're really trying to do here is get their attention and make sure they do that. Am I reading that's all. OK, thank you for answering that, Mr. Chairman. I will have a motion at the proper
Senator Fredrick J. Love
Unverified
5:03
time. Central. OK, so I guess I'm supportive of of the fact that I.
I like the idea of uh schools
having seat belts, but you're saying that they were forfeit the money, the transportation
money for the entire school year. No, just
Representative Mark D. McElroy
Unverified
5:23
until they comply either with the election or if they agree to go ahead and put the seatbelts on the bus. And as far as I know, this is, I'm the only one that's tried this after I passed that law in 2017, we were one of 4 states in the United States that had a
seatbelt law, and it's a local control law that let the people decide where they want it, and it really saves the school district the liability because when and it's sad, but it happens that children get killed on a school bus, and when they do, people want to blame somebody. And that way I've created an avenue that they can put seatbelts on, but the people have to do it, and they can't say that the legislature didn't
try to protect the kids or the school district in try to protect the kids, so we made an avenue where they can do it locally. And since then there have been 4 more states that have used this law and they've actually called me and see if they could use him. Maine was one of them. I remember, and I think Nevada was one, but Did I answer your question?
Speaker 31
6:33
I'm sorry. Yeah, sir, you did answer. OK, thank you.
Senator Matt Stone
Unverified
6:46
Any other questions? I've got one stone. Just for clarification, if a school buys a new bus, they would have to buy one that had seatbelts
Speaker 41
7:03
in it, correct only if if uh they uh carry this to the people
Representative Mark D. McElroy
Unverified
7:09
and they vote on it with the military increase, uh, or they just say, hey, from now on, I'm
going to buy buses with seat belts that way they can forego the election process, but if they, if a 10% of the people carry that petition, and if they vote it down, they don't have to do that. I mean, it's up to the local people, you know, in in the school district. Well, that was going to be my next
Senator Matt Stone
Unverified
7:34
question. If it does get voted down by the people, then there's, there's no repercussion to that school district, if they don't hold the election every time they buy a new bus, it has to have seatbelts, and the old ones will be grandfathered in. Well, if they,
Representative Mark D. McElroy
Unverified
7:50
if they choose that, that avenue they can say, well we'll just forego that because they don't want to waste that village increase on such a small amount, and there's a lot of, a lot of schools have just gone on and and said, well, we're going to go ahead and get a seat belt because the only time that the kids not seat belted in now is on the school bus. You think about it, I've even got them on my lawnmower. Are there
Senator Matt Stone
Unverified
8:14
any statistics nationwide about how many fatalities or how many lives would be saved saved if students had seatbelts on and bus
Representative Mark D. McElroy
Unverified
8:22
crashes. Well, the National Transportation Safety, uh, board back in 2017 when I passed it said that they wouldn't, it wouldn't help, but since then they've changed their stance on it because there's so many cameras on these school buses that showing a rollover situation that the kids get thrown from the bus or they they collide. Now they recommend. that you do put seatbelts on school bus, but they haven't, they haven't taken the step to, you know, say you have to yet,
Senator Jamie Scott
Unverified
8:52
so thank you. Centra Scott. Thank you, Mr. Chair. Um, Thank you, uh, Representative McIlroy for bringing
this bill. I think I'm trying to figure out what is your top priority that you're trying to resolve. Is it the safety of the kids or is it presenting local control so that they can decide. I think I'm a little confused because the bill
Representative Mark D. McElroy
Unverified
9:22
in 2017, already establishes this this law that says local control, they can, they can vote if 10% of the people. Sign a petition that they can turn it over to the school board and then let them put it on the next ballot measure with the costs, increased cost of the, the seatbelts. And uh they they can vote it up or down or they can decide if they don't want to have the You know, if they don't want to have the election, they can just go ahead and buy us.
School buses with seatbelts on them. Uh, my main concern was the safety of the children, but this, this Let it be a local control issue where everybody in the district can decide whether they want them or not because it's a controversial. I know some of you got some calls on it, so it's not a cut and
dry deal that, you know. have a follow up. Yes, ma'am, so
Senator Jamie Scott
Unverified
10:20
if it's voted down and because school This elections would take place
during school elections, right, which aren't every cycle. Are they now
Representative Mark D. McElroy
Unverified
10:31
they're, I think they're on a regular cycle that the same cycle that we are
Senator Jamie Scott
Unverified
10:37
on. So every school district has It's OK, um, so if it's voted down. Then to me, the priority. And the issue when I guess necessarily the safety of the kids because then you have to go through a whole another step to protect the kids, right? Am I understanding this right or wrong, yeah, the
Representative Mark D. McElroy
Unverified
10:59
Actually, it's just let the local people decide and, you know, my concern is for the safety of the kids, but you know, we can disagree on that. I'm imagine if we went around this table, somebody would disagree, but it lets the political process work out. People rule. So I, I'm not disagreeing on
Senator Jamie Scott
Unverified
11:19
you. I'm saying that the priorities can be different if the people vote vote it down, then how is the priority that you have, which is the safety of
the kids. Where does that fall next? That's what I'm
Representative Mark D. McElroy
Unverified
11:33
asking. Well, I'll still be on the side of seatbelts on school buses, but you know, our motto is people rule, so
I'll abide by whatever the people decide. Thank you. Any other questions from the committee? Seeing none, representative McIlroy, I would,
Senator Ricky Hill
Unverified
11:50
I would like for you to pull this bill down and get you a Senate sponsor on here.
Oh, I thought, I, I wanted to make sure we heard everything, but there's not a Senate sponsor Senator Wallace was already on that. I'm sorry, no sir, he's sure not. All right, thank you, sir. I apologize. You don't have to come back and we don't have to hear your testimony again. We just need to get them I want that done before it moves onto the floor.
Speaker 62
12:15
Does that mean you don't love me? No, that just means we're going to follow the rules. Thank you, sir. I appreciate you.
Senator Ricky Hill
Unverified
12:34
It looks like uh we're to the bill now that everyone's here for. And if you have not
signed up, get signed up, otherwise we're not going to hear any testimony from you. So if you're here and you want to speak for against this,
get signed up. I'm gonna call the two of you out right now. Y'all both know. Sign up.
Is there anyone else here? Senator Penzo, we're gonna turn it over to you. SB 258. Thank
Senator Clint Penzo
Unverified
13:19
you, Mr. Chair. I've got 2 people I'd like to come up and present with me. it And please introduce yourselves for the record.
Speaker 80
14:07
Thank you, Mr. Chairman. Senator Penzo. My name's Josh Bryant. I'm from Cape Springs, Arkansas, not the Senator Josh Bryant, the notorious one, I guess, but thank you for having us here today. I'm Katie Butler.
Speaker 82
14:18
I'm from Fayetteville, Arkansas. Thank you. Go ahead, Senator Pennzo.
Senator Clint Penzo
Unverified
14:22
I'm gonna let Josh lead off with this. He can probably explain what the bill does a lot
better than I can get to experts here. There's no point in my words, so. OK And please pull those mics pretty close to you where we can
Josh Bryant
Unverified
14:38
hear. Yes, sir. Thank you, Mr. Chairman. Thank you, Senator Penzo. Again, my name is Josh Bryant. I'm a fellow of information privacy through the International Association of Privacy Professionals have other certifications from them as well in US information privacy as well as global information privacy and artificial intelligence governance as well. The bill in front of you is one that has been copied from a couple of other states, several other states in fact, different states have passed a very similar data privacy
legislation and to varying degrees and there are another dozen that are currently considering data privacy legislation in this, this legislation season. And what we're seeing technology has just outpaced the law. We we had a discussion yesterday where we noted that in 1995 when President Clinton signed HIPAA into law, the health insurance portability and Accessibility Act. When he signed that into law, nobody knew what a Fitbit was, but now we have Fitbits that are collecting vast amounts
of information about how many steps you take in a day and maybe your heart rate and some of your other vital signs, including there are apps now that will take your blood pressure and track your moo. in a mental health application, not to mention all of the other services that collect things like your name and your IP address and your maybe your Social Security number and all sorts of businesses that have that information that creates a risk to Arkansas consumers, and it has created a risk to consumers all over the country and in the absence of federal
leadership, state legislators have been left to try and address these issues and how do we make sure that we protect the personal information of the people. That we represent Just this morning I was signing or checking my son in to be a Senate page and heard the story of a woman whose debit card has been compromised and who used to own a business that was breached that cost them tens of thousands of dollars to recover the data and when they got the data back, it had been scrambled, and who knows how many people were adversely affected by data that
had been hacked and gone through countries where we know there are advanced persistent cybersecurity threats. Countries like China and Russia and North Korea. In Iran and other places that are adversaries to our nation. And so as technology has outpaced outpaced the law, and there's been no substantive federal leadership on this issue from from Washington. States have stepped up and what you'll see in the bill in front of, I'm just going to give you a brief synopsis are things like data minimization requirements. These are what we call fair
information privacy principles that have been around for decades, but they've just not been codified. These are some industry standards or academic standards that have set forth just some basic things that we think businesses need to do in order to keep consumer privacy at a premium and so data minimization is one of those that says, look, you're only going to collect the data you need for the service that you're going to provide. You're not going to collect more than that. There's a section in the bill in front of you called that that deals with purpose limitations that say you're not
going to repurpose the data. We're not going to have a bait and switch here where we say we're going to collect your data so that you can have a flashlight application on your phone, but then we're going to turn around and repurpose it so that we can track your geolocation. movements. All right, and so those are the types of things that you'll see in this bill. Personal data data theft causes causes billions of dollars' worth of economic harm to our economy. There's identity theft. Banks are defrauded. Consumers are defrauded. Credit card companies are defrauded, and money is stolen. And Arkansans are tired of
having their identities sold on the dark web to the highest bidder, and that's what this bill is designed to address, not to mention the fact that we now have artificial intelligence that is not emerging but has emerged onto the scene, which creates additional problems at scale that is unprecedented and so we have to make sure that we are not only governing the data, but we've got to govern the artificial intelligence as well. So if I could, I would like to turn it over to my colleague Katie Butler. She is an attorney. She's also a fellow of information privacy.
She's reached the height of the information privacy field, and I'm going to allow her to explain the data privacy portions. I'll come back and talk about biometrics and artificial intelligence in just a moment. Thank you, Josh. Um, does anybody have
Speaker 89
18:57
any questions so far? you. Thank you. I don't, I don't speak very
Speaker 93
19:04
loudly. I'll try to do better. Um, any questions or anything that we can address for you so far? OK. Um, as Josh said, I'm going to talk about the privacy implications of this bill. The first thing that I
want to address is that SB 258 is not designed to be a burden on Arkansas businesses. So as Josh mentioned, there's 19 or 20 or so states that already have these bills in place. The The entities that will be covered by these bills are already complying with those 19 or 20 other states, and let me, let me give you more information about that. So, There's a specific um application or a non-application for businesses that are considered small businesses under the SBA administration
guidances. So no businesses in Arkansas that meet those SBA requirements to be a small business will have to comply with this law. Um, they're also, also no nonprofits whose annual receipts are less than $15 million a year. OK, back up and tell the committee because most
Senator Ricky Hill
Unverified
20:06
of them are not going to understand what it takes as far as the SBA small business definition on that kind of clarify that for everyone. Yes. I actually looked this up last
Speaker 96
20:20
night because I wasn't totally clear about it, so the small
Speaker 93
20:24
Business Administration publishes this, um. 40-page list of businesses that are organized by their NACS code in AICS code. So if you, when you know what your code is, you can look it up in here, but generally if you are a Let's see here. I don't want to misspeak. And that number will also be on your tax return. Yes
So if you are a Manufacturing company with 500 employees or fewer. Or um a non-manufacturing company with the average annual receipts under $7.5 million. You qualify as a small business. That's That's the kind of summary that the SBA provided.
Speaker 81
21:17
OK, thank you to give a general basic. And if I could speak on that, just, just kind of
Speaker 106
21:23
piggyback in on that. There are 3 different ways that other states have addressed the
Josh Bryant
Unverified
21:32
applicability issue. One is just said, OK, well, whatever your revenue is, say it's $25 million a year. If it's less than $25 million a year, this doesn't apply to you. There are other states that said, well, if you have less than 100,000 Arkansans in your databases and this law doesn't apply to you. Texas came along last year and they when they passed their law, they said that they were the ones who introduced This small business idea and there been a couple of other states adopted since then, and the whole idea there is that as inflation persists and is going to persist. The legislature
would then have to come back and up that amount for a revenue amount to make it equal or at some 0.25 million is going to be a drop in the bucket and it's going to start hurting small businesses or if you say 100,000, all the population is going to increase, and now that 100,000 doesn't mean anything. We need to up it to 1000 or 200,000, so it increases the legislative touch points as time goes on. The way Texas did this they said no, let's just say if you're not a small business as defined by the Small Business Administration. This applies. And if you are a small business, it doesn't. That reduces the number of times you have to come
back and then amend this bill to account for inflation and
Speaker 93
22:40
population changes. So if you're a small business or a nonprofit that does $15 million a year or less in annual receipts this there's only a very small portion of this bill that that applies to you, and we'll talk about that in a second. Um, we also exempt organizations and data at the at the organization and data level, so state agencies aren't
covered. They're exempt. state political subdivisions are exempt, and then we have this is the stuff that's really interesting. If you are regulated by the GLBA. So if you're a bank or financial institution and you're subject to the GLBA. None of your data is impacted by this bill. So not your not your not your banking customers' data and not the consumer data that you might collect to advertise to your banking customers. If you are a credit reporting agency, you don't have to comply with this bill, at least not
the, not the privacy requirements of it. If you have Any association, if you're, if you're a covered entity, a business associate, or your collecting or processing protected health information. You're not covered by this bill. You're also the consumer data that you are collecting to advertise to potential patients isn't covered by this bill, so medical professionals aren't impacted. Um, if you're an educational institution, or any of the data associated with FERPA or any consumer data that
Speaker 110
24:06
you might collect as an educational institution. That's not covered by this bill. And This is a big
Speaker 93
24:13
one. Any data that's collected for investigating, reporting, or preventing fraud or crime. is not covered by this
Senator Ricky Hill
Unverified
24:26
acronyms that you mentioned. Tell us, tell the committee what that means.
Speaker 93
24:29
I'm sorry. The GLBA, the Graham Leach Bliley Act. Uh, and it covers
Speaker 110
24:38
Pretty much everybody who's in the who's within the financial industry. Um HIPAA. Healthcare data, FERPA, um, so education data, I think that was all of them. I'm sorry. And, and to just kind of piggybacking
Speaker 116
24:56
on that, the idea is this is kind of a stopgap bill. If there's already sufficient federal privacy
Josh Bryant
Unverified
25:02
legislation at the sectoral level, then there's no need for us to add to the compliance burden there and further
regulate those companies, so banks are obviously subject to the Graham Leach Bliley Act, which has privacy requirements. HIPPA has privacy requirements. So if you're a health care provider, a covered entity, a business associate of a health care provider. You've already got your privacy requirements. You don't have to. comply with this act. Same thing on the educational side. You've already got that in the federal, the family and educational Rights Privacy Act. So this is, this is the stopgap bill that fills in all those other areas that are collecting a whole bunch of personal information that are not governed by any privacy law thus far.
Speaker 93
25:41
I said that there was a small piece that's applicable to small businesses, and I don't want to hide the ball, so I'm just going to come right out and say on page 18, there's a section called Requirements for Small Businesses and nonprofit organizations. The only thing we want those organizations to do is Make sure they have consent from consumers if they're if they're selling our data. They don't have to do anything else.
Speaker 110
26:01
It's just that if they're selling data they have to get consent. Well I young. Um, 25 through 32. 18.
Senator Ricky Hill
Unverified
26:38
OK, I'm right there where you were just talking about. It just says
here that uh without receiving prior consent from the consumer, a nonprofit. So are they going to have to hold a document forever? If someone signed or what, what kind of kind of elaborate a little more on that. Josh, do you
Josh Bryant
Unverified
27:00
want to go through the consent mechanism? Sure, absolutely. So in practice, the way this happens, it's through electronically derived consents and so there are platforms out there that have been
specifically built to assist companies in collecting consent from consumers like as they're interacting with a website or an application and so what would happen is a consumer would go to a website, they're going to sign up for whatever service or whatever application they're wanting to download, there's going to be a notice that says, Do you consent to our privacy practices, and it'll be a yes or no I. I declined whatever. When you say I accept, that goes into a database of all the consents that have been collected on on that point we can talk a little bit more
about consent because I know there's been some concerns about the lawfulness of processing, including legitimate interests but at the end of the day that's how that is captured. It's not necessarily explicit written consent unless we get into much more sensitive information such as biometric information, and I'll talk about that a little bit more later. as well. This is a good segue for us to talk about what a sale of data is and what
Speaker 110
28:02
it looks like we, we understand that you may have gotten some feedback about this
Speaker 93
28:09
as well, so maybe this is a good time to address this. So, um, if you'd like to look, page 10 line. 21 is where we define the sale of personal data. And um this is a lawyerly, uh, definition. So I, I understand and I'll walk you through it. So, A sale of personal data means sharing, disclosing, or transferring personal data from monetary and this is the lawyerly part or other valuable consideration. By a controller to a third party.
So I think we all understand sort of what a data broker relationship looks like, you know, somebody who's like a marketing company that's amassing a huge databases of consumer data and then selling it to to commercial companies so that those commercial companies can market their goods and services, right? That's a very sort of traditional idea of what the sale of data is. A more non-traditional, um,
Explanation or a more nuanced or more recent is, is this it's and it's really if you think about like the ads that you get on Facebook, it's that, so when you, when a company signs up for a Google Analytics license. They make this deal with Google where they are sharing the data that people give them as people peruse their websites. They are giving that to Google, so the business is collecting data on behalf of Google and giving it back to Goog. Google is using that to build
out profiles about us and then Google is selling that information to other companies so that other companies can advertise to Me, the person visiting the website that I might be interested in whatever they, whatever they sell because I was interested in this other website. In exchange for the business letting Google have that data. The business gets um preferential statistics and analytics from Google. So there's no money ever exchanged in this relationship?
Um, at least not in this like very simple one and it's sort of like intro to Google Analytics. I'm letting you have my customer's information in exchange for Google letting me have A lot of information about who's visiting my website and what they're doing when they're there and where they're coming from and where they are going to so that I can then change my website to um better. Better convert sales on it. So that's what this tricky, tricky part about valuable consideration is is about. It's
the value of Google giving me these statistics and analytics that are helpful in exchange for me giving them data, but there's no money ever exchanged there. So that's why the definition is so broad. And these, um, you know, we've all like, Gone and looked at a jet ski. I And then gotten, OK, fair, but we've all gone and looked at something random, cowboy boots or um horseshoes or whatever and then gotten an ad for it on Facebook, right?
That's how this happens or or we've gotten an ad for it in Google. That's how that, this is the mechanism that makes that happen. And so, so we know that my data about Googling jet skis is valuable to somebody who now knows that they can target me with their. With their jet ski ads, and so, so that's the value that that's the valuable consideration that we are trying to
Speaker 107
31:37
capture here. Let me Let, let me ask, right, so because I understand when you
Senator Fredrick J. Love
Unverified
31:49
say consideration, usually consideration means money. And so, all right, so, but, but what you just explained in regards to, say for instance I go out and I look at a jet ski. So then you're saying Google then. turns around and sells that information and says, hey, you know, whoever the company is, you could target Fre love. So is that why
I'm getting all these ads about jet skis. Is that, is that what you is that example of what you're talking about. Yes, so it's like
Speaker 98
32:22
um Senator Love's jet skis down on the corner. I
Speaker 93
32:25
look up your website and I'm like, yeah, those are some nice jet skis, and then I leave your website and I'm back on Google and I get ads for somebody else's jet ski business. That's the value. Yeah, and so there's no
Senator Fredrick J. Love
Unverified
32:40
money exchange, so there's no, no actually monetary consideration, but there is a value in that. OK. All right. Thank you. And if, if I could.
Josh Bryant
Unverified
32:53
I think some of the objections on the sale of personal data involve just the length of the bill. I know it's a complex and it's a long bill, but for example, one of the things that we've heard is, well, this could hurt fraud prevention, the way this is defined. Well, I'd point you to page 16 lines 7 through 11, where it says data processor maintained for the sole purpose of doing all sorts of things involving fraud or criminal activity. Again, page 16 starting in lines 7 through 11. These are all exempt, OK, so if,
if you are transferring data to a third party and you are getting a service in return that helps you prevent crime or fraud against your business that is exempt. That doesn't doesn't count here. Another one is service provider use. Um, if you look at the definition of sale of personal data, this is one page. This is on page 10, excuse me, um. talking about the sale of personal data. If you go on past 39A and go to 39B. It does not include the disclosure of personal data to a processor or a service provider
saying in California they differentiate between those terms, but we don't, we don't carry that definition over here to this bill, so the disclosure of personal data to a processor that processes the personal data on the controller's half or disclosure to a third party for the purposes of providing a product or service that is not a sale of personal information. It's specifically excluded from that definition of sale of personal information. Another one we've heard is internal data transfers. If you keep on going. in 39B they're on page 10. Go down to line 30 and 31, the disclosure or transfer of
personal data to an affiliate of the controller, OK, that excludes internal data transfers. That's not a sale. It's specifically excludes that from that definition of sale and so we think just some
Speaker 116
34:37
of the complexity of the bill has been confusing to some, but at the end of the day, the called out concerns about
Josh Bryant
Unverified
34:46
this limiting the transfer of data. We think the bill itself addresses that. Any questions on on the sale that we can maybe
Senator Ricky Hill
Unverified
34:56
address. I guess my question on this right here would be. Looks like you've got 19 states. I remember you saying it correctly. Yes, sir, are all 19, do they have the exact same bill, or is there going to be a variation for these companies between every state in
the US There are mild variations among every state. California is kind of define the word mild.
Josh Bryant
Unverified
35:17
What's mild to you may be different than me. Sure, let me, let me see if I can quantify that a little bit, so California's kind of in a league of its own. They do their own thing. The bill in
front of you is modeled on the Texas bill. This is verbatim language right out of the Texas data privacy and. Act the past 2 years ago and went into effect last year. Well, how does Texas compare to Colorado? Uh, they're probably a little bit, right, they're probably a little bit similar. Most of these are modeled on the Virginia bill and so Virginia is kind of, we call it a parent bill, I guess, but then uh Utah kind of does its own thing as well, but Colorado pulled a little bit off of the Virginia bill. Connecticut pulled a little bit off the
Virginia-built. Texas pulled a lot off of the Virginia bill and all of these other states. You look at that like Nebraska, Kentucky, Tennessee, Indiana. A lot of those are modeled pretty closely. To that Virginia bill with their own state contextual issues like Tennessee, for example, they're going to have a whole lot of concern about intellectual property because of Nashville. They do music there and so when you talk about AI legislation in Tennessee, they're talking about, hey, don't use AI to steal a musician's voice and market and pass it off as your own, right?
And so there are state contextual differences. We don't need that level of control here in Arkansas because we just don't have Nashville, right? And so each state does things a little bit different to their context, but This language here is verbatim right out of the Texas Data Privacy and Security Act.
Speaker 142
36:44
I guess my question with that, it would be. How are these companies will keep
Senator Ricky Hill
Unverified
36:48
every state separate. How they, that seems like a lot of regulation. It is. It is definitely a concern. It's less of a concern now because of how similar these
Josh Bryant
Unverified
37:00
bills are. There's been less impetus for a federal bill because of that. I think everybody would much prefer Washington to come out with a ceiling preemptive data privacy bill, and matter of fact, one passed the House Energy and Commerce Committee 53 to 2 back in 208, I guess. 2020 or 2022, unfortunately, the Speaker of the House wouldn't bring that to the to the floor for a vote, because there was disagreements as to whether it was going to be a preemptive bill or if it was
going to set a floor and let states build on top of it, and that was the only disagreement about the bill to speak of. and there have been talks about can we, can we revive that? Can we bring a federal data privacy legislation back and the impetus is just not there. It's lost a lot of momentum, probably at least in my view. Because these data privacy bills really have much of the same requirements on businesses across the board. Thank you. Yes sir. And any other questions we can answer on sale of personal data because I know that was one of
the one of the concerns that's been brought up.
Speaker 93
38:06
Senator, Senator Hill, I can provide just a little bit more detail about what you ask. Yes, about the differences between states. So, um, it's the second page of that handout that you've got, but it's labeled 11, um, this covers those exemptions that I talked about, the ones that we included in this bill are pretty much standard across the industry, but here you can see how the states differ a little bit. So in Colorado,
nonprofits are not exempt. So if you're, if you're a nonprofit and non in Colorado or If you're, if you're a nonprofit anywhere and you're collecting Colorado residents' data, you have to comply with the Colorado privacy law as to those Colorado residents. Does that no, I know what you're saying it's just hard for us as a committee to
Senator Ricky Hill
Unverified
38:50
sit here and digest that were just passed
out to us along with the bill and listen to you at the same time. That's almost impossible. I'm pretty simple-minded myself, so yeah, I know, I understand it's a lot of information. It's hard
Speaker 81
39:03
for me to keep up with it, and this is what
Speaker 93
39:06
I do every day, but um I think maybe going back to what Josh said is there's just like small differences among the states like Colorado makes nonprofits comply. Um, and then other differences like on the next page. are Pretty much everybody offers the same consumer rights that we've offered, the right to access correct, delete. So if a if a business is collecting my information and I want to know what they've collected about me, that's a right to access all of
the 19 states on this list offer that same right. Um, if I access my data from a business and I find out that something is incorrect and I want it to be corrected, the right to correct. 17 out of the 19 states on this list offer that right. And if I could
Speaker 116
39:53
piggyback in on on the comments about the nonprofits in Colorado. Obviously in Arkansas we would not want to force every nonprofit in Arkansas to comply with this, and
Josh Bryant
Unverified
40:02
so the $15 million number that we have in
there came from the National Council of Nonprofits where it, you know, they've shown through their studies that that's the top 1% of all nonprofits in the country operate on less than a $15 million budget, and I think it's actually less than a $10 million budget and so we kind of pushed it up there. So we don't want every mom and pop nonprofit to have to comply with this. That's why we set that really high, high bar where it's only going to hit that top 1% of nonprofits.
Senator Tyler Dees
Unverified
40:35
Senator Deet. thank you. Um, thank y'all for presenting this. Does this apply to campaigns or ballot initiatives, committees at all. So it
Speaker 152
40:48
would apply to, yes, so if if you are that's a lot of
Senator Tyler Dees
Unverified
40:52
that's being collected and owned and used, um, and it's just I don't understand how that
falls into is that a Consider a small business under your definitions, is it considered a data subset that is exempt from this process or not.
Josh Bryant
Unverified
41:06
So those are typically going to be set up as nonprofits. They're not 501c3s, but they'll be set up as like a 501c4 or something similar to that, right? or 501c 6 even. I think there are some other provisions that are different than the 501c3, so
Speaker 116
41:19
those are going to be set up under those for purposes of tax law, and if their annual revenues are greater than 15 million, yes,
Speaker 158
41:27
it would apply. So in, in my own campaign, I, I, I
Senator Tyler Dees
Unverified
41:30
could have data on um Uh, public data that is shared.
From the county clerk's office and all and uh but that wouldn't have different thresholds of of campaign expense under your definition, or it would
Senator Tyler Dees
Unverified
41:47
different a 7.5 million campaign budget, so I'll be under your threshold, but I'd be having this sort of data and I'm just curious, would I be subject to the penalties on page 18, line 32, which I don't quite know a person who violates this section is subject to the penalty under Subsection 4-12701.
Speaker 116
42:07
I didn't know if that would qualify for me, right? So if you sold it, if your campaign then said I want to I want to make some more money for campaign finance, and I'm going to sell this data to somebody else, then yes, you would need consent before you sold that data. Otherwise this is not going to apply to you because first of all you're not a business, you don't have to worry about 7.5 million, you'll be a nonprofit, and then you're going to have to reach the $15 million threshold before I'm not a nonprofit. The campaign for tax
Speaker 90
42:33
purposes would have to be set up as some sort of 501c.
Speaker 163
42:37
is not set up as a non as a nonprofit is an unincorporated
Speaker 106
42:40
association, I guess, then. There's gonna be some, some formal documents, I think um, I'm sorry, say it
Senator Mark Johnson
Unverified
42:55
again. Go ahead. Oh Uh, Mr. Chairman, I believe that I went through this recently because I did get a federal ID number for my campaign, uh, so I didn't have to pay tax on the interest that was earned by the
carryover in the sitting in the bank, uh, but up until that time, it was just me and and as far as the bank was concerned, it was because you have to have some kind of a number when you open the account, as you know, Mr. Chairman, I use my social security number, but I didn't want them sending me a a 1099 for the interest on my. or whatever before whatever it would be. So I set it up as I did, you know, it is a, I did
ask my CPA asked for it a federal ID number. Now, If that's the way it's looked at, then it would be, would I be exposed by the amount of money that I raised or the company that I used to Contracted with to access this data. There are a lot of companies out there and some political parties that provide that uh I probably some other things I haven't considered, but uh I guess it's different in the
aggregate of say every campaign that that company contracts with uh or is it my campaign and Senator Dee's
campaign or whatever that's a little confusing to me. Can you clarify that? Yes, sir, I think we can. So
Speaker 172
44:25
and I will admit I'm not an expert on campaign finance, and so I'm But you do know that
Speaker 173
44:31
we, we disclose that in the aggregate. Yes, absolutely, absolutely in
Senator Mark Johnson
Unverified
44:37
many cases we disclose in the specifics of itemize how much one individual or PAC donated to
Speaker 172
44:43
our campaign. Yes, yes, absolutely, Senator. And so one way or the other, I think you're either
Josh Bryant
Unverified
44:50
going to be set up kind of as a sole proprietorship and that's where you're using your own Social Security number for the purposes of report of campaign finance. In that case, you would hit that $7.5 million annual, so you would have raise $7.5 million annually in order to fall within this the confines of this bill, or if you're set up as a 501c4 or whatever under the Internal Revenue Code, you'd have to hit
the $15 million annually that you've raised in order to fall within this. Now the companies from which you're getting that data would be considered a data broker or something like that, they're going to fall within the small business guidelines. So is it 7.5 million or whatever the NICS code is that's on your tax. return. However, the small Business Administration defines that at the time that's how they
Speaker 106
45:33
would determine. What that threshold level is, but on average that 7.5 million is you'd have to raise to get there. OK, thank you. Thank you, Mr.
Senator Tyler Dees
Unverified
45:44
Sarah, you get your question answered. Thank you. I do have one other follow up, um. I, I love what we're trying
to do here. This is, this is a good consumer idea, and I think we need to pursue this, but I do have concerns because what I understand about studying the Texas bill, which he said this was mimicked after the Texas bill, is that this was a multi-year process to get here. And it was used with all of our state entities and organizations and retailers and
companies of all different sizes to make sure that they had input heard. Changs, tweaks, whatever, you know, there's going to be different things needed in Arkansas that don't apply to Texas and Virginia and Colorado. So I, I agree. I love the idea of trying to make it a blanket, but there's going to be things
that specifically need to Arkansas. And so I guess I, I guess my question is, what work, how long have we been working on this and what's the communication been like with, with some of the larger entities that operate in, in Arkansas. Yes, sure, so we have heard some of the objections and concerns
Speaker 141
46:46
from some of those entities as well. We
Speaker 116
46:49
did. Do an amendment before it got to committee that addressed some of those concerns, the rest of those concerns, we do believe we can address native to the bill and kind of talk to her and just see how internal references within the bill alleviate those concerns, specifically talk about
Senator Tyler Dees
Unverified
47:04
what those what what are you hearing. So let me start
Speaker 157
47:07
with we talked about the sale of personal data. That was one concern that's come up, and I think, I hope that we've
Josh Bryant
Unverified
47:13
addressed that and if we have not to your, your satisfaction, let me know and
I'm happy to go back. I can answer any questions on the sale of personal data. Another one is the definition of consumer health data. The concern is there that it's too broad and it's going to um regulate non-sensitive wellness information from fitness apps, sleep monitors, and nutrition trackers alongside actual health conditions and medical records, and so they want to focus on more of a HIPAA definition rather than the consumer health data. And so there are two things here. First of all, the, the objection is that this is going to hurt small businesses.
Well, we've already talked about how small businesses. are exempt from this, and so it should not hurt small businesses. Second of all, the treatment of consumer health data in the bill is very, very narrow, all right? It only deals with if you're going to share that data get consent, OK, so if you're going to share the information, get consent from the consumer first, and again we talked through that with it being an electronic consent. It's not like you have to have a written document or anything like that, just get, hey, we're going to share it with this service provider. We're going to share it with this other third party already being done today?
Speaker 159
48:19
Consent being announced by the consumer. It is under several private are you talking? I'm sorry, let me clarify
Senator Tyler Dees
Unverified
48:26
the question I'm just thinking about my own user experience when I see accept cookies and I see um, you agree to these terms and I mean that, I feel like that's happening today. And so what, what's going to change in this situation? So operationally probably very
Speaker 116
48:39
little because it can all be done in the same format. When I was talking about some of those data privacy platforms
Josh Bryant
Unverified
48:45
that are out there that help businesses with this, all these things can be baked
into that platform as it built into your website or your application that you're you're providing to consumers, so very little should change there. It's just going to be a matter of updating the language. Hey. You know, do you consent to cookies, and by the way, we may also share this information with these service providers to help us provide the service to you, um, and they could be cybersecurity providers. Hey, we have a cybersecurity agency they're going to have access to this data so that they can, you know, make sure our website is safe and that your information isn't going to get hacked or
maybe we have a third party database. We don't build our own databases, so we go to a company like Mongo or Google, and we use them for our cloud-based databases. We have to share. the data with them. We're just letting you know that. Do you consent still knowing that we're going to share this this health information, um, and so it's specifically designed for that. It's specifically designed to cover What what has been labeled nonsensitive wellness information we think a lot of Arkansas consumers are going to consider that, you know, my
weight. It's kind of sensitive. I'm a little sensitive about my weight. And so if we've got an app that tracks that or my sleeping patterns or things like that, that is sensitive. I don't want you sharing that without, without my consent, right? And I'm not going to sign up for an app that is just going to share it without telling me where it's going. And so it's specifically designed for those purposes, but it's not going to hurt small businesses because small businesses are exempt. Scott. Well, since you mentioned weight
Senator Jamie Scott
Unverified
50:21
and health, my question would be what would be the objection to amending it to include the HIPAA. Language and not just what you're saying. So we could
Speaker 157
50:31
include HIPAA language there. I don't I don't think that's necessarily a big deal, but it is. It's not amending to
Josh Bryant
Unverified
50:38
include it. I think the objection is they want to only be data that is already regulated by HIPAA, so it's not that this that they're asking not or
Speaker 116
50:45
it's not that they're asking expand the definition of consumer health data to include things that are
already governed by HIPA. I think the objection is. No, that's not, that's
Speaker 159
50:56
not protected. That's not sensitive information. Don't require consent to share that information. Does that make, did I answer your question? I think so a little. So, um, the
Speaker 98
51:08
definition of consumer health data is on page 5, line 17. They pulled that light closer to your. At least
Senator Ricky Hill
Unverified
51:13
look at it when you talk to it. Yes. And the feedback that we have
Speaker 98
51:24
seen reduces the scope of that definition. To um identify to data that identifies a consumer's health condition, diagnosis, or treatment. Um, page 5, line 17.
Senator Clint Penzo
Unverified
52:04
And Senator Scott, you were asking about HIPAA, that, that would only cover when
he, when he was saying it's what's protected already, that's your medical records that are with your doctor wouldn't
be what's on your Fitbit, so, um. OK. Yeah. Senator
Speaker 93
52:29
kind of hijacking your question, so I'm not sure if if
you're if if this covers you and your business, but let's just assume that it does and talk about like what that means for you. I know that it's scary to get to the end and see the enforcement under the Arkansas Deceptive Trade Practices Act, but like, let's talk about what it takes to get there before, before we get scared. So primarily it requires that you provide a a transparent privacy notice that says this is how we collect your information. Um, this is what we use it for. This is what we do with it. This is how we dispose of it and and
these are your rights at those, and those are the rights that I kind of summarized a second ago, but I'll go back into it. So primarily it requires that you provide a transparent notice of how you're getting folks' data, and if you're if you're buying, you know, data from a data broker that says, you know, you want to know about zip codes or counties or who lives there and you're going to a data broker and they're giving you that. information, then you'd have a line in your privacy notice that says something like, we collect data from our third party business partners. About you.
It would be kind of that innocuous, um, so that's, that's one of the things that you have to do. You also have to offer those rights that are outlined in this chart, so if I um get an email from you and I realized that I'm in your database. Uh, I have the right to reach out to you and, and, and for you to tell me kind of what data you have about me, that's the right to access. If I see something wrong in what you tell me, I have the right to ask you to correct it.
I can ask you to delete it. And that works a whole lot like your unsubscribe button that's already required under the Canned Spam Act. Um And if you're engaging in that kind of if you're if you're sharing my data with Google kind of in the example that I gave earlier back to the jet skis. If I, if I, if I, and I don't, I don't want you to share my information. I don't want to get Google's recommendations for other jet ski companies. That's the opt out.
You have to get, if you're, if you're engaging in that sale of data, I can go to you and say, man, you can have my data, just
Speaker 106
54:51
don't sell it. And again, that only is if it applies to you to begin with, if you hit those thresholds that we've
Speaker 187
54:56
already talked about, so. Right. There's a few Requirements for special data. Yes, and we'll go
Speaker 159
55:02
into those in in just a minute as we continue to go through some of the objections to the bill, but before we
Josh Bryant
Unverified
55:07
get there, if I could, I want to just call out one of the objections or the concerns
that we've heard is that talking about opting out of profiling, this is on uh 41,220 1. So this is going to be on page 19, um. Starting on line 26, uh, you see that there's amended text there in the engrossed version of the bill talking about solely automated decision that was recommended by others in in Arkansas who had concerns with the original version of the bill and so we were, we asked Senator Penzo to work with us on getting
that one amended and that that one did take place same thing, there was a definition of sensitive data, and so if you look at the That definition there, it's actually be back a little bit, um. In the definitions section that'll be on page. I tell you
Speaker 165
56:00
what I'd like to see us do a little bit
Senator Ricky Hill
Unverified
56:06
as well. I'd like for us to kind of stay in order we've gone from page one
to page 60 to page 3 to 25 we're we're not going anywhere, we're not showing any sequence here to to go through to go through in
Speaker 198
56:25
order, yes sir, we can. I know you're gonna leak some stuff out if you don't, yes sir,
Josh Bryant
Unverified
56:29
yes sir, we'll, we'll do that for, for sure. So, um, on the sensitive data there was concerns about how it was originally worded. We broke some stuff out to make it a little bit clearer and separated finance. data from things like a person's social security number or credentials that could log in or to a to a bank account or anything like that. So we addressed those concerns as well.
Uh, and so there are a couple others that we can, we can go through. We've talked about the lawful basis of processing as well, um. You know, we think the bill natively takes care of that, and we can address that objection when we, when we get to lawful bases. But it skipping over, I'll tell you what, let's do um if if it's OK with everybody, we can kind of just go through general, we talked about the applicability of it. Katie, do you want to go through the rest
Speaker 106
57:12
of the prophecy and then we can, we can talk
Speaker 123
57:16
about the biometrics and things like that. Mm. So Katie, what
Speaker 141
57:28
page are you, what page are we on now? Sure, so let's just move past
Josh Bryant
Unverified
57:32
the definitions that we've we've kind of beat everything else um to death there. I think we're good on that. We can go to um Mccay's talked about the consumer rights and so those start on page 18 at the bottom there on line 36, um, are there any questions that we can answer
Senator Tyler Dees
Unverified
57:49
about the consumer rights that this bill would recognize. it's just, just one quick question. When I think about this VPN network access related to this. If a consumer has their own VPN. Um Network, does that shut down all access to traceability or um consumer data sharing or is is that I'm just trying to think in my mind from a tech side of um
for a consumer if they used a VPN, would that shut out any um shared information to the to the retailer or business. It does not. It just changes the
Speaker 116
58:28
information that that business would get, OK, so in order to use that business's services, they are
Josh Bryant
Unverified
58:33
going to require a lot of times a certain amount of personally identifiable information. So regardless of whether you use a VP and they're they're going to get that. There's other network data that they will also get which will be different because it's going to show that maybe you're coming from an IP address
in Moldova rather than one in Arkansas if you're using a VPN. So all that VPN does is redirect the traffic from one location to another and uses ostensibly a secure portal to route that traffic through. Thank you. Any questions on consumer rights that we can answer. In short, it's we have the right to ask businesses to delete data to correct it, to let us know what they're doing with the
data, and at the end of the day there are still exemptions to that. So for example, if, if you are anticipating litigation or if you have a claim or if there's a warrant or a subpoena for information, and you get one of these requests to delete, obviously we're going to comply with the judge's issued subpoena over a consumer's request to delete that information because they're going to try to hide that from law enforcement, right? So we don't want that that there are exceptions to even applying that, so but for the most part if it's a legitimate request.
Then they would have to delete that and again all 19 states have those same laws, and so these companies are already poised to to to grant those rights to respect those rights, and there have no we have not heard any objection to
Speaker 90
1:00:03
that portion of the bill and granting those rights. So I believe we're
Speaker 93
1:00:10
at the controller responsibilities portion of the bill that's page 23. I went over this kind of quickly with Senator Dees, but this outlines what would be required to be in a privacy notice. You ask
Speaker 81
1:00:27
Why, how, how, how this changes practically when you're already receiving privacy notice and cookie
Speaker 93
1:00:32
pop-ups, so you are receiving those notices because the businesses that you're getting them from are voluntarily complying. There are other businesses are making the the choice to extend these rights to you as an Arkansan that you're not currently legally obligated to have. They're doing that because it is easier for them to streamline their business, to offer the same. rights to everybody no matter where they live than it is to
parse out people based on state by state. So I would consider these businesses to be really good data stewards. They're looking at the laws and they're saying this is the most difficult part to comply with about each one of these privacy laws, and we're going to comply with each most difficult part to ensure that we are meeting our minimum obligations across all of the states that require them, and we're going to offer them to all US citizens and like you've kind of alluded to, they're doing that basically. Of generally your IP address, they're kind of figuring out or having a sense of where you're from, making the choice to offer
you these rights, even though as an Arkansan you're not entitled to them. So the companies that are most impacted by this, the, the companies that I prefer to parse out the data are the ones that recognize that there's a great deal of financial gain that they've got by treating Arkansans different than other other citizens. It's worth it to them to go through the business trouble of having of treating entities within 1 to 8 treating consumers but within one database differently because
the value of my data as an Arkansan is so high to them that they're willing to put in all of these different compliance mechanisms based on where they think I'm. I'm, I'm visiting their website from or they're otherwise gathering data from, so, so the impact is that to the really good data stewards, there's no impact. They are already doing this. And to the folks who want to leverage my data to make money off of it.
They're going to be required to, to, to basically the the online platforms that Josh talked about, they're going to be required to turn the switch on for me as an Arkansan. They're going to have to turn the switch on for the state of Arkansas as well as all of the other states that they have already flipped the switch for. And so I think next, if we
Speaker 157
1:02:52
wanted to go to page 24, this talks about the lawful basis of processing, and there
Josh Bryant
Unverified
1:02:56
have been some one concern raised on this lawful basis of processing, uh, from entities here in the state,
and that is starts on line 10 of page 24, uh, talks about an identifiable good faith and legitimate interest in the processing of the personal data that is publicly disclosed to consumers in that notice that Katie was just talking about and not outweighed by the rights and freedoms of the consumers
Speaker 106
1:03:20
and so the objection here. Yes sir, just for the committee that starts on line 10. Yes, yes, page 24 starting on line 10.
Josh Bryant
Unverified
1:03:29
And the concern here is that the phrase legitimate interest is
borrowed from the European Union and their GDPR, the general data protection regulation there. It was kind of the first data privacy law consumer-based data privacy law that was passed in the world, and the concern there is that it's a little bit loosey goosey. It gives businesses a little bit of ambiguity in deciding what is and is not a legitimate interest. And in the European Union, I would certainly agree with that. However, we've got a much more narrow definition here where we say this is a legitimate interest that you have given notice of in your privacy
notice, OK? And when it in the control of responsibilities we'll talk about in a minute. It talks about the purpose limitation if you've given notice and said, OK, here are all legitimate interests and which why we're capturing this information. And then you decide you've changed your mind, guess what? Now you got to go get consent from those people whose information you have. You can't get it for one reason, do a bait and switch, and I'm going to process it for a different reason. And so what we think this does is actually make it a little bit more business friendly. It gives some consumers the ability or some businesses, excuse me, the
ability to say we're going to process this personal information based on our legitimate interest in providing the service that the consumer has asked for. Can businesses still operate under a consent model? Absolutely, and I think That may actually build some trust with that business's customer base. When we say we're only going to process your information if you tell us it's OK, but consent management can be a little bit of a challenge, and so there may be some smaller businesses that are not small business under the SBA, but so they'd still have to comply with
this that may want to be able to say we don't want that compliance burden of having to capture every individual consent and every revocation of consent, so we're going to give notice. Here's our legitimate interests, and Only going to process the data for those interests, and we're not going to repurpose it from from later things, so are there any questions that we can answer about the lawful basis of processing under this bill. The rest of the bases, sorry, that are there come straight out of the Texas state law that they passed and so that those come straight from that one and are very common across all of the
other 19 states. That one is a little bit different because it's a little bit more business friendly. It allows businesses to process that information for noticed uh and publicly acknowledged a legitimate interest. So questions we can answer on
Senator Tyler Dees
Unverified
1:05:52
that one. Mr. Chair. Yes, is there anything in here when it comes to consumer
consent related to minors versus adults and how that's capturing on data and used on data differently from a minor versus an adult and
how the consumer is, um, in, in this describing or identifying themselves and how a business can and cannot use that info. Yes, so in the bill, data belonging
Speaker 116
1:06:17
of a person under the age of 13 or under is considered sensitive personal information which requires consent.
Josh Bryant
Unverified
1:06:23
So now legitimate interest is out the window. You don't get to claim legitimate interest when you're processing the death of a child, you have to have a parental consent. There is also language in here because we have CAPA, the children's online privacy Protection Act at the federal level that says, listen, if
you're already in compliance with that, you're in compliance with this, OK, so we don't, again, we don't want to add to the compliance burden there, but we do want to make sure that we're taking care of children's data as well, so it it it allows now for state level enforcement of making sure you're taking care of children's data. I'm sorry, just one more, Josh,
Senator Tyler Dees
Unverified
1:07:03
and what you were saying there. So the threshold is 13, so a 16 year old's data. They could give consent.
Speaker 116
1:07:11
Under this bill Yes, they could, and the goal there was to avoid ambiguity and conflict with federal law because the
Josh Bryant
Unverified
1:07:20
threshold at the federal level under COPA is 13. Uh, and so we wanted to avoid any conflict in the federal law there, so legal, a
Senator Tyler Dees
Unverified
1:07:27
legal minor can give consent to a business that they to allow them to use their data to be sold. Yes, they could. Now I
Josh Bryant
Unverified
1:07:33
think at that point parents would still have the ability to come back and undo that if they wanted to, but yes, under this bill, a child would
still have the ability to a child between the ages of 14 and 18 or 17, I guess, would still have the ability to do that.
Senator Fredrick J. Love
Unverified
1:07:52
OK, thank you. In love. Thank you. But so currently they. You're saying currently under the law now. Minors
older than 13 have the ability to sell their information. Currently under the law to to give their, give consent for businesses to
Josh Bryant
Unverified
1:08:08
process their personal information. Yes, that's, that's the current law under the
Children's Online Privacy Protection Act. It is under review in Washington. That is one privacy law that they that Congress seems Comfortable trying to tackle and so that could, that could certainly change and the FTC has put out guidance on that as well, but under current, under the current rules, it's 13 and under are the
Speaker 144
1:08:29
only ones that require parental consent under federal law. OK, alright, thank you.
Speaker 207
1:08:38
And And with this I'm sorry And with this, with this
Senator Tyler Dees
Unverified
1:08:42
proposal, this bill, you still could. I'm trying to follow now too. We're not changing that at all, so still this bill you're saying would allow. A minor Over 14. To still have their data be sold with their consent, even though a minor can't give consent. That's why I'm trying to get my mind around, um, and how this, this is a little confusing there and that's, that's what I'm trying to drill down. Help me understand that there's no changes to what current law is
Speaker 141
1:09:14
or that fixes or doesn't fix for a minor, right? All all it does is say that the that as you would treat any
Josh Bryant
Unverified
1:09:22
other sensitive personal information, so you're going to treat a child's information who's 13 years of age or under, you're going to treat it with the same level of security and respect that you're going to treat my Social Security number as an adult. That is highly sensitive information and you've got to have consent to do that, so you can't process it with under this legitimate basis issue, so we're not expanding the protections that are offered under federal law that can be done and I think
there are some states who've done it and said you need to be 16 or under. There are also some states that have gone the opposite direction and said, if, if you're, you know, 13 or older, you have explicit you have to have the child's consent. You can no longer have the parent's consent. You must. to have the child's consent if you're over the age of 13. I think that's the approach California has taken. Texas and several other states have said You know, the federal, just like they have with HIPAA and FERPA and some of these other sectoral privacy rights privacy laws, they've said.
Hey, the federal government has already issued regulations and written law on children's data. We're going to kind of maintain the status quo there except to say you need to treat that more sensitively than just standard data. So even a child's date of birth or a child's name has to be treated the same as my Social Security number. It's got to be held that sensitively. Senator Dees and
Speaker 93
1:10:39
Senator Love, I certainly appreciate this line of questioning. Um, this age verification proves to be an
incredibly difficult process for businesses turns out, kids are really smart on the internet. And so the way that businesses actually get consent for those for those folks and the, you know, 9 to 16 range, um, there's been consent mechanisms where they've tried to like make kids enter their parents. email address and then businesses email the parent and try to verify consent that way. Kids use fake email addresses or they have access to their parents' email address. I've
seen consent mechanisms that require a credit card number where they do that little like test charge of a couple of cents. Turns out kids have access to their parents' credit card number. So this building in a building an actual Workable consent mechanism for businesses is actually it's, it is actually very difficult. I don't know of a single business that does this well that does this in a way that complies 100% with CAPA. It's a very, very difficult, and so,
While I would love to see everyone who's 18 or, you know, 17 or under have to have parental consent. The, the burden on businesses is very is very high for 2 to to increase that. Any other questions? And I will call out
Josh Bryant
Unverified
1:12:15
that the General Assembly has passed other law here in the state of Arkansas that specifically
addresses children's use of technology, so social media bills and adult websites and things like that, those are already in place too, aren't those bills? Don't you agree with
Senator Tyler Dees
Unverified
1:12:28
those? We agree with those bills for sure. I think my son, my son behind me my, my son behind me would
Speaker 215
1:12:34
love to have his cell phone in school. He's already, already, already
Speaker 198
1:12:37
mentioned that, but I think that's a good bill. I'm glad. I'm glad. Is he sitting here sha? his head behind me, I think so. So, but I think that's a good bill. I appreciate your pass. We may have to move back to the legislative body.
Senator Clint Penzo
Unverified
1:12:53
Um, I might add, uh, Senator Des you brought up the ages, um. If, if it gathered support from this committee, I would be happy to raise that age up more. We were just looking for a path of least resistance and not changing that section, but I'm perfectly fine with the men and the legislation to increase that age of consent. Which I'm sure. You would agree
Speaker 74
1:13:17
with, yeah. And I'd be against, so let's put it.
I said I would be against it, so that's split that didn't accomplish anything and that's why that's where it's
Speaker 198
1:13:32
at. So I think for the rest of this that there are no other questions, let me try to speed through this. I know we've been talking for a while, the rest of this, this, the
Josh Bryant
Unverified
1:13:40
section of the bill or this subchapter. Talks about control of responsibilities. These are people, people who have collected the information and they're the ones doing the processing, right? They say you're not going to use dark patterns, OK, a dark pattern is where have you ever tried to unsubscribe for something, then you get a screen that says, Are
you sure you want to unsubscribe? and you say yes, and then you get another one. I said yeah, but you're going to miss out on this 25% discount. Yes, I want to unsubscribe. Well, I'll tell you what, I'll give you a 50% discount. Would you please unsubscribe me, you know, if you click through that multiple times. That's a dark pattern and those would be prohibited. Data minimization we've talked about where it's only collect the amount of data that you need and keep For as long as you need it. Don't collect more than you need. Um, the next purpose, uh, next section there is on data security. Arkansas already has some data security laws, so we didn't feel like we needed to write a whole bunch here, but it's basically you need to put, considering the state of the
art, you need to put proper administrative technical and organizational controls on keeping the data secure, so make sure you've got good passwords, make sure you've got multi-factor authentication. A lot of organizations because of the sensitivity of a data breach, already have these things in place. Purpose limitation like we talked about. This is on the bottom of page 26, starting on line 28. Purpose limitation just says once you have declared the purpose for which you're going to collect data, no bait and switch, OK? You don't get to use the same data for a different purpose without getting consent of the
consumer, um, moving on to, to page 27 starting on line 8. This talks about the sale of data. This just says that if you're going to sell information, you need to disclose that and you need to give people the right to opt out of it. That's all that does. And again there are privacy platforms that automate that process. Uh, starting in Section 308, they're on on line 15 of page 27. This is talking about data protection assessments. A lot of organizations already do this. They certainly required under every other privacy law that's out there, and we've heard no
objections to this section, but in essence you have to put yourself this is a very simplistic way of doing this, but you need to put yourself in the shoes of the consumer and ask what are the risks? What are the risks to the consumer? A lot of businesses are going further and saying, well, what's the risk to the business by processing this information? Is this going to cause me harm? Am I not going to lose consumers or what's the risk of a data breach here. So these data protection assessments are designed to be done on processing activities only those that are high risk. It's not like every application you have or every database you have, you now have to do one of
these data protection assessments. is again straight out of the the law in Texas, but for example, if you're going to process personal data for the sale of targeted advertising. You need to do a data protection assessment on that to make sure that you're respecting consumers there. If you're going to sell the data, if you're going to process it for the purpose of profiling, you're going to conduct a privacy risk assessment or data protection assessment there. If you're going to do any kind of sensitive data, OK, so now we're getting back into the children's data if, if you're going to
process that information or any other sensitive information, you have to have one of these data protection assessments if you're going to do anything that presents a heightened risk of harm that you identify at a smaller scale you need to do, you need to identify and do a data protection assessment on anything that presents a heightened risk of harm to the consumer, um. And then later on as you've done these things, if there's a problem and the Attorney General is investigating, the Attorney General would have access to that so that they can see, OK,
what have you done to try and mitigate these risks, and then the Attorney General would would be able to then determine if there's been a violation of this act. Um, the rest of this kind of gets a little bit technical if you go to the bottom of page 28 on pseudonymous data basically provisions in here talking about pseudonymous and anonymous data say, hey, look, as long as this information can't be tied to an individual. If you've got a, you know, technical controls in place that segregate that data from other data that can be tied
to an identifiable person, then this doesn't apply. You're OK there. Or if it's truly anonymous or truly pseudon, truly fake data. This doesn't apply to that. And businesses should actually be encouraged to use pseudonymous or anonymous data. You can do a lot of analytics, a lot of reporting without actually having to identify a person, so this kind of encourages that, uh, and then, um, the last section there under control of responsibilities really starting on page 29 at the top, um, it's just basically
saying, don't um Don't process that in violation of state or federal law. No big deal there, and don't treat consumers differently just because they've decided they're going to exercise one of the things, one of these rights, and so the idea here is, and there's a waiver provision in here as well that says you can't contract away your your information privacy rights. You can't be treated differently because you've decided to. That doesn't mean that you're going to get the same services, you know, listen, I have to have your name in order to and your address in order to ship this
good to you. If you're not going to give it to me, I can't do that. That's OK, but we can't retaliate based on somebody's decision to exercise one of their privacy rights, so and when we talk about a controller again, we're talking about the person who is collecting the For their own purposes. So are there any questions that we can answer about processing processor responsibilities. Center. Thank you. So with the 19 in the
Senator Fredrick J. Love
Unverified
1:19:01
19 states have you, have you heard of any of any retaliation or retaliatory tactics. I'm not aware of
Speaker 115
1:19:09
any, um, I will certainly say the first of
Speaker 116
1:19:12
these laws that came into the United States was in 2020, so a lot of these are still in the if there have been has been litigation on it. There's still very much at the trial court level. There hasn't been a whole lot
Speaker 159
1:19:26
of Appellate litigation to give us case law on that,
does it happen? Yeah, probably so. I think it
Josh Bryant
Unverified
1:19:34
it probably happens, but it's, we also want to make sure that businesses are not discouraging consumers from using. These data privacy rights. OK, thank you. OK, go ahead. All right. Next section there is talking about process of responsibilities and when we talk about a processor, this is a business who says, hey, we're a specialist in this particular field, so we are going to sell you a service and
we will process this data for you, OK? So the controller collects the data and decides what to do with it. The processor just helps them in doing that, OK? So an example of this may be I'm not a database specialist. I have a business and I'm collecting this personal data, but I don't know the first thing about running a. database. So I go hire Google Cloud platform to provide my my my database or I go hire MongoDB or I go hire IBM through their DB2 product to provide this database for me. They are then a
processor, OK? Or, uh, perhaps I'm not a cybersecurity expert. I want to outsource my cybersecurity operations, so I go hire somebody to do that and they're going to have access to some of this information and and make sure that they're keeping it safe, so when we talk about a processor, they don't have all of the obli ations of a controller because they're not the ones who are deciding what to do with the information, but they do still have some obligations. So for example, they have to comply with contractual obligations that they have with The controller. The controller's going to tell them in a contract what they need to do with the
data, and they need to comply with that. Um, they, they also need to include in that contract things like, hey, we're going to help you with these privacy risk assessments. We'll tell you what we're doing with the data you've given us so that you can conduct your data privacy, uh, your data protection assessments, um. It will do things like tell them that they have to also have a notice of privacy practices. So for example, um, As a processor, they need to be able to say we're collecting this information and we're using it for these purposes to help other businesses do X, Y, or Z. They just need to put that in a
privacy notice as well, um, you know, they need to minimize the data that they're collecting as well. Uh, if I'm hiring a company to to just manage my data. They don't also need, you know, I don't need their social consumer Social Security number, then the processor that can come in and say, oh well, we can't do this without their Social Security number. No, you don't need it. I I'm telling you what we're doing with this data. This is all you need it for. I'm not going to go collect consumer Social Security number as well. So that talks about data minimization as well. They have to keep it secure as well. There's that a security
requirements. They can't repurpose the data, so when the controller says, Here's what you can use the data for. They can't take that data and go use it for something else. They have to use it in line with what the controller tells them to do. They have to have a data retention schedule that says at the end of their contract or when the data is no longer needed, they're going to delete the data and then they have to assist controllers. in honoring those data data privacy rights. And so for example if if I've given my, my personal information to Company A, and they give it to Company B to help them process that
information. I'm not going to go to Company B and say delete this information because they're not the controller, they're the processor. I go to Company A. Company A then has to go to Company B, to whom they've given the information, and they have to try and then Pull it back and follow the controller's instructions there. So far fewer obligations on processors, but mainly because they're only doing what the controller tells them to do. Any questions that we can answer on processors. Or Katie, if you have something extra.
Speaker 106
1:23:08
Go ahead. OK, very good. So let me talk about biometrics. This is on page 33, starting
Josh Bryant
Unverified
1:23:13
on line 19. We did have one concerned with biometrics, and they would, there are some people who would like this pulled out biometrics is a very, very special type of information, all right, all of us in here probably have cell phones. If you have your cell phone, you can pull it out and it's going to scan your face. It'll create capture a facial geometry, and it gives you access to your phone, and then on your phone you also have additional. apps, so maybe you have your
bank account or your health care provider. They have what they call pass keys, and you can set it up to where you can only access that app after it scans your facial geometry. So when you think about biometrics and how it's used today. It's like a password you can't change, right? You can't change your facial shape. I know I would like to, but I can't do that. You can't change your thumbprint. You can't change your retinal scan. These, these are very, very sensitive pieces of information, not because they are your Social Security number or your password. It's a
password you can't change, and it's going to get you access to an awful lot of stuff, OK? The second reason why this is so sensitive is we have adversaries in this country. That live in surveillance states. They are a surveillance state and facial recognition, matter of fact, I read a paper not a year ago, facial recognition is one of those things that works really well at one level. So if you're staring at an ATM machine or at your phone, it works, but if you move your phone up here, it doesn't work work real well. Well, researchers in China have
figured out a way to say I can capture your facial recognition at an ATM machine that you're looking down at. And I can transfer that to the security camera on the top corner of the building looking down at you and so now that is a huge surveillance state problem, and I know a lot of these adversaries, our attorney general has has sued companies that are housed in those those countries because they're doing things with our personal information that are bad for Arkansans and bad for Americans, and so Biometrics need special attention. They need special
protection, and what this bill says, first of all, biometric data is sensitive personal information, so consumers have the right to opt out of its processing. Consumers need to have notice that their their biometric information is being used. This goes a little bit further and says, listen, If you're going to process biometric information, you need to get explicit consent, and that explicit consent needs to go a little bit further than the regular consent that we've been talking about. It also needs to state here's how long we're going to keep the information, and by the way,
After we don't need it 3 years later we must delete this information. You have to delete that that biometric information, all right, so it just treats it a little bit differently now some of the concerns that have come in certainly. At least intimate that the or at least suggest that their concerns are with things like crime prevention, OK, if you walk into the store, they're going to have security cameras and those security cameras may have biometric filters on them that allow you to capture that biometric information, um, because we've already exempted
all information from this chapter that deals with preventing, investigating, reporting, prosecuting crime, that type of data is not going to apply here, OK? um if if the the use base of the biometrics is in HR data, for example, we want to use a thumbprint to clock you in and out on the job. We've already exempted employee and commercial use cases. This is only on a consumer use case, so this is really capturing a pretty narrow use case. It's not a ubiquitous use case of
biometrics, but all it's saying is that in those limited use cases you've got to have consent and you have to delete it 3 years after you no longer need it. Is there any questions that we can answer on biometrics. Texas also treats their biometric data separately, both they treat it separately from their data privacy law and within their data privacy law. This kind of just pulls it all into one place and says let's just address all biometric use in one place rather than have two separate acts to cover it.
OK. There's no questions there. The next one is artificial intelligence. Again, artificial intelligence has the capability of Taking the problems with data privacy and data security and compounding them at scale because it operates so much faster. A and and doesn't necessarily require humans in the loop to to to do these things. And so the important thing that you need to know about this bill in terms of artificial intelligence is that it only regulates high risk artificial
intelligence systems, OK? Your chat GPTs doesn't apply, OK? It doesn't apply to chat GPT. It doesn't apply to you know, clouded or whatever, it only applies to these high risk systems. Now how do we define that? OK, a high risk system is a system where the computer is going to make a legally significant decision about a person, OK, that includes is the person insurable is the person eligible for a loan is the person employable is the person eligible for bail.
I don't think it's being used for that in Arkansas, but OK, is the person eligible for bail or should they have a certain sentence over another sentence or whatever the case may be. So there's only a handful of What we'd call highly sensitive or high risk situations and use cases of artificial intelligence, and then the bill doesn't say no, it just says, look, in your model card, which artificial intelligence companies are already creating it's saying you need to include some answers to some real basic
questions such as how can this AI be used? What data did you use to train the system? What can't this system do? What's the purpose of this system? How does, how does it help achieve a problem or fix a problem. However you tested it, how is it monitored? What are the foreseeable risks? All you got to do is answer those questions in the model card that you're already creating. Do your risk assessment. Deployers then have to have some sort of risk management framework that they use to mitigate the risk of these artificial intelligence systems, OK, uh, there's no need
for businesses to reinvent the wheel here. We have the nest, National Institute of Science and Technology. They have an AI risk management framework. This bill basically creates that as a safe harbor where you can go and say as long as you're you're following the AI risk management framework, you're fine. There are, there are others out there as well, but this is the one that I've been trained in, and then you need to give notice to the consumers that you're using AI to make these decisions and give them the right to opt out of that, OK, if I'm applying for a loan or a farmer is going to a loan or going to the bank to get a loan so that they can get seed
for the next year or if I'm wanting to buy a house, I need to know that an AI system is making that decision. And I should have the right to tell the bank, no, I want a human making this decision, not a computer, or I want to know how the, how the system came to that, and I don't want to be in a situation where they can say, oh well, the computer made the decision we shouldn't be liable under the Fair Credit Reporting Act or anything like that. So all we're saying is in this bill, which has been passed by other state legislatures. It was put together by a team of 13 state attorneys general from
across the country and other other folks that they brought in to kind of speak into this. You're saying in those high risk use cases, make sure you're mitigating risk. Make sure you're testing it. Make sure you're giving people notice and give them the right to opt out of it. Um, so are there any questions on the artificial intelligence piece. That we can address
Speaker 116
1:30:55
Nothing there. All right. Last one is enforcement. The the business objection to data privacy bills ubiquitously across the United
Josh Bryant
Unverified
1:31:01
States has been don't give people a private private right of action. There is no private right of action in this bill. The Attorney General is the only one who can enforce it. Um That we had additional information in there. We ran this through the Attorney General's office. They came back and said, Look, just make it a violation of the unfair deceptive Trade Practices Act. That means there's a $10,000 fine or up to a $10,000 civil penalty per violation, and the
Attorney general will have broad discretion to use this. The Attorney General's office is a great. resource and great tool for enforcing this bill because they're doing what they can with what they have. The unfair and deceptive Trade Practices Act was not necessarily designed for this context, but Attorney General Griffin is using that right now, and they have sued companies like Timu and TikTok and Google and a handful of other companies, Ford and General Motors just last week, not General Motors. It was General Motors and OnStar just last week trying to protect
Arkansans' data under that construct. This is going to be just another arrow in the Attorney General's quiver. Hold businesses accountable to make sure they're using personal information adequately, so any other questions we can answer about Attorney General enforcement. Any questions
Senator Fredrick J. Love
Unverified
1:32:18
from the committee? Central. Thank you, Ms. So, Our big picture now, so. Basically,
Oh What are, what are we trying to do big picture with this bill.
Josh Bryant
Unverified
1:32:34
I would say the big picture is twofold. Number one, give Arkansans the tool to protect themselves, OK, that's through the data privacy rights that they have the right to delete, the right to know what businesses are processing about them. So give Arkansans the ability to do that and make it an enforceable right that they have. Second of all, we also need to understand that again these things protect some national security interests that we have against these advanced
persistent threats, criminal hacker groups that are highly organized all over the world who are using personal information of Arkansans and Americans. nefarious purposes and we believe this bill does that. It protects against the compounding of those problems through the use of artificial intelligence and high risk situations those are the two primary goals, OK, for me, OK. Can I have one more? It's um to
Speaker 93
1:33:23
give the Attorney General the opportunity to go
after companies in a broader scope than just the ADT, the Arkansas deceptive trade Practices Act. So right now he's limited to only being able to pursue folks when they've acted with um fraud or deceptively rather than just like negligently like they've made the business decision that it's less expensive to not protect. private information then and risk a lawsuit or risk a data breach. So this gives the Attorney General the opportunity
to go after folks kind of proactively or that have just negligently kind of abandoned their responsibilities over data. OK.
Senator Fredrick J. Love
Unverified
1:34:08
Now, now we heard in, in some of the exchanges that hey, some of this is already being taken care of. I mean, Um, so, so tell me, I mean, with that being said, how it currently works, I mean. What is, what is, what is going to change? So
Josh Bryant
Unverified
1:34:30
I, I would say for businesses that are already required to comply with other state laws, very little except that now this is going to be an enforceable right that Arkansans have, and let me give you an example. There's a business in Arkansas that is a data broker, um, I filed with them a request to know what information they had about me. They didn't have to honor that because I'm an Arkansas resident and I don't have this right right now, but they did honor it because they have a global privacy practice in their organization. And I found 88 pages of information that they had about
me from what car I drove when I was 17 years old to what grocery stores I go to and buy, and then I ask them to delete that data and they honored that one as well. So those who are already subject to these laws in other states, very little is going to change for them for Ta Kati's earlier point for companies that are Distinguishing how they're going to treat a consumer based on where they live, whether they live in a state like Kentucky or Texas or Tennessee that has a data privacy right, they're going to treat them differently than somebody who lives in
Arkansas who does not have that right. That what's going to change is now they're going to have to flip that switch for Arkansans. They're going to have to say, yes, we're going to start complying
Speaker 106
1:35:42
with these requests. So those are, those are the two. Two contexts in which
Senator Fredrick J. Love
Unverified
1:35:48
I can see that changing, OK, well then I guess one of my final questions to you will be out of the, out of the people that had objections or the groups or organizations that had objections, um, to, I guess,
parts of your be all, how many, how many operate in
Speaker 221
1:36:08
other states. Of the ones where I can name the organization, every
Senator Fredrick J. Love
Unverified
1:36:12
one of them. Operating in other states that have a bill that
Josh Bryant
Unverified
1:36:15
has passed. Yes sir, and some other countries that have similar data privacy bills like Europe. China has a data privacy bill, that they'll holding force against their citizens but not ours, but yeah, they, there are global companies that operate in all of these different nations and states
Speaker 90
1:36:28
all over the country that have these privacy laws that are and they're already
Senator Fredrick J. Love
Unverified
1:36:34
subject to them. OK, all right, let me try to get an
understanding. So some of the companies that had objections to this bill. operating in other states. That already have this bill, so they're complying in other states. They're just So, but they have objections also. Yes, to some of, some
of the language they do have objections to that
Josh Bryant
Unverified
1:36:53
and or concerns with it and again I can't name all of them because some of them, you know, came from lobbying groups and I don't know who that lobbyist represents, but of the ones that I know I can name,
they operate in at least one if not all of these states that currently have data privacy laws on the books. And some of, some of which is verbatim, you know, they're concerned about language that was verbatim copied from the states to which they're already subject. OK. Thank you. Mm. Any other questions? Senators, I appreciate your patience in going through this complicated bill. I'm happy to answer any other questions and
Unknown speaker
1:37:38
with that we can turn it over back to Senator Penzo and. See like Seeing no other questions. Thank you for your testimony. Thank you very much.
Senator Ricky Hill
Unverified
1:38:10
Sandra Penzel, you can stay, stay here if you want 2 cents,
Renzo Soto
Unverified
1:38:27
you'll be clothing. Please introduce yourself for the record. Yes, sir. Thank you very much. My name is Renzo Soto. I'm the executive director for Texas and the South for TechNett. We are the national network promoting the growth and continued advancement of the innovation economy at the 50
state level as well as the federal level. We represent 96 different member companies of all sizes operates here in Arkansas as well as throughout the country and throughout the world in a wide range of different fields from AI to cybersecurity to the gig and sharing. economies to education and much more. So as you mentioned, I am here respectfully opposed to Senate Bill 258, and I do want to start by saying greatly appreciate Senator Penzo as well as the experts, Mr. Bryan and Ms. Butler, for laying out the
case for data privacy. We completely agree with the intent of the data privacy provisions that are within the bill, our members do, uh, as well as the the entire industry at large places a high priority on consumer. privacy on consumer data protections, consumer data security, and they take many actions to deliver just that, which is why we agree with the intent of that portion of the bill, but I do want to note that we have concerns with Senate Bill 258 because it is a massive and consequential piece of
legislation that presents comprehensive regulations, not just on data privacy, which, as you've seen through the very, very lengthy discussion on the layout of the bill impacts, you know, not just the tech industry, but really every industry that has some kind of digital platform, and digital presence, some kind of online presence or digital tools that they use or that consumers interact with and we were also concerned because we think that it's going to lead to massive potential unintended consequences for consumers and importantly as well for
businesses in Arkansas or that operate within Arkansas and so I think it really stems from and we want to be clear, we do understand that A number of the data privacy provisions were pulled from legislation like in Texas, but the data privacy provisions within Senate Bill 258 are not the Texas law. It is not identical that bill took You know, passed in 2023, implemented and effective by 2024, but conversations on that piece of legislation really started in 2018 to 2019. They
were extremely deliberative and intentional conversations because it expanded so widely and impacted so many different industries and so many different people in the state as well as folks who interact with Texas businesses from outside of Texas, and as has already been laid out, there are several provisions within the bill that do not align with the Texas data privacy. and Security Act. The biometrics provision, for example, the consent provisions or what was referred to as the law, the lawful processing provisions the
processor duties as well. Those use language that are not pulled from the Texas bill, and while it was noted that, you know, for example, a lot of good actors, good stewards of data already implement this. The reality is for businesses when you implement it in a way that is not interoperable with laws like those passed in Texas or in 18 other states where there is an interoperable data privacy law that leads to a very conservative interpretation of the words that are on the page and from a legal standpoint that
means, you know, for example, with the biometrics, the protections that are afforded with these specific provisions within Senate Bill 258 as it as it relates to a special type of data, um, it is redundant of the way that it is handled throughout the rest of the framework. Texas, the Texas law, for example, already. manages biometric types of data through a consent process, but because there are outlined provisions within the bill that differs from the way that it is outlined in the Texas law from a regional basis and from a
compliance basis that would mean a conservative interpretation, which would mean that the existing regimes for data privacy and data security that have already been implemented by these businesses who may be complying with that Texas law is not going to be sufficient to comply with with the language of the law as it's currently. proposed for Arkansas, so what does that mean for businesses? It means higher compliance costs. It means confusion in terms of what it really means to be in compliance with this bill, Senator Scott, you asked about,
for example, the consumer health data provisions that are within the bill because it would expand that, right, because it expands that, that would mean that the regimes that are for the HIPAA compliant data that would need to be expanded to fit into, you know, some of that data that might not already be covered, so that's an added cost to business, but Senator Dees, to your point of, you know, you've seen businesses who do provide, for example, like the cookies or the opt outs related to that type of data, they are doing so in relation with how they're
interpreting kind of the regional data privacy frameworks that already exist. If you start laying that out in a prescriptive manner as Senate Bill 258 does, then you then come up to that interpretation issue that I mentioned, which would mean again those best practices that companies rely on to meaningfully comply with this and provide those consumer data privacy rights, those can be those could possibly not be sufficient to comply within the state of Arkansas, which would make the state really an outlier and the only state right now of the 19 states with an inter or with a
comprehensive data privacy law that is an outlier from the rest of them is California, and we've seen massive, massive costs on businesses all to really provide around the same type of rights that are afforded from that are afforded To the rest of the states to in line with what is provided to Californians. Um, so we do want to work, I want to note that we did take a look at the bill to assess possible amendments, for example, but because, you know, we've not seen this type of approach
before where a comprehensive data privacy bill has been taken up together with a comprehensive AI bill in a single large bill. We really weren't able to find streamlined fixes to address. All of the concerns with the entire framework as it's currently proposed. We do want to work with the legislature. We want to work with Senator Penzo possibly in the interim to address data privacy protections for the state, as has already been mentioned, you know, models like the Texas Data Privacy and Security framework that provides very strong data protections
while allowing for companies to meaningfully comply without too much regulatory burden without too much compliance costs being afforded to them. Um, and then also on the AI side of the bill, we would encourage the legislature to really first take a deep dive and study the issue because there is no model legislation on that side of on that side of the bill, the potential for unintended consequences we think is extremely significant, and although it was brought up in testimony that this is based on other state models. I'm going to interrupt you just a second.
Speaker 241
1:45:28
You just said there was no. No, nothing out there for artificial intelligence as of right now. No, not at the state level. And obviously there's nothing been passed at the federal level
Renzo Soto
Unverified
1:45:40
either. OK, thank you for that. Thank you to clarify that, uh, the provisions within Senate Bill 258 right now borrows from the Colorado AI Act, which was filed last year 40 days before they adjourned Saida. It was tracking Connecticut legislation. It was Senate Bill 2 in Connecticut, and there was no stakeholder
process when that bill passed in Colorado because every change was being made over in Connecticut was then being replicated over in Colorado until the Connecticut bill died, I think around the last 5 or so days of session after which Colorado passed it and in the signing statement, Governor Polis stated that although he was signing the bill, he instructed the legislature to work with stakeholders over the interim through the Colorado AI Impact task force, as well as through the rest or at least the beginning of this year so far to implement fixes to the to their.
state's law. Those fixes have not been filed yet. We don't know what those look like, and so you're really borrowing from an untested framework and underlying all of that, even though the Colorado bill was signed into law, it's not in effect until 2026. And so from a legal and from a compliance standpoint, we don't know what this impact is going to have on responsible AI development and deployment within the United States because we have not seen that anywhere within the country. Um, and I want to underscore, you know, I, I understand, you
know, the points that were made about the concerns with AI and that possibly exacerbating the concerns with data privacy, you know, I think that the underlying data privacy models such as those in Texas they do cover data that is used for AI. However, if you're doing them in conjunction with one another, you are risking a situation in which there is no guaranteed certainty from the you know, folks who develop AI, who deploy
AI, which by the way is a very expansive term that can that that that captures not just people who are taking an AI system and then maybe outfitting it into a specific use case. It also impacts businesses who just have some type of AI system. that they might be using. You are capturing them without any type of reasonable certainty on, you know, how should we be treating people's data first. What does that look like in terms of liability and expectations and complying
compliance for us before they then start using, you know, these AI systems, these AI tools, and we think that risks, you know, the, the adoption and the adaptation of these, these really powerful technologies and could set Ark. saw back competitively from from other states who do not have legislation like this or who have not proposed legislation like this yet. Um, and so, you know, on that end as well, we'd be willing to serve as a resource to look to the legislature to discuss AI, to study the issue, talk about
maybe some of the state specific contexts because, you know, there are a lot of underlying laws that have been passed over at the state level as well as the federal level, for example, anti-discrimination laws that apply to applications within AI systems, particularly where there is a human in the loop or where there's a human involved, and so really we just want to make sure that there's no unintended consequences both from the data privacy side as well as the artificial intelligence side. I know that was a lot, but I'd be happy to answer any
Speaker 241
1:48:59
questions that the committee might have. Questions of the committee.
Senator Tyler Dees
Unverified
1:49:07
See. Sara, thank you. Just real fast. Thank you for your testimony and it was technet, right? What was your involvement or your organization's involvement with the Texas legislation. We supported it, but, but tell me about the the how it works, you said from 2018 to 2023, where was your engagement organization from that timeline. Yes, so, so I'll be candid. I only started with the
Speaker 246
1:49:33
organization in 2023 myself the organization, yes, we
Renzo Soto
Unverified
1:49:38
were involved in negotiations and conversations. in, you know, crafting here's what are for example some of the crucial exemptions that are being included when the Senate Bill 25, to make sure that there's no, you know, confusion between the federal laws or state laws that might exist. We provided technical recommendations and so we were really involved all the way through, which is why we were proud to be able to support it at the end of the day. Thank you. So how close is this bill to the Texas bill? I think with some targeted improvements on the data privacy side, it could, it could get there. However, you
know, as I mentioned, it's in conjunction with the AI regulation, it's, it's pretty far from, from just the Texas data privacy and Security Act. OK. Because I was under the impression it was in Senator Penzo, you
Senator Ricky Hill
Unverified
1:50:21
can nod yes or no, that this was real similar to Texas. OK OK, so yeah, that's what I was gonna
Senator Fredrick J. Love
Unverified
1:50:32
ask so. Is it, is it, is it far or just
From the AI standpoint, or are you saying it's just Apples and oranges, even if, if you exclude the ARP. How close is it to the Texas bill because I, I If I, if I, if I'm hearing you correct, it's the Texas bill didn't take up AI. Is that, is that what you're saying?
Renzo Soto
Unverified
1:50:58
Well, it doesn't take a comprehensive AI regulations, but as a part of data privacy because you know, data is an underlying part of AI systems. It does include it in
Senator Fredrick J. Love
Unverified
1:51:09
the data privacy provisions. OK, so as far as the data privacy portions, are you saying that the the the bill here is similar. Arkansas,
Renzo Soto
Unverified
1:51:19
I think there can be some, yeah, there can be some targeted improvements that are made to address a lot of the broader concerns, but again it comes down into, you know, the redundancy, for example, of some of the more Yes, kind of like the European language that's in there, the redundancy of what that the Texas law, the underlying Texas law within Senate Bill 258. What
that seeks to do combine together with that, I think would introduce significant confusion, and so we would have to take a really good look at Understanding what are the underlying protections that are really being prioritized here, making sure that those are in line with what is in the Texas law in terms of what's allowed from a regional compliance perspective so that businesses, you know, don't have to implement entirely new regimes just to comply with just within the state of Arkansas alone.
But, but we can, there there are targeted improvements to answer your question that can be made. I think he's saying they could work together to make that. Come
Senator Ricky Hill
Unverified
1:52:20
together a little bit better than what it is. Am I saying that correctly? So, so that the um there there are ways apart
right now that they could probably work together and get to where they need to be to be similar to Texas. OK. Um, That's it. Any other questions?
Thank you for your testimony. Thank you, sir. And speaking for. Yeah, you know who you are.
And please introduce yourself on the record. It's been my whole life. I didn't know. I
Speaker 256
1:53:10
didn't think the Capitol would be any different. I was trying, but I just didn't
Amar Jabereen
Unverified
1:53:15
want to slaughter your name I didn't want to give you a hard time about it, so my name is Amar Jabereen. You dropped the cu just for fun, so you said amar Amar, sir, and uh first of all, I want to thank you all for giving me the opportunity to speak on behalf of for this bill, and I am representing myself as an Arkansas resident and a privacy professional and a mother of a 13-year-old Arkansas resident, so So, um, it really spoke to me when you all brought up your concerns about 13 having the level of consent. I'm like my
daughter can't even unload the dishwasher without me refinding her, you know, a couple of times a day. Please pull it a little closer to you, sir. So what I wanted to bring up today was that what this bill does is it really brings privacy best practices to protect the Arkansas residents, so As stated earlier, you know, we do get to see the browser notifications of, hey, we're using cookies. This is how our data is being used. These are
benefits we get because other states lobbied and really worked hard to get those rights for their residents and so as a privacy professional, it always kind of breaks my heart just a little bit that I have to fight for other people in other states, but I don't have that own right, and then my own la, my own daughter doesn't have those those rights, right? And my friends and family and your friends and family don't have those same rights to go to a company and say, what information do you have about me? How was it actually sold? Where are you sharing it?
And so a lot of times companies will just ignore those. Messages and just not even paying attention to them because they're like, I don't have to, you know, in some instances, if they are great data stewards, they will reply. So, The example of the web browser, I think, is the easiest one to understand. I want you to think about how many of you have Netflix on. Any device, right? It's on your TV, it's on your phone, it's on your tablets. I'm sure some of you, if you have a Tesla, right,
it's in your car, so that's collecting information on you. It's not just saying like, oh, where did I stop the last time I looked at this episode. It's saying like, well, how long are you engaged in it before you pause? How long does it take for you to like an episode before you jump out, right? And all that information's being collected on you, and then your kids and then everyone who you're sharing your password with, right, that information's being collected on them, but it's ass. associated to you. So how often do we get the opportunity to say, I don't want you to share that information. It's none of your
business. Like what, what types of shows I like and all of that. Yes, you're giving me better recommendations at the same time, why are you sharing that with other like other companies are you selling that information to maybe bigger media corporations to be able to Create, you know, Either better advertising or better products to sell to you. So, With that being said, I want you to think about every single app that is on your smart devices in your homes that are listening to
you. Do you even know what this microphone? is doing what is it processing? Is it looking at my biometric right now? Is it looking at the quiver in my voice because I'm very nervous right now? Is it listening to how long it takes for me to take a breath, how many times am I saying the word um. All of this information is being collected. How is it being processed? How is it being sold? So us as Arkansas residents, we should have the rights and the protections to know where is this information going, who has access to it, and can I go back and delete it if I don't think you need it, or why should you
keep it indefinitely? For some unintended purpose that I don't know whether or not it could harm me in the future. So, those being considered, I want you to think about the data that's being collected is being stored as ones and zeros in a database somewhere. For me as a privacy professional, I see that as information that's tied to a heartbeat. It's tied to an individual. It's tied to a person, and I want to make sure that that information is protected. I want to make sure
that in the event that it is used for a different purpose than what it was intended like initially intended for that I'm notified about. that. And if in the event that you want to make money off of the free resources that you offer me? Cool, just let me know about it. Give me the option to come in and say like, no, I'd prefer that you don't sell my information, right? And so, The emerging technologies. Such as AI, even though I would strongly argue AI has been
around a long time. We have seen lots of companies get in trouble for the misuse of data misuse of calculation, unintended bias, and If you'd like, I can give you lots of uh like examples of companies and how they've gotten in trouble and what they've done with it, but it's impacted people in terms of employment, shopping, like getting in trouble with the law even though it wasn't actually them because the facial recognition wasn't accurate, and so
I think this bill actually gives more responsibility on the companies that are using these technologies to actually give the forethought of what harm can actually be done and how can this actually impact these people because we're not just ones and zeros, we're all human beings with a heartbeat. And so I humbly ask that you use your power that you have to help protect the people of the great state of Arkansas, and I thank you for your time, and I am happy to answer any questions you might have. Any questions for Mark, Senator Love.
Senator Fredrick J. Love
Unverified
1:58:56
OK, so, so this is the field that you work in. Yes sir. All right. And, and you,
you've read this bill, you looked through it. Is, does the, does the peace on AI, does that, does that Trouble you is as far as is Looking at it from a business aspect, stifling business, I mean, like, talk to me about so I started
Speaker 268
1:59:22
out in IT and my background is IT and I moved
into data privacy, mainly because I was curious about what
Amar Jabereen
Unverified
1:59:31
even is data privacy, and so from that perspective of a business, I feel like what is being asked in this bill is just due diligence of what they should already be doing and just being more careful about using The technologies that are available. So for example, we have cars. Cars can cause great harm, right? We don't just give them to toddlers and say good luck, you know, we say, OK, you need to be a certain age, you
need to know the rules of the road. You need to make sure that you're responsible and can, you know, do all the safety features and be careful in that respect, right? We expect people to have that certain level of responsibility and due diligence to drive a car with AI, how many people could be impacted by this if we look at loans, credit card applications if we're talking about maybe ability to like move into a rental property, all those different things could be
using AI to say like your eligibility and so if they didn't properly vet that, that can definitely impact. Lots of people, right? And Unfairly there has been a lot of bias in a lot of AI studies that do impact human beings, right? And so if they haven't done proper bias testing, which actually isn't even in here of
Speaker 263
2:00:50
saying like you're required to have a third party do bias testing, which If I wanted to sneak something
Amar Jabereen
Unverified
2:01:00
in, I probably would sneak that in. I like if it does impact a person and then there's 100%, you know, automated decision making. There's no human interaction coming in and saying like, OK, maybe they didn't evaluate that properly. Maybe they didn't look at everything the right way, like yes or no, like you can change that from a person who is regulated, right, who can actually come in and say I
Speaker 263
2:01:20
have to follow all of these steps in order to make my decision, then I think there should be
Amar Jabereen
Unverified
2:01:27
a little bit more caution there just
because the amount of harm that can be done cause the fun thing about AI and technology like that is like, it's coming in, it's making all these decisions, it's storing it, and then it's making decisions off of the decisions it's already made. So if you think about a little bit of bias in the beginning that just comes from the human element of it, right, because AI is it learns from what it's seen from other data that's already been collected that was decided upon by humans, so everybody has inherent bias. That's just kind of the way of
the world. So if the AI model is trained on that, then it learns that inherent bias, which then Continues to progress and grow, and it can be exponential that that inherent bias continues and so you might not catch it until you have, you know, 500, 1000 people saying like, hey, why am I this person with these characteristics, not getting this credit card, not getting this, so. I think just having The, the proper vetting in
place, so just the requirement of saying what harm can be done. You can look at that and say, oh, these are individuals that could actually be harmed by this. Are we actually checking for bias? Are we checking to make sure our data sets have any bias in it, right, which Cool enough, like we have the technology for that. It's it's not that hard, so I don't think it's a big step for corporations to come in and say, yes, I can do this, or yes, we should do this due diligence. It's not
Senator Fredrick J. Love
Unverified
2:03:05
that much added on work, OK? And now from the from the debt of privacy piece in the in the bill. Um How do you, how do you feel about that? What, what are your thoughts on that piece? I'm
Amar Jabereen
Unverified
2:03:19
really happy as a data privacy professional for getting the rights to the Arkansas residents. I'm very excited about. Being able to go to my friends and say, Hey, if you think you have a concern about this, this is what you do. These are the steps you need to take to be able to go and make sure I teach my daughter like, hey, you are
13, you're clicking that button, right, that says I agree to these privacy policies, be like, you look in there and see where these are, and then you can go back and remove your consent. OK, alright, thank you. Thank you. Any other questions? Say no, great job. Thank
Senator Ricky Hill
Unverified
2:03:54
you, you use the word uh nervous and you're comfortable we'd have never known it. You did very good You handled yourself very well. Thank you. You're better at speaking than I am pronouncing names.
It's like I'm terrible at these too. Uh, next we have Randy Zook. And please introduce yourself for the record.
Speaker 284
2:04:39
Thank you. Thank you, Mr. Chairman. Randy Zook with the Arkansas State Chamber of Commerce, and thank you to the members of the committee for the opportunity to address this really big bill, um. I'll be brief. I should just say the gentleman from TechNett what he said and go on and call it a day. But let me make just a couple of comments about the size and the scale and the impact of the of the proposed bill.
Like him, we are all in for data privacy. Our business business members probably close to 100% would be fully supportive of any proposals to address the very real concerns around data privacy. But that said, there are lots of benefits for businesses, and it's important to consider all of the complexities of this bill carefully and the impact on businesses. We have businesses all the way
from health care to high tech to manufacturing, to agriculture, to transportation, to construction, and this bill, unlike most bills, will have some impact ultimately on nearly every one of them because it's that big and that widespread that wide. Reaching at the very least, we think the AI section should be broken away from this, from the data privacy part. It's at least 2 bills, so we would recommend to you and urge you to consider breaking the bill up into at
least 2 pieces and to give both Elements, the data privacy and the AI section full consideration and give your constituents, our members, the citizens of Arkansas a full chance to consider how this is going to affect them and then come back with ways to better align this with some of these other states that have already taken this step. There are substantive differences between this proposal, for instance, in the
Texas bill, the Virginia bill, the Indiana, Indiana bill, all of which are much narrower focused and really deserve to be considered fully. So with that said, we just, I'd like to say we're for the idea, the concept of data privacy, but we think this bill overreaches and goes too far with too much, so we would urge it to Come back to it in a different from a different angle, a different approach, perhaps interim study that's yours to
decide, obviously, but that would be something we could be for and support. So with that, I'll be happy to take any questions. I'm not a data privacy expert. My question to you would be at any point did you
Senator Ricky Hill
Unverified
2:07:27
try to work with the bill sponsor. No, we've not had that opportunity. Thank you. Senator Scott Thank you. Thank you, Mr.
Senator Jamie Scott
Unverified
2:07:39
Chair. um. So you said, just a quick question, um, you said you would be In favor of it being split up,
right? And you agreed with the gentleman who who gave very good testimony from il what's it called tech technique. OK, um, so if the bill could get closer, like he said to a Texas version which y'all be OK with something this this session or is that not what I'm hearing we'd be
happy to if you could get there,
Speaker 287
2:08:06
you know, if it could get there much more closely aligned with the Texas proposal
Speaker 284
2:08:12
and keep out. Let me give you a quick. I dug this out. popped up
And some research on this. Just last month, Vice President JD Vance warned that excessive regulation of the AI sector could kill a transformative industry just as it's taking off. So let's be really careful with what we do with AI because it has enormous potential to improve productivity and accelerate economic growth, but it can be a It's a double-edged sword at the same time, so it's very complex, very complicated, and I think it deserves a whole lot more study
than, than you've probably had the opportunity to provide to this bill
Speaker 218
2:08:57
so far. Thank you, Senator Love. Thank you.
Senator Fredrick J. Love
Unverified
2:09:03
So, so. So Mr. Z, I heard that the testimony before was that there were, there were several amendments I guess to the to the
bill. Was that not Your Your agencies, we've been involved with it
directly, no. OK. Um, hm. It's, it's kind of tough. OK. All right, thank you. Thank
Speaker 234
2:09:30
you. Any other questions from the committee, Mr. Z, thank you for your testimony very
Speaker 293
2:09:36
much. You're not going to brag on me though, are
Senator Ricky Hill
Unverified
2:09:43
you? Ms. Laurie Tudor, I mean Trogden. Good
And you are speaking against. Correct. And please pull that close enough to you
Speaker 296
2:10:16
so we can hear you. How's that Laurie Trogden presid and CEO of the Arkansas Bankers Association to forever be haunted by Laurie Tudor. I will be very quick. A couple of things that I wrote down from earlier testimony was we want to know why we were turned down for a loan, and federal law actually dictates Senator Hills, you're
well aware, federal law dictates what goes into those letters of adverse credit decisions and so that is taken care of and I'm sorry I did not catch her name, the woman that that testified just a minute ago. For the bill talked about third parties. Yes, we are already required to thoroughly vet our third parties that we utilize at banks for risk management purposes and that we are examined on that and then the GLBA exemption, which we do appreciate that exemption,
but that exemption does not apply to the entire bill, so the algorithm portion, which the AI portion, which many have talked about and addressed here, the FDIC actually already has guidance and examines us right now for algorithm issues looking for disparate. impact and discrimination from algorithms. So again, we are already regulated in that space. I would say I would argue that we're the most regulated industry outside of healthcare when it comes to data privacy
and other things, so we asked for a full exemption in the bill, and apparently the group behind the bill
Speaker 299
2:11:42
did not feel like we needed a full exemption, and that's why we are against
Speaker 264
2:11:48
the bill is written. Thank you. Any questions for
Senator Fredrick J. Love
Unverified
2:11:53
Ms. Trogon? Center Love. OK, so you, you, you Well, let me, let me go back to what she, what she said uh in regards to the biases, it could be loan applications. It could be. And Do you, you, you, do you agree
or you disagree with the, with the analysis that she had
in regards to their maybe biases within your. Your algorithms. Uh, if
Speaker 296
2:12:19
there are, the FDIC is currently currently examining us for that, and that would come out in our examination
Speaker 302
2:12:24
in the FDIC would react accordingly. OK, so your
Senator Fredrick J. Love
Unverified
2:12:30
argument is. I guess your argument is that since you're being regulated by the FDIC. Then
Speaker 296
2:12:40
The biases are already. Being accounted for, yes, but also the guidance and the examination manual that have been put out by the FDIC, there could be some disparity between that and state law. Just that's the reason they put the GLBA exemption in so that there's no disparity between this bill and federal law. And so we're asking for the same thing with the algorithm piece. It's
Speaker 302
2:13:03
already been taken care of by the federal government. OK. All right, thank you.
Senator Ricky Hill
Unverified
2:13:12
Any other questions? For the witness. Saying none, thank you
for your testimony. Any other questions for Senator Penzo? Sent love
Senator Fredrick J. Love
Unverified
2:13:34
Or so Senator Penzo, you, you've heard, you've heard some of the testimony that we had in regards to um, not being able to kind of
work with the bill sponsor on getting amendments and getting adoption, uh, getting the amendments, I guess to the bill and it not being kind of representative of the of the Texas legislation, so can you kind of
uh speak to that. Yeah, could you do that in your clothing because it really wouldn't be fair
Senator Ricky Hill
Unverified
2:14:00
for us to ask you a question about what they just said, OK. We've already done the questions. I'm sorry about that, Mr. Chair
Senator Fredrick J. Love
Unverified
2:14:11
asked me if there was any questions. I I I
did I caught myself, OK, well then, then can I ask him to speak to these things because I mean, because it was, it was very interesting because I, I thought I heard
testimony that said. That, um, there had been some amendments, um, amendments taken and different things, so I was, I was feeling, I thought. Uh, that you all have worked with the industry and kind of accepted amendments, but it came out that it didn't, so I I guess
I'm asking you to speak to those different aspects and then the uh the factor or the Did you think about breaking the bill out too and why, why, um, why did you combine the privacy and the AI together. So I would say if you could with that uh address that in your clothing that'd be really appreciated. Thank you, Mr. Chair. Thank you, Senator Love. Thank you committee.
Senator Ricky Hill
Unverified
2:15:05
I know this was a long one and a little bit
Senator Clint Penzo
Unverified
2:15:17
painful, but I appreciate your your time on this. This is something I think is very important. It's kind of a confusing topic for a lot of us that don't really understand. I mean, it's pretty high level stuff, so we all know that we don't like people being in our business, especially when we don't know they're in our business. I don't know how many times I would, you know, get online and My computer's spying on me because like the ads that come out that that's always drove me nuts, makes me wonder what else we're being looked in, you know,
there's even the time you you speak certain things and all of a sudden the computer starts sending you ads and it's like, oh, it's listening to me too. It's not just tracking, you know, um, so those, those are things that we, we definitely need to address. So, you know, it was mentioned that California was an outlier and in some of the testimony and it's difficult, but it's also came out testimony that Most of the states are pretty comparable. Some people like the Tennessee, some people like the Texas. We, we, we tried to mirror this as close to Texas as
possible, um, there was mention of some EU language that was in it that is actually more business friendly than the Texas law, and that's why the EU language was put in the bill, so I was a little confused to hear some of the testimony state that um Uh, that, that we would prefer we supported. The Texas bill, but yours has EU language in it and we don't like it, but my understanding is that was more business friendly, so that's why we went with that. Now why is this two bills in
one? That's the way it started, um, you know, I'm, I'm happy to uh. Split this bill in half if that's what the committee would like to see whether it was just a data privacy and an AI bill, um, but I don't like. We shouldn't do this because no other state's done it. We should wait till all 49 other states do it, and we should be last place. Where we belong. That's always
the mindset in Arkansas. We've got to wait and let all these other states flush it out instead of being a leader, and I think, I think we need to maybe consider that now there's there's templates out there for the data privacy. There's, there's probably a few things we could do, you know, there's We did make amendments, pretty much every major corporation out there. I mean, the big boys, the worldwide Fortune 100 companies are all on one side saying, gosh, we can't do this in Arkansas. It's going to be such
a strain on us, but yet, They're already adhering to all these other states that are doing it, it's a little bit different in all these states, but if Arkansas does it a little bit different. Boy, that's gonna be tough on us. I mean, these are tech companies. They're the ones that write the programs. It's not gonna be difficult for them to adhere to Arkansas, and it shouldn't be something that keeps us. From protecting our citizens. We've got Fortune 100, Fortune 500 companies on one side. We've got the people on the other side that are being spied on.
And that's what's happening. They're being watched. They're being, you know, tracked. Stuff that people don't, we've got how many apps on our phone? We don't know what kind of data is flying out of this thing every single second. I mean, I'm, we're probably being recorded on this too, not just this. So it's, it's something that we, we, I think we do need to talk seriously to to the people that spoke in opposition mentioned We're happy to work with you during the interim. Well that's where bills go to
die. We all know that. Well, I'm happy to work with them over the next couple weeks. If that's what the committee wants. We're not going to wait till the interim. I mean, I'm not. The committee can decide what they want, and I'm, I'm going to ask you if, if, if you don't want to get this for a vote today. I'll split out the AI. Have two separate bills, but I'm not, I'm not putting this in an interim study and waiting for 10 more states to pass it and let's wait another 2 years to get in line.
Um, you know, uh, JD Vance was quoted. Tremendous amount of good could come from this, was said. They had a tremendous amount of bad could come from it too. AI is a scary thing. I mean, for, for those of us that understand um what, what it could be, yeah, it's great. I mean, I love asking my phone questions and it just pops up the answer for me. That's fantastic. Um, you know, Elon Musk Musk, if we're going to quote people, says he thinks there's only a 20% chance of annihilation, you know, all
jokes aside, he's already got Skylink up there, you know, now we just need the AI to go with it. So, um, you know, there is concerns AI will be smarter than humans in the not so distant future if it's not already. I mean, we don't, we don't know what they've got out there, um, so I do think that that's something that we need to address. The data privacy is probably a big priority, like I said, not many states have done this yet, but I'm, I'm happy to
To amend this. I think, I think, Senator Love mentioned that amendments were requested and not made. Amendments were requested. Some of them were made, some of the people that spoke heaven. Sit amendments we're happy to look at more amendments, but some of the ones that weren't made would completely gutted. And not even make it what the Texas bill is, so I just asked the committee if we If you decide not to
past this today that we split this down, worked together to come up with a better solution on some of these issues, um, and, uh. Let's see if there's anything else I wanted to touch on,
but anyway, I'll leave it up to. It's
in your hands and I'm open to whatever y'all decide and if you'd like to see the two bills split, I'm happy to do it. Um, if we want to make out, take out the business friendly EU language and make it more like Texas, which isn't as business
friendly, if that's what's the big companies want. We're we're happy to do that as well. And I'm closed for my bill. Thank
Senator Ricky Hill
Unverified
2:21:39
you, Senator Penzo. So what's the will of the committee? We have to have a motion to discuss with
Speaker 317
2:21:49
no. Oh Thank you for offering Senator Penzo, but I'm not gonna take
Senator Joshua Bryant
Unverified
2:22:04
that. Yeah, I, I guess, uh. I want the discussion. I, I agree with the sponsor that any delay will just If we're going to discussion. I
Senator Ricky Hill
Unverified
2:22:12
appreciate that. I'm gonna go back to Senator Johnson first since If you don't mind on
that we didn't have a motion, so now we're just going to discuss what What the will of the committee is since we did not have
Speaker 317
2:22:24
a motion. Thank you, Mr. Chairman. Uh, thank you, Senator
Senator Mark Johnson
Unverified
2:22:28
Bryan. I will try to jump the gun on you here, um.
Ser Penzo, I, I, I thought that when he made the suggestion that Mr. Zook's idea of splitting these two rather Related but different. Provisions in the bill I thought was a good idea. And having got beat up the other day. You may remember on a bill that I thought. In retrospect, was a little bit too complicated and covered too many things. I might suggest respectfully, that you consider
uh splitting those two things up, you know, into some smaller bites as far as the EU versus Texas. I mean, I, I don't know. You, you've studied this. I haven't, but I think he would maybe get it into a uh a a more digestible form for us and I absolutely respect and support your decision not to send this interim study. I think, you know, this is something, this is a 2025 issue, and I respect your your your desire to do that and
and actually I expect to be supportive of the two bills, but I would recommend that. I think the two bills would be a little more digestible to us, you know, slower people that aren't as tech savvy as you and so on. My other friends and and my daughters and all that, so that's just my comment, Mr. Chairman. Thank you. Well, my comment to
Senator Joshua Bryant
Unverified
2:24:00
the committee would be as as You want to digest something
prior to slumber, I think, uh, if you look at Texas HB 4, it very much is in line with this language right here. Obviously there's going to be some code for or some style formatting and nuances to it, but anywhere I spot checked HB 4 out of Texas from two years ago. I, I saw it in this language. It's just a matter of how it was sequenced, so, you know, I, I generally support this and I want to see, I want to see it move forward. so I'll be supportive of a second if there was a motion, but without a motion, I would
say I would encourage you to pull pull and
Senator Ricky Hill
Unverified
2:24:45
get those last bites at the table and then bring it back. You can always make the motion yourself.
You are a member of the committee.
Senator Matt Stone
Unverified
2:24:56
Yes. Thank you, Mr. Chair. I'm agreeing that there are all these idols need to be addressed, but in the bill in his original form, I felt like I've been asked to eat an elephant in one bite. If we split it now I think I'm being asked to eat it in two bites.
I think we, it's, it is important as it is, as much as it needs to be addressed, I think we need to pump the brakes to make sure we get this right. We don't damage anything, especially when it comes to AI. Yeah Thanks to Senator
Senator Jamie Scott
Unverified
2:25:29
Scott. Uh, thank you, Mr. Chair. Um. I appreciate your courage. You never back down from a fight, um. I wish you would. I'm sorry, I didn't mean
Senator Ricky Hill
Unverified
2:25:38
to say that out loud and I, I think I'm supportive of
Senator Jamie Scott
Unverified
2:25:45
what you were doing. I, I think it is a lot of unknown. I would like to see it in a form, um, I'm actually agreeing with Randy, um, you know, that's very rare that we're on the same page, so I'm excited about that. Um, maybe just a forum in I forget your name they gave the testimony, just something that's more condensed that's along the lines of Texas or whatever y'all can find a happy medium because I know you. I know you ain't gonna give everything. I mean, I know that about you, but um I know that you've worked hard on this bill and I know it's something that's
probably important to our Kansans and so it's something I'm generally supportive, so, um. Is there something that you would really consider friends. The breaking up and yeah, because I do think it's not something that you need to put in in the interim, I think, especially the data piece. I can't speak to the AI piece. It's more that you would have to probably just talk to me about, but I would probably definitely be in support of if you can move
in that direction. Senator Love I'm just gonna go around the table,
Senator Fredrick J. Love
Unverified
2:26:50
tell you, I did know what what has been said here. I think this is a big deal now. In all honesty though, you
all, we've tackled larger, way larger bills than this in a in a session within a week, and we, and we've passed them through, so I mean for us to say that hey, this is just too big for us to kind of get through that, that, that's the wrong, I, I think that's the wrong ideal to
even start with. Uh, I think though you have the concept of of the privacy and the AI in which seems to be kind of putting it in two bills, maybe. A lot mentally to kind of digest, but I think that we should be able to do this, uh, within the next week or two, so I mean, if you would agree, um. I mean, we should kind of split this up and then let's just take one at a time, but I think that we should be able to this committee should be able to work on this and get it done, uh,
because I don't want to say, hey, you know what, why don't you go and split these two bills up, and then we're we're back here and and um we're just voting it down. I mean, you might as well just take it as it is and vote it up and vote down, so, uh, if you agree to take I can, I can give you
Speaker 333
2:28:06
a motion, man, and we can go we can rock and roll. I'm good. Senator D's. Thank
Senator Tyler Dees
Unverified
2:28:14
you, Mr. Chair. Uh, um, Don't need a bill letter
everything we've said a lot. I think we all agree with the concept. I don't think there's one person that doesn't agree with the concept that this needs to be addressed. Um, I think my request would be to, as we're as we're reviewing these is is on the the miners' side of data if we can really have a fine tooth comb on that. Um, I struggle with any minor being able to give consent contractually, um, uh, and so if If when you're working on review. I don't care what other
states do. I want to protect our Kansan kids, um, uh, not only on harmful material online, um, but also on their own data, and so that would be my request as you're as you're coming through for whatever gets brought up now in whenever and then I think I'd like to add a comment too on this discussion time about um that A lot of the data is being used for good as well. I think we need to make sure we remember that, um, uh, you know, I enjoy as a consumer.
That my choice of retailers know me. I actually like that because they're they're marketing to me in a way that I like. And so, um, you know, I, I enjoy that it's um I'm offered products online that you, you know, uh, Other shoppers have bought this. You've bought this, right? A lot of that is data collection and so I want to make sure that we're not undoing the good parts of this, right? Um, and so I think we've all said, said that right tonight. So, um,
I, I just, I don't want to go too fast again, like we've heard. I don't know if it needs interim study or not. I'm open to those discussions. I just want to make sure that, you know, when we, when we think about the businesses in Arkansas that And how they impact our citizens, the good and the bad, that it's that the conversations make sure it's been had and been flushed out. And so I, when I hear it took 56 years for the Texas bill to get there. I'm not saying it needs 5 years for us. But a few days doesn't feel
good, right? And so let's let's figure that out. Um, I'm, I'm open to hearing what that means if that needs to be an interim study. Let's talk about it. If it needs to be done in a couple weeks, let's talk about it, but
Speaker 334
2:30:36
those are the things I said children protection protection side and let's make sure we're doing the good with it too.
Senator Ricky Hill
Unverified
2:30:42
Thank you. So what age are you, Senator D 21, 22. I think we need to have those
Senator Tyler Dees
Unverified
2:30:49
conversations, Senator Senator Love and I do want to
Senator Fredrick J. Love
Unverified
2:30:56
reiterate something though in in I think Senator Penzo said
this, We don't always need to be the last state to be adopted just because of the other 48 states haven't done something that doesn't mean Arkansas can't be the leader, and protecting his people and so I am big on that on that piece. Now whether it's 2 bills separated out. I mean, if you agree to do that, I think that I think that would be good, um, but I, I don't, I don't think that we should wait just because this state didn't pass it and this state didn't pass and this
state didn't pass it, then Arkansas can't pass it. That's, that's the wrong idea. That's the wrong premise. If it's a good deal and it protects our Kansans, I think that we should, this is what we should be doing. Thank you, Mr. Chair. Thank you, Senator Love. Pennzo year kind of what you want to do. I want to keep one thing
Senator Ricky Hill
Unverified
2:31:45
in mind too. We all talk about freedom of choice. We all have choices of what we do in life. I have a choice to whether I want to put an app on my phone or not. That's my choice. I know they're tracking me, whatever, that's my
choice. I don't like it, I can delete it. You know, they may still have a record on me, but It's freedom of choice out there too, and whether there'd be for myself or for someone else, we do have a choice whether we
don't even have to have a cell phone. That's our choice. We know the ramifications when we
Senator Clint Penzo
Unverified
2:32:14
have it. Yeah, there's, there's, there's a lot of apps that I. Don't have for that specific reason. No, but based on, you know, I would like to pull this down and, you know, based on what Dee's just said, there were
probably 3 bills instead of 2, but I'll break it down, try to make it a little more attractive for you and come back to see you and we'll make the presentation next time much quicker. OK, I appreciate it, and I would appreciate too if you
Senator Ricky Hill
Unverified
2:32:39
could get with the Trogden from the banker Association and address some issues that she thought was already addressed in this one. Sent. Thank you, Senator Penzo and Mr.
Senator Mark Johnson
Unverified
2:32:51
Chairman, I don't think we're going to need anywhere near this much time going to these two bills as we
did doing it as one, I think we can expedite this, and I wouldn't have even said that we should be looking at that if I thought it was going to slow things down for Senator Penzo. So yes, we should be able to get to it in a couple
Speaker 339
2:33:08
of hours or less. Thank you. We should be able to do it a couple
Speaker 76
2:33:13
of hours on each one. Thank you, Senator Penzo, appreciate it. Thank you committee. Any other, anything else for the committee
Agenda
CALL TO ORDER - Sen. Ricky Hill
SB258 C. Penzo TO CREATE THE ARKANSAS DIGITAL RESPONSIBILITY, SAFETY, AND TRUST ACT.
HB1536 M. McElroy TO WITHHOLD STATE TRANSPORTATION FUNDING FROM A SCHOOL DISTRICT THAT DOES NOT REQUIRE PASSENGER RESTRAINT SYSTEMS IN SCHOOL BUSES UNDER CERTAIN CONDITIONS.
ADJOURNMENT
Documents
| Title | Type | Pages | Source |
|---|---|---|---|
| Agenda — TRANSPORTATION, TECHNOLOGY & LEGISLATIVE AFFAIRS - SENATE, Mar 3, 2025 | Agenda | 1 | Official source ↗ |
Speakers
Senator Ricky Hill
Unverified
Representative Mark D. McElroy
Unverified
Speaker 11
Senator Mark Johnson
Unverified
Senator Fredrick J. Love
Unverified
Speaker 31
Senator Matt Stone
Unverified
Speaker 41
Senator Jamie Scott
Unverified
Speaker 62
Senator Clint Penzo
Unverified
Speaker 80
Speaker 82
Josh Bryant
Unverified
Speaker 89
Speaker 93
Speaker 96
Speaker 81
Speaker 106
Speaker 110
Speaker 116
Speaker 107
Speaker 98
Speaker 142
Senator Tyler Dees
Unverified
Speaker 152
Speaker 158
Speaker 161
Speaker 90
Speaker 163
Speaker 172
Speaker 173
Speaker 141
Speaker 157
Speaker 159
Speaker 187
Speaker 165
Speaker 198
Speaker 123
Speaker 144
Speaker 207
Speaker 215
Speaker 74
Speaker 115
Speaker 221
Renzo Soto
Unverified
Speaker 241
Speaker 246
Speaker 256
Amar Jabereen
Unverified
Speaker 268
Speaker 263
Speaker 284
Speaker 287
Speaker 218
Speaker 234
Speaker 293
Speaker 296
Speaker 299
Speaker 264
Speaker 302
Speaker 317
Senator Joshua Bryant
Unverified
Speaker 249
Speaker 333
Speaker 334
Speaker 339
Speaker 76