Alaska Legislature: House Judiciary, 4/24/26, 1pm

This meeting of the House Judiciary Committee will now come to order. The time is now 1:39 PM on Friday, April 24th, 2026. We are meeting in the Grunberg Room, Capitol Room 120. The following members are present. Representative Underwood, Representative Eichide, Representative Vance, Representative Mena, Representative Costello, and myself, Chair Gray.

Let the record reflect that we have a quorum to conduct business. I would like to recognize the staff supporting this meeting: Sophia Tenney from House Records, Kyla Tupou from the Juneau LIO, and my committee aide, Dylan Hitchcock Lopez. We have two items of business on today's agenda: Senate Bill 9, Surrender of Infants, Infant Safety Device, by Senator Myers, and HB 367, Consumer Data Privacy Act, by Representative Story. Let's go to our first item of business, uh, Senate Bill 9. Um, Senator Myers, would you like to make some opening comments?

Uh, thank you, Mr. Chair. For the record, Robert Myers, Senator for District Q. Um, just as a quick reminder what the bill is, we're adding a tool in the toolbox, um, trying to save lives, just expanding the, uh, already existing safe surrender— excuse me, an already existing safe surrender law to include, uh, infant safety devices that can be installed at a hospital, fire station, police station, et cetera. Thank you, Senator Myers. I would note for the record that at the last hearing I set an amendment deadline of Thursday, April 23rd, 2026 at 5:50— 5 PM, and our office received one amendment.

We will now take up that one amendment. I move Amendment Number 1. I will object for purposes of discussion. Representative Mena, would you like to explain Amendment 1 to us? Yes, Amendment Number 1 adds language to the signage that would be at the infant, uh, infant devices, uh, and the added language would require that there would be a statement, uh, referring to 211 or another statewide service navigation hotline.

And the other language would help ensure that, uh, there is information about the Safe Surrender Law referencing the Department of Family and Community Services website. And this is after discussion in the committee where we talked about my concerns related to the lack of resources for the parent involved in this situation, and I appreciate the work that was done between the sponsor to help figure out what was the right language to add to the sign. Thank you, Representative Mena. Senator Myers, do you have a position on Amendment 1? Yes, thank you, Mr.

Chair. So, for the record, Robert Myers again. I am fully in favor of Amendment Number 1. Representative Mena and I talked it out over the last few days since the last committee meeting. Does a couple of good things, as Representative Mena mentioned already.

Putting in 211 or another statewide phone number to connect people to services is great. Remember, these are most likely going to be people already in crisis, and whether we're talking about connecting to you know, something straightforward as how you access SNAP benefits, or something much, much deeper, you know, dealing with issues of domestic violence or of sex trafficking, or, you know, maybe maternal health, as we have brought up in the committee a few times. I think this is a great way to do it without trying to overwhelm people with information on the signage. The second portion regarding the QR code or statement regarding information about the Safe Surrender Law, I think is a great addition. I believe last time Representative Vance brought up that these boxes, in addition to, you know, the service that they're, you know, the reason that they're there in the first place, they also help in terms of a kind of a public education piece regarding the Safe Surrender Law in general.

You know, we don't want to be necessarily printing out a URL for somebody to sit there and type on their phone or, you know, print out 3 pages of statute on a sign. And so trying to have a QR code we figured was a good short way to do so. We did speak to the department. They were a little bit concerned tying ourselves specifically to a QR code. You know, we have rapidly changing technology.

We don't want to be stuck with something. My hope, and I believe this is Representative Mina's hope as well, since we said a statement or QR code, we hope that this is interpreted liberally, that there could be many options, but the The intent that we're trying to convey there is we want something short and sweet that directs them to a website or maybe even just a short statement. The—. Representative Mena brought up a couple of statements that are on the— already on the Division of— or Department of Family and Community Services website about safe surrender that could be used as well, just to let people know that these laws do exist. Thank you, Senator Myers.

Representative Mena. Thank you, Chair Gray. And if I may add as well that the language in the amendment is specific to 211 providing resources that are also— would help someone who might be in a situation where they need resources related to family planning, human trafficking, and domestic violence. Those were concerns that were brought up a lot during the committee because we don't know the situation of what the parent might be right after they've given birth. And additionally, when, uh, Senator Myers and I were talking about what the language could look like on the, uh, point E on the amendment, on the Department of Family Community Services website on the Safe Surrender Law, they have a couple of flyers there.

And the statement that they have right now in one of their flyers, which is a little outdated, it says the Safe Surrender Law allows you to give up your baby within 21 days of birth. Bring your baby to a fire station, police station, medical facility, or leave it with a person you trust. So that would be, I think, a good example for the type of language that would fit onto, um, point E with the addition of adding infant surrender device. Are there any questions about Amendment 1?

Seeing no questions, I remove my objection.

Seeing no objection, Amendment Number 1 has been adopted. Are there any final questions for the sponsor about Senate Bill 9?

Uh, Senator Myers, do you have any final remarks? Uh, Mr. Chair, just appreciate the committee taking the time to hear the bill today and looking, looking forward to moving it on to the next step. Thank you. Seeing no further questions or comments, do we have a motion?

Mr. Chair, at this time I move that Senate Bill 9, Work Order 34-LS0085/Q, as amended, be reported out of the House Judiciary Committee with individual recommendations and attached fiscal notes. Hearing no objection, Senate Bill 9, Work Order 34-LS0085/Q, as amended, is reported out of the House Judiciary Committee with individual recommendations and attached fiscal notes. I authorize Legislative Legal Services to make any necessary technical and conforming changes. We will take a brief at ease to sign the paperwork.

At ease.

Back on the record. Our second item of business is House Bill 367, Consumer Data Privacy Act, sponsored by Representative Story. It is my intent to adopt a committee substitute for House Bill 367. Do we have a motion? Mr.

Chair, I move that the committee substitute for House Bill 367, Work Order 34-LS1485/G, be adopted as the committee's working document. I'll object for purposes of discussion. I would now like to invite my committee aide, Dylan Hitchcock Lopez, to come forward, put himself on the record, and give us an overview of the changes to the Committee Substitute.

Good afternoon. Dylan Hitchcock Lopez, staff to Rep. Gray and the Committee. I'm going to give a really broad brush overview. Rep. Story's staff, Kaylee Holm, behind me, is going to do a more detailed sectional analysis, which we did not do at the last hearing, so it's updated for this Committee Substitute. I don't want to be too repetitive.

But, you know, as we heard at the last hearing, the original version of this bill was modeled off of the California Privacy Act. And since that act went into effect, a variety of other states have enacted more comprehensive consumer privacy laws that follow a different model. Those include Virginia, Washington, Colorado, Connecticut, and I believe several others. And so one of the things that we heard at the last hearing from the expert from Consumer Reports was about the importance for— or, you know, that's not necessary, but it's certainly helpful, both for industry and for states' attorney general on the enforcement side, to have similar frameworks and some comprehensive legislation between states, given that data moves around. And so this committee substitute switches from the California consumer protection model and goes with the model that the majority of states have followed, which is sometimes called the Washington model or the Virginia model.

So that's the structure of the bill at kind of a high level. It removes a couple of things, larger components from the previous version that were particularly heavy on state resources and on state enforcement. One of those was the collection of a 3% sort of fee from processors that somewhat resembled a tax. There were some concerns articulated about that, as well as just the administrative burden on trying to establish that entire framework. So that has been taken out.

What has been included are now a data broker registry to ensure that data brokers are registered with the state. It goes to a controller-processor framework, which is the language that is used by the majority of states. It takes individual consumer rights, which were in the previous version sort of scattered around the bill, and it creates a clearer framework where the consumer's rights in their data are clearly articulated. It lowers the threshold for business size. One of the things we heard at the last hearing was, you know, the threshold for the number of consumers that a business engages with is important given the population of the state.

So we have, in this committee substitute, gone with a version that is more similar to that in states like Vermont, or, you know, a place with a smaller population size, where the other one was quite large. We've also created specific exceptions for government and tribal entities, and also added a list of exemptions, which is quite lengthy, you can find in the bill, that is meant to avoid concerns about federal preemption. So, data which is already subject to comprehensive federal law, like HIPAA, and a variety of other federal laws, is exempt under the statute. Now, you know, one might say, well, that would be likely preempted under federal law anyway. That is correct.

The goal here is to provide clarity. So that there isn't a direct conflict of laws issue. If there's any other kind of higher-level things that would be helpful to highlight for the committee.

There were some requirements in the previous version that had, like, requiring businesses to provide specific training for personnel. That was removed. I believe there's also— and then also sort of mandatory rulemaking by the AG was removed. The idea here is that the Attorney General is authorized to promulgate regulations by this act. They're not required to.

And those regulations can be tailored specifically as sort of the landscape evolves. So, again, trying to alleviate some of the administrative burden in the bill while providing a comprehensive framework that we can use going forward.

And I think that that's sort of at a high level. I would be happy to take any questions, though I would say that we worked closely with the sponsor's office on this, and I think that Ms. Holm is well equipped to walk us through sort of a section-by-section analysis, which could be helpful at this time. And then I do believe we're going to have several folks available for questions on different technical components as well. Thank you, Mr. Hitchcock-Lopez. Representative Mina.

Thank you, Chair Gray. Through the chair, just a quick question. If the Attorney General is not promulgating regulations, where does that responsibility reside? Through the chair to Representative Mina, could you, could you clarify that question a little bit for me? Because the, uh, in terms of the, the AG is still authorized to promulgate regulations.

It's just this statute is not saying, "Go out and make up a bunch of regs right now." It's saying, you know, "Make up the regs when you need them as—" or not "make up," you know, but "promulgate the regulations as needed," sort of at your discretion. The idea being there that the AG's office will be more well-equipped to make that decision as this law goes into effect. Thank you. That makes sense. Thank you.

At this time, we'll call forward Ms. Holm to walk us through the sectional, and Representative Story. Thank you, Representative Story.

Thank you, Representative Gray and committee. I wanted to make a few opening remarks if I could. And for the record, I am Andy Story representing House District 3, which is the northern Mendenhall Valley here and Haines, Gangway, Klukwan, and Good Springs. Davis. And again, I'm joined by my staff member Kaylee Holm, who's doing great work on this important bill.

Before I begin, I want to apologize that I need to step out of the meeting almost immediately because I'm first up at House Finance with another bill. But this bill, I believe, is really important. House Bill 367, the Alaska Data Privacy Act. As Mr. Hitchcock Lopez stated, this bill has gone through a full redraft. While the structure of the bill has changed, the core intent remains the same, to establish a public data broker registry and enact the Alaska Data Privacy Act so that Alaskans have meaningful control over their personal data and stronger protections for their constitutional right to privacy.

I have prioritized this legislation because it touches nearly every Alaskan. Personal data is collected, shared, and analyzed and sold in many ways that people never see and often do not understand what is being done with their personal data. The data can reveal where where we live, where we go, what we buy, what we believe, and who we associate with. It's powerful, valuable, and influential. House Bill 367 is about reducing harm, protecting against future harm, and giving Alaskans more transparency in a largely unregulated system.

It's about protecting these constitutional rights, um, and we need privacy status in our books so that if something egregious does happen, our state has a clear foundation to act in a timely and effective manner. And I'm just going to go through the key points and then we'll go through the sectional analysis. Thank you for your indulgence. So what this bill does is limits collection and sharing of personal data to what is reasonably necessary to provide a requested service, to conduct an activity the consumer has requested or consented to, or for security and fraud protection. It gives Alaskans the right to know when their data is being collected.

Correct incorrect data that could lead to negative consequences, delete their collected data, and opt out of having their data collected and sold to third parties. This is important to me and many of you. I know this because I know you. It creates stronger safeguards for youth and sensitive data. For youth, the bill prohibits the sale or use of data for individuals 17 or younger and limits targeted advertising and profiling.

It also creates stronger safeguards for sensitive data, including biometric and geolocation data. It creates data broker accountability. Data brokers must register within the state before operating, increasing transparency. And it provides an enforcement mechanism. Violations would be enforceable under Alaska's unfair or deceptive trade practice laws The bill also gives the Attorney General clear authority to investigate violations and pursue penalties.

Alaskans should be able to know when personal data is being collected about them, who has access to it, and how it is being used. With that, I will turn it over to Ms. Holm, and I'm going to— I hope I will be back shortly. Thank you. Thank you.

Good luck.

Hello. Thank you. For the record, my name is Kaylee Holm. I am office staff to Representative Andy Story. And now I will just briefly go over the sectional in an abbreviated version since you guys all have it in front of you.

So the first section is going to add the consumer privacy account— to the established list of separate accounts under the general fund. Um, that's where the money that is collected from any kind of fees or lawsuits or whatever would go into to make sure that this bill is self-funded. Um, it requires the Department of Commerce, Community and Economic Development to establish and maintain a data broker registry is in Section 2. Section 3 will add the Alaska Data Privacy Act. Created in this bill to the existing exemptions governing disclosure of the Social Security numbers.

Section 4 will clarify that notwithstanding the existing Social Security numbers protections, a person may disclose an individual's Social Security number to an independent contractor to facilitate the original purpose or transaction which is provided. And then Section 5 is where we get into the meat of the bill. This is where the— this amends to create the Personal Information Protection Act and adds a new article, adding a new article that establishes the Alaska Data Privacy Act. So under Section 5, we have 0.800. So this just is saying, oh, What entities are included and which ones are excluded?

805 Is the consumer rights. So saying that consumers do have the right to access, correct, delete, and obtain a copy of personal data and information from third-party transfers and to opt out of targeted advertising, the sale of personal data, and profiling in significant decisions. 8.10, The controller responds to consumer requests. This is going to establish how consumers may exercise their rights and requires controllers to provide specific opt-out methods, set responsible timelines, and create an appeal process. 8.15 Requires controllers to limit the collection, processing, and transferring of personal data to what is reasonably necessary for a specific purpose and is establishes the requirements covering the de-identification of data.

820 Is sensitive data, so this is just a special call-out to make sure that the data that helps de-identify data allows people to, like, figure out what— re-identify it, essentially, including biometric data and location data, has a more strict standard. 825 Is a privacy notice and disclosure. It requires controllers to provide reasonably accessible, clear, meaningful privacy notices. So not hiding your— these notices in some area that's hard to find, to make sure that people can understand them and they're clear. 830 Is the responsibility of processors and controllers.

So this requires contracts between controllers and processors to establish Processor's Duty Related to Consumer Requests. So essentially saying that if you are selling to or trading to a third party, that you have an agreement that you are going to be proper stewards of the data in which you are transferring. 835, Data Protection Assessment, requires controllers to conduct and document data for protection assessment and processing activities. 840 Just says that you are not allowed to discriminate if somebody opts out of their data.

845 Is the Transfer of Information in Business Transaction, establishes a requirement for transferring personal data in mergers, acquisitions, and bankruptcy. So you're not allowed to sell data for a purpose other than which it was originally intended. And if that is the case, the consumer, or the person whose data it is, has to be notified and given an opportunity to opt out. 850 Is security procedures, saying that if you do have— hold this data, you have to have a certain standard of security measures in place to make sure that you are not getting breaches. 855, The data broker registration, we kind of already touched on that, just saying that the Department of Economic and Commerce will have a data broker registry.

860, The consumer privacy account. Again, this is the account in the general fund. 865, The violations of this act will fall under the Fair— Unfair and Deceptive Acts or Practices and specifies that each of the violations constitutes a separate violation. So instead of trying to create our own, we are— our own enforcement, we are just leaning on stuff that is already in state statute instead of creating— reinventing the wheel. Regulations just authorized the Attorney General to adopt the regulations and implement the act, which we've already discussed.

And then exemptions, so there are just a set— these are standard exemptions that you see in a lot of the bills throughout the nation. And it's mostly tied around healthcare, studies, scientific studies, things along that, that just we think will help benefit society, so the need to share is okay. 880 Is essentially saying that you can't— we have thresholds for who can buy and who this law applies to, and you can't try to evade that by making a smaller entity that sells to a larger entity. 885 Is just saying that people can't just— and this is protecting against people that might be convinced to waive their rights. Is saying, uh, uh, 890, liberally, liberally constructed, essentially says that, um, the AG can go and focus on the intent and the purpose of this law instead of strictly what is written.

And then definitions, this is a big chunk of the bill. I think there's about 10 pages of definitions. Uh, we are creating a new act, so it just needs to include those definitions. And then, um, 898 is a short title. So this will now be referred to as Alaska Data Privacy Act.

Section 6 adds the Data Privacy Act to the list of unfair and deceptive acts or practices. And then Sections 7 through 9 is just related to the effective dates of this bill. And with that, I will conclude sectional analysis. Thank you, Ms. Holm.

Are there any questions about the sectional? Representative Costello? Yes, thank you very much for Thank you for going through that. So I have a few questions. My first has to do with the writing of the regulations, and in here we had discussed that it says the Attorney General may promulgate regulations, which means they don't have to but can.

I have never— I've never come across a law or statute where the regulation writing comes after the law has become, you know, has— goes on the books, and I have a couple questions about the regulations. So there is a section in here, I forget where it is, where it gives the Attorney General the authority to write the regulations, but then it asks the Department of Community and Economic Development to create this database, and it actually mentions the regs that they will promulgate, but it earlier in the, in the bill it gave the Attorney General that authority. So I'm curious about how you see that working. And then on the Section 890, where it basically what you mentioned just briefly, which is that the Attorney General doesn't necessarily have to keep the regulations to specifically what's in the statute, but can kind of veer off into what's the intent of the statute. And so I had asked the chair earlier if we could have the acting attorney general and the solicitor general here just to comment on how they see they would implement this bill.

But can you talk about the regulations? Yeah. So I would first kind of just say the idea is that this is mostly based in a digital marketplace. As far as like technology goes, it advances so quickly. That if we wrote really strict guidelines into place, essentially they could be out of date very quickly.

So what— so this bill is written that, like, these are the things that need to be accomplished. People need to be able to have these rights. These rights need to be protected. But in what fashion and how can be flexible given the speed in which— and change in which the industry goes? Is essentially what I would say.

So before the last bill, it was very descriptive, but we, we saw even within the 3 years of that bill being written how out of date they were. So this one just is more like, you need to accomplish these goals, but how you can do it can match the speed in which the industry is changing. And I can also let the Department of Law if they want to talk about that, or the drafter of the bill. And then as far as the Department of Economic— Community Commerce and Economic Development goes, So their sole role is that database. They are just more, more set up to do that.

They have databases for business licensing and everything along that. So they are just essentially saying this is one thing that is in the bill is this database has to be created. These are the things that we need to see in that database. And this is— and the flexibility we give there is the fees because we just don't know of what, uh, how much it's going to cost. And we want to make sure that this isn't costing the state, since this is something we're responding to that's happening to us.

And so that's really the only flexibility. But that part is not, or should not be, under the AG's office. And if, uh, Ian Walsh or the department wants to correct if I'm misspeaking, they are more than welcome to. Thank you. That, that's a good moment for me to to recognize the folks who are here to answer questions.

We have in the room, we have Sylvain Robbe, Director of Division of Corporations, Business and Professional Licensing, Department of Commerce, Community and Economic Development. Thank you for being here. Online, we have Ian Walsh from Letsch Legal, and we have Matthew Schwartz, Senior Policy Analyst at Consumer Reports in Washington, D.C. So those three folks are available for questions. Do you have a follow-up?

Yes. Thank you. So you said there's pages and pages of definitions and there's just some that are here. Is there a definition for high-risk profiling? Yes.

Chair Gray, Representative Mena.

It is the sensitive data— oh, sorry. Sorry, Representative Costello. Representative Costello. It is the sensitive data that they're referring to, so these like the ones where the Either there's a higher risk of discrimination, or is data that can be used to help de-identify, re-identify de-identified data is what those high-risk ones are referring to, or health data, the things that have already been, are already understood as high-risk. Just one more follow-up.

Thank you. The location data accurate within 1,750 feet. So I, there's two things I'm thinking about here. One is in Alaska where there's a small community, if a person is, you know, within that range of their geolocation, you pretty much know where they are. So why, why that number?

Mm-hmm. And then the other question is, um, So there are apps, you know, where parents can track their family members. Would that be impacted by this or, or not?

Through the chair, um, what I— we chose that number because that's the standard number that you see in other bills and policies. It is my understanding that you can choose to allow, if you want, allow to be able to see, or allow the tracking. So like think of your Maps or Waze. You can say, "Yes, I need to know my directions." So, but the point is, is they're not allowed to— so you can use it on that direct first-party association, but they're just not allowed to sell it to someone else afterwards. So your first party, yes, you're allowed to use it, but they just can't say, "Oh great, now we have this data.

We're going to now make a profit off of this by selling it to a third party that can use it to figure out other things about you and connect it." And again, if I'm misspeaking, please correct. One final comment. Thank you. And I just want to mention this is really, you know, I'm really learning about this new committee subcommittee. Institute right here.

But I guess my overarching concern is, is that we're giving, um, a commissioner, which is the Attorney General, a tremendous amount of authority to almost rewrite law with this kind of flexibility, with the idea that, well, this is a fast-moving industry. Well, not sure that I'm completely comfortable with all that. If I'd like to know more information, and also how the Attorney General, the acting would plan on interpreting this and working with it, um, specifically with the fact that you can write regulations after the law has been in place. So that really, we're handing over the legislative responsibility to the executive branch at that point if the regulations aren't drafted prior to it coming into fruition. So that's just my concern.

Thank you, Representative Costello.

Representative Mina. Thank you, Chair Gray. Through the chair, could you explain more about the difference between the previous bill, which I understand was emulating the California framework, and this CS emulating the framework of most other states? What is that main difference between California and all the other states? So as, um, essentially when all these When attention started to come to this issue, California was the first to write and implement a policy.

And so what— and so, and we were also working at that same time to write and try to implement something to help with this issue. And so that bill, because California had created its own entity, they put 10 million dollars into it. It's much more restrictive. And so essentially it was great if you are a large state that has money and can monitor this more. That is what you see.

And it realized that a lot of states just couldn't obtain creating a new entity and things along those lines. So what you saw was then the shift into a, something a little bit more consumer-friendly and business-friendly that was more attainable and less costly. And so it's just not as— yeah, it's just set up— the framework is set up differently. Follow-up? Through the Chair, if it requires less funds to implement and enforce.

And I might have missed it, the fiscal note for the bill, but is there a fiscal note, or what would that capacity— what capacity does the Commerce have to be able to implement this, and would they require new positions, etc.?

So is that from Director Roddy? Sure. Oh. Thank you. Director Robb.

Hi. Thank you, Mr. Chair. Good afternoon. For the record, Sylvan Robb, Director of the Division of Corporations, Business and Professional Licensing.

Through the Chair to Representative Mena, obviously the committee just adopted the committee substitute, which is substantively different from the earlier version of the bill, so there is not a fiscal note. From the Division for the new version of the bill. That being said, a crucial element that we would need to understand is sort of the expected scope of these data brokers in the state in order to help us figure out what, uh, the workload would be. And at this point, that's not information that we have on hand, but we're hoping that the sponsor or other folks involved with the bill will be able to work with us on that. Thank you.

Follow-up through the chair. Could you explain more about that expected scope? What kind of information are you looking for?

Through the chair to Representative Mena, so in our reading of the bill or of the CS that was just adopted, it seems that the, you know, the division will come up with the fee to register as a data broker. And in reading of it, it seems like the intent is that that fee will fund— and I will defer to the sponsor staff— but that the fee is intended to cover the expenses at the Department of Law and the Department of Commerce. And so obviously you kind of need to know how many people you're going to split that cost by, and so we would need to know how many potential data brokers are out there to have some rough estimate of what the fee may need to be. And again, how much work it is if we're going to register 10 data brokers or 100 or 1,000, that obviously may require a different amount of staff. Follow-up through the chair to the bill sponsor's staff or to anybody online.

Do we have an idea of how many data brokers might be operating in Alaska? So Through the chair, Representative Mena. I will pass this question to Matt Schwartz after I say I just want to make one slight correction. We are— the intention was that the registration fee would be cost of— would cover the administration cost for the department to create this registration thing. As far as the other fees for the Department of Law, that would— the assumption would be that those fees would be covered through the collection of lawsuits or settlements, anything along those lines.

And it's designed that like the Department of Law does actually does not have to seek out these kind of things or work towards them. But if there is something going on, then they can like direct staff there. So, and then as far as data brokers, we do have an— One of the issues is that it is mostly an opaque system. A lot of people don't know the names of these data brokers or who they exactly are. That's one of the goals of the bill is to start understanding who the players are, what they're doing, what they're collecting.

But we do have an under— kind of assume that they are the ones. This is a global issue, so we can look towards other registries, and I'm going to ask if Matt Schwartz can answer what kind of numbers they see in other states, if he has that answer. Mr. Schwartz, can you take yourself off mute, place yourself on the record, and give us an estimate of how many data brokers are operating in Alaska?

Can everybody hear me okay? Yes.

Okay. I'm Matt Schwartz, senior policy analyst with Consumer Reports, for the record. And yes, so there's similar data broker registry requirements in a handful of other states right now. California, Texas, Oregon, and Vermont all have this requirement. So a range of big states to small states.

There— the list of data brokers that register in each of those states ranges from around, you know, 300 to 400 to around 600. I believe. And so, you know, obviously more data brokers registering in California than some of the other smaller states, but not kind of differing by an order of magnitude. And so I would anticipate that if data brokers were to have this requirement to register in Alaska, it would fall somewhere in that spectrum. Thank you, Mr. Schwartz.

Thank you. I would now like to go to Ian Walsh from Ledge Legal. I would like to ask Mr. Walsh to comment on Representative Costello's question regarding giving authority to the Attorney General to make regulations basically without direct— without specific direction from the legislature. Can you speak to if that happens in any other agencies or if this is an unusual facet of the bill.

For the record, this is Ian Walsh, Legislative Legal Services. Through the Chair, to Representative Costello's question, I did a quick search, and this is not going to be exhaustive, but just in the number of statutes that we have that similarly basically say that a department may adopt regulations under the Administrative Procedure Act to implement a law, and I found about 120 other instances of similarly worded statutes. So I would say the way the bill is formulating this regulations permission is not at all unique to this bill. Thank you. Um, I have a question, perhaps for the sponsor, perhaps for Mr. Schwartz.

I am just going to randomly read parts of the bill because— and what I'm basically reading is things that should happen, but I'm just curious how you make them happen. So page— actually, let me make sure I got them all. Page 8, lines 24 to 31: A controller may not collect, process, or transfer sensitive data pertaining to consumer unless the collection, processing, or transfer is strictly necessary to provide or maintain to obtain a specific product or service. If I flip to page 15, lines 13 to 15, the controller shall require that the third party agree by contract to keep the personal data confidential and not use the personal data for a purpose other than evaluating and consummating the transaction. Flipping ahead to— oh, I don't know.

Well, back to page 11. Lines 9, at the controller's direction, they must delete or return all personal data to the controller at the request— at the end of the provision of services. Lines 19, ensure that personal data the processor receives from or on behalf of control not be combined with personal data that the processor receives from or on behalf of another person. All these things, like, I think are great, but I'm just curious about How do you make them do that? And when we say a lot of this opt-ins or opt-out stuff, I know I'll speak for me and I'm sure people, you know, you can judge me.

A lot of times my phone will say updated contract, click here to proceed. I just click here to proceed. I just agreed to everything. I'm curious if a lot of this bill will just result in a new click-through. That folks in Alaska just click through and basically, um, you know, allow what, what we're trying to stop and what we don't want to happen, that we just click through and allow it to happen?

Probably wasn't the most well-articulated question in the world, but do you have a comment? Yeah, Representative, um, Chair Gray, So I will let Matt Schwartz answer how it's applied in other states. But as far as like the quick through, you will— you are starting to see— one of the things that's in here is like clear and conspicuous, easy to read, understand. So you're seeing less of this like giant legal thing that you don't understand and more like, oh, this is what I'm agreeing to. There's also— In here it's written that you can use global— they're like global consent, so you can download something that allows you— that says like, I don't want my data being shared or purchased.

And then that feeds through, through your web server, everything else. Again, he can probably better explain this. So there are in the bill ways to prevent that, like just click through. One, by making it easier to understand what you're clicking through, and two, by allowing— saying that they have to respect these apps that universally say, "I'm not a person that wants to be partaking in this free-for-all of my data." And then, again, if you would like to elaborate with— [Speaker] Sure. Thank you.

Mr. Schwartz, can you comment on how other states have enforced their laws and have actually been able to check and make sure that these companies are following the new law in the state?

Uh, Matt Schwartz again for the record. Yeah, it's a good question, and if we don't have decades of enforcement, um, history to really go off of, right, like this whole creation of state privacy laws began in 2018, 2019 with CCPA. A bunch more states have passed laws since then, but in recent years, and many of them are just going onto the books now. And so it's a little hard to say with certainty how this stuff will end up getting enforced. I will say, depending on the provision of the bill that we're talking about, Sometimes violations will be apparent to consumers in such a way that they could make a complaint to the AG.

In some cases, a potential violation won't be apparent to them. For example, it's not going to be immediately apparent to a consumer if they've requested a deletion and the business told them that they deleted the information and actually they retained the information.

I will say, you know, that is one of the benefits of adopting a standard that, you know, at least in concept and the general framework looks similar to other state privacy laws, because that will allow AGs to do multistate investigations of companies, which is happening a little bit more often these days. So some of the AGs that have had a head start, California, for example, have been getting more sophisticated on these issues and have been kind of growing their capacity to investigate in more technical ways whether companies are complying on the back end. It hasn't been, I would say, a great volume of enforcement on that, but it also hasn't been zero. And so this just seems like something that that states are going to learn over time. And that is also, you know, gets to the question of whether there should be a private right of action in the bill or not.

You know, in most other states, it's left entirely up to the AG to enforce the law. There is no private right of action. And, you know, the experience has been that AGs while well-intentioned, are often under-resourced and haven't been able to bring a great deal of cases to enforce the law. And so, I think that has led to— there's continuing to be a lack of compliance to a certain extent. And so, to us, that is one reason why a private rights action might be something worth considering so that it's not fully up to an AG's office that has a handful of staff to enforce this law, and other folks can take a look at, you know, helping consumers take advantage of their rights and rectify any violations that may have happened outside of the state.

Thank you. Additional question about that, and I know it's a limited amount of time and a limited amount of states, but do you believe that there, that in the states where laws like this have passed, that we've seen a change in behavior from the companies that this bill is targeting?

In my opinion, not enough. And that has to do with the fact that I think many of the laws that have passed in other states are not particularly strong. Substantively, and then they don't have those enforcement provisions I talked about either. And so I think the primary benefit to consumers in those states is that they have new procedural rights, which is not nothing, right? You now have the ability to opt out and grant and access and all, and all those things.

But at the end of the day, those states' standards, they kind of really substantiate provision of the bill allows businesses to continue to collect and use data so long as they disclose it in the privacy policy and don't veer from those promises that they've made. This bill, I think, takes a little bit of a stronger stance and says that businesses can only collect and use information if it's reasonably related to, you know, a product or service that a consumer has requested. And I think that type of standard will require businesses to change behavior and collect less information upfront, and especially so if that is backstopped with real enforcement. So that's why, you know, I think there's reason to think that this bill, if passed in its current form, wouldn't replicate problems that we've seen elsewhere. Thank you.

And I will just say for the record that we did invite Department of Law to be here, and we had somebody who was unavailable. But I agree with Representative Costello that we really need to hear from the Attorney General, um, because to me— and I'm happy for anyone to comment on this— but it just seems like we could spend a lot of time working on an enormous bill, but if there's never really enforcement of any reported violations then that would basically be sending the message to the companies that they don't need to comply.

Thank you, Chair Gray. I do just want to point out, I walked around to some of your offices and talked to your staff, and I can get this to you guys as well, but there are examples of enforcement starting to happen through the data broker side. I talked to California, and they just weren't willing to share the enforcement that was 'cause most things happen in settlements, share what those enforcements were. But there was an article that came out in February through Texas about them successfully reaching settlements for at least getting data brokers to register so we can actually know what companies they are. A lot of this is about finding out what this industry is and the length of it.

And so that if something does happen, we can be like, "Oh, it's coming from this business. It's coming— this is how they're doing it." And shining a light and transparency onto that. So I think in Texas it was like they had a one settlement for $1.4 billion and another one for $1.5. So there, there is enforcement happening. It's just at the beginning of that.

So through other mechanisms. Thank you, Ms. Holm. Representative Costello. Yeah, I have a question. So on a new topic, so are anti-discrimination —statute, which is Title 1880.

It actually goes through who it applies to. So my question is probably for the bill drafter. Why would we not simply add data consumers into that list of who it applies to and instead enumerate in the bill the anti-discrimination clause? To me that as a state would weaken our anti-discriminación laws because if we're now going into different titles throughout the entire body of law to say that there's— you are not able to discriminate, then it seems to me that you can make the case that if you don't say that, you then aren't protecting individuals, so why— I'm just wondering maybe the the bill drafter— and I know this law, this bill is probably based on other states, but if we could answer that question, why wouldn't we just go into our Title 18, 80, 220 and list the data consumers have to apply to what our anti-discrimination statute is for other entities? Mr. Walsh, did you hear the question?

Through the chair, for the record, this is Ian Walsh, Legislative Legal Services. I did hear the question. Representative Costello, I think the answer is that it's a policy choice how the discrimination laws are going to apply. So the approach taken in this bill is to add a subsection that specifically relates to anti-discrimination. Another approach might be to amend 1882-20.

They were probably different policy implications And I would be happy to discuss the sort of potential amendment of 1880.220 with you if you would like to. Okay. Thank you. Thank you. Representative Vance.

Thank you, Mr. Chairman. I am looking at the section on page 3 and the last 2 lines on there are pointing to the statute. And it says in AS 4548.885, provisions not waivable. So provides that a consumer's waiver of the provisions of the Act is contrary to public policy and is unenforceable and void.

And I'm wondering why that policy direction rather than letting a consumer have full rein over their data. And then the next one is liberal construction. It says provides the Act is remedial and shall be liberally construed. And I feel like those two are conflicting each other. So if you could give more insight as to the, the two and how they would work.

Ms. Holm. Chair Gray, Representative Mina, um, Kaylee Holm for the record. So the first one is, it's essentially, they're, uh, part of one of the larger issues with this is the level of fraud that goes on and using the data to manipulate to believing something and to giving up their money in a lot of aspects. And so essentially what We have seen a loophole is that they receive this policy or some kind of written policy and kind of click through it and don't fully understand and click and are just like, sure. And then all of a sudden all their rights are gone away when they don't fully understand it.

So the bill does give a lot of flexibility into individuals' rights. You can opt out, you can opt in, or opt in. And so This is just saying they can't essentially send, like, send something that you're not fully aware of, and you need to, for each thing, think about. So it's not really taking the control away from the individual. It's more just protecting the individual from a being unknowledgably saying yes.

And then the liberty constructed, again, that goes into making sure that just the policy stays up to date and flexible. Things change. A lot of times definitions change. A new technology comes out. And so the intent of this law is very, very clear.

You have these rights. So even though we didn't include, say, like— we did include this, but if we forgot to include pixel or something like that, it's the understanding that that is still, even though it's not listed, is going against the intent of the law. And so there's that flexibility there. I, I actually also like to just ask, uh, Ian Walsh, um, particularly to explain what liberal construction is. For the record, this is Ian Walsh, um, to the chair, um, Chair Gray [Speaker:JESSE] That's a— it's a good question.

And I don't have a succinct answer for you off the top of my head. But I think sort of essentially the idea is, as Ms. Holm stated, that the provisions of the bill, when they're being interpreted by courts primarily, perhaps also the Attorney General, will be liberally construed sort of in the— to achieve the policy intent that Ms. Holm indicated is clear. And liberally construed might be construed in a broad way to ensure that all these technologies are covered if there is some new technology, as Ms. Holm said. Although it's not, I think, totally clear the impact of this provision were a court to read it and try to understand how it interacts with the rest of the bill. I think it's not totally clear exactly what would— the result would be.

Representative Vance, follow up. I mean, this is a 33-page bill and we get consumer protection, but can you give some examples of real-world application of Alaskans, of how is this going to change their life? What does this look like? How are they going to interface with this?

Chair Gray, Representative Vance, for the record, Kaylee Holm. I am so I will not be able to do this as eloquently as Mr. Schwartz, but so examples are right now, think of minors under 18. They, there are, they say around 1,000 to 2,000 data points on everyone. That, those data points are used to find out your likes, find your interests. They can manipulate you through data.

So you think about, you talk about something and all of a sudden advertisements appear on your phones. Businesses and advertisers will use it to like maybe start putting vaping in front of younger kids to get them interested. The more you see it, the more likely you'll do it. So a lot of that bill just removes that ability to individually target somebody and manipulate them. There can be broad strokes, but they can't like target it.

So that's one. Fraud is another huge issue. The more information you have on somebody, the more convincing a fraud, somebody that's trying to scam someone is. Like, if you can say their children's names and where they went to school and provide information that is convincing. They've seen fraud, I think, went up like— don't quote me on this and I can look up the right number, but like I think 30% more than they expected 2 years ago.

And they point a lot to this as part of the way that it is convincing. This is again something that is not happening any longer, but they— there was a big article about Instacart where they saw your purchases. If you were making larger, more expensive purchases, then they were actually increasing the cost of groceries, I think, to the height of like 12 cents per grocery, which again is small right now, but if you think about instead of pricing to what your— the market can bear, you're pricing to what the individual can bear. And that's essentially a tax that's going into a business's pocket versus something else. So there are these large— there is a lot of identifiable harm already happening.

And as well as there's potential, like, that's what's happening now. What can happen if somebody has 1,000 to 2,000 data points on an individual is, um, pretty— like, it provides a lot of— knowledge is power, and it can provide a lot of influence. So I guess that's what I would— is my response, if I've followed me. Uh, thank you for, for bringing that back. I know that that was— now that you've refreshed my memory, the first introduction that was discussed.

Would this bill shift the way we interact with social media? Because there's been other bills wanting to restrict that type of targeted advertising to minors, you know, through social media bans, things like that. Would this bill kind of do a blanket for everyone, not only with, um, like you said, the grocery store, the Instacart, but also on social media? Would it impact those platforms.

Chair Gray, Representative Vance, for the record, Kaylee Holman. Yes, uh, it— as far as blanket, it gives you the option to say no, do not target me, do not profile me, do not sell my information. For, uh, minors, so 17 and under, it says you are not allowed to, um, target, advertise, and profile those individuals. So it doesn't restrict the use of social media, it doesn't restrict their engagement. It does say that like information that is somebody chooses to publicly share is publicly shared information.

So there still needs to be a lot of education on what is appropriate to share online in these medias, but you won't be seeing that targeted on the marketing side towards individuals, right? This is kind of a larger blanket for that. Thank you. Um, we'll go to Representative Costello and then Representative Mina. And then we're going to ask for the sponsor's position on the committee substitute, and then we will adopt— hopefully adopt the committee substitute.

So I guess I'm just going to say it. It seems to me that this is an issue that will affect every American, and what we're seeing is states starting to wake up to the problem and passing bills, and now we're— which happens. But what's happening on the federal level? Because one of the things that's running through my head is the fact that you've got these businesses, and so are they going to follow the laws? There's one set of laws in California, another one in Virginia, another one in Alaska.

It seems to me that they're seeing this happen. They might just be doing this anyway. And have we been in contact with our federal delegation about efforts at that level?

Yeah, through the chair. What— the answer is, actually, 2 days ago, there was a bill introduced. I believe it was called the SECURE bill. And they have— and I actually tried to provide documentation for the committee based on all the congressional research and previous bills. They were just locked, and so they weren't able to be uploaded.

But yes, there's been tons of work on it. I guess it's just— It is a big bill. It is, um, there are a lot of decision points. And so what's happened is it just, it stalls, um, it's just a very slow-moving thing. So we saw another one introduced 2 days ago, uh, the likelihood of it passing or not passing, I don't know.

So I think it's just, um, a more realistic lift to get it, um, to, and a quicker lift to get it done through the state. And then eventually if there is a federal regulation Then you reevaluate if it aligns, if it matches, if we need to adjust. Federal always supersedes state, so we could see if it's stronger, we need to make ours stronger or weaker based on that. But the answer is they have been trying. All of Europe has something that is stronger than anything that we have offered here in the United States, so— Would we love to see this through the federal government?

Yes. Has it happened yet? No. Is it going to happen in a time frame that ideally we'd like to see? I would argue that we already are slightly behind the curb because we're already seeing these rights.

And Alaska— Alaska, in our Constitution, we have a right to privacy that is currently being violated. So I don't know if we need— should be waiting for the federal government to pass something if we can pass something sooner. Thank you. Representative Mina. Thank you, Chair Gray.

Through the chair, I think I'm going to direct this question to Mr. Schwartz. So we heard a little bit about how the enforcement of this, this type of law can differ state to state depending on how funded their enforcement is and the capacity for their Department of Law. I guess my general question is, what are the basic tenets of this type of framework in other states, and how do different state laws compare and differ from each other besides funding and enforcement? Mr. Schwartz.

I think that— Matt Schwartz with Consumer Reports, again, for the record. I think the basic tenets of these state-level privacy laws are pretty similar across the states. So pretty much all of them create the same types of baseline consumer rights. So for example, they all have the same access, correct, deletion, opt-out rights. As you said, they've differed a little bit in terms of enforcement and their capability to do that.

But I would say in general, the basic framework of these bills, these laws, are quite similar, especially if you pull out California. The other kind of 20 states that have done this are, are more or less the same, and, and much of that's reflected in, in this, uh, in this bill before you as well. Thank you. Thank you. Um, Ms. Holm, Do you have a position on the committee substitute?

We are in support of committee substitute. Like was mentioned at the very beginning, we took in the— we've heard from businesses, we've heard from the committee. A lot of the questions that were asked at that very first committee hearing were considered when writing this bill. We heard from experts in the field and all of them said the intent of the bill is there. It just would be overly burdensome to businesses if they had to change like one word in order to comply for the state of Alaska.

And so if we could align the bill more with what is already being seen, it reduces that burden to the bill. It, it makes— so it can make compliance more feasible. It makes makes enforcement more feasible because then states can now work together if there is, um, in some kind of egregious act that they need to respond to. And so yes, and sorry, that was a longer statement than I said, but we're in support. Thank you.

Um, I remove my objection. I object. Thank you. Would you like to speak to your objection? Uh, there's still— this is robust there's still a lot of questions that we have, just not ready to accept it at this time.

At ease.

Back on the record. A question for the sponsor. Can you talk about why we did a committee substitute. Yes, Chair Gray, rep. The reason— so originally this bill was brought to us because it was flagged by a constituent that this was an issue.

We started looking into it and realized it was a very big issue. That's why almost— there's 21 states that have passed something, there's 15 that are working on this. And what I— and so when then we look back in our archives and, and we saw that, oh, we have been working on this since 2018 as well, It's gone through several committee hearings. So why reinvent the wheel? Let's start with what Alaska's already worked on really hard.

It was also had a lot of support from both sides. However, once— and so that's the bill we started with. And then once we introduced it, we realized, well, this was written in 2021. It matched the California bill. It wasn't in line with that industry.

So it was adding that extra burden that was unnecessary. So So we thought it was more appropriate to make this bill, um, again, more feasible for businesses to comply, easier to— uh, we just wanted to update this language to make sure that this bill was worthwhile but not adding extra burden to individuals. Thank you. And I'll just say that we're not passing this bill out. We're accepting a working document.

I believe that there are many changes in the CS based on our first hearing. I know that my staff worked really hard to make changes that were in alignment with some of the issues that came up during that first hearing. I think the committee substitute, no offense, is much better than the original bill. And so I'm going to ask the clerk to call the roll.

Representative Eichide. Yes. Representative Mina. Yes. Representative Vance?

No. Representative Costello? No. Representative Underwood? No.

Representative Kopp is not present. Chair Gray? Um, yes. 3 Ayes, 3 nays. With a vote of 3 ayes and 3 nays, we've failed to adopt a working document.

Thank you. I would now like to set— well, I can't set an amendment deadline. Uh, we will now set House Bill 367 aside and bring it up at a later date. Thank you, Ms. Holm. Thank you.

That concludes today's business for the committee. Before we adjourn, I would like to set an amendment deadline for SJR 2, constitutional amendment, votes needed for veto override, for Wednesday, April 29th, 2026, at 5:00 PM. Please work with my committee aide to ensure that amendments are submitted on time. The time is now 2:54 PM, and this hearing of the House Judiciary Committee is adjourned.