An inside look into how a coalition of state legislators plans to take on data brokers

Democratic Vermont State Rep. Monique Priestley is one of the top state lawmakers in the country focused on data privacy legislation, having introduced four relevant laws in her state. After the June slaying of a Minnesota lawmaker and her husband by a gunman in possession of a list of data brokers, state lawmakers from across the country reached out to Priestley to launch a joint effort to craft and push through new laws to rein in data brokers. 

Her campaign kicked off earlier this month with a virtual call including lawmakers from more than two dozen states, many of whom are now focused on enacting legislation to better regulate data brokers. 

Priestley spoke about the early results of the effort for the first time with Recorded Future News, sharing how the multistate group of legislators she is leading were galvanized by the slayings, what lawmakers are saying about their plans and what’s next for the movement she has started.

This conversation has been edited for length and clarity.

Recorded Future News: You recently led a convening of legislators from several states who came together about potentially drafting new state laws in response to the slaying of a Minnesota lawmaker. She and her husband were killed by a man who allegedly had a list of data broker people search sites in his car. What drove your decision to get lawmakers from so many states together?

Monique Priestley: As soon as the killings in Minnesota happened, I got a number of different text messages and calls from legislators in other states who knew that I'd worked on data broker regulation proposals, asking what they could do, where they should start and how can we solve it.

RFN: What did the Minnesota lawmakers on the call say about their experience being targeted and how that influenced their wanting to participate?

MP: We heard a personal story from State Rep. Kristin Bahner from Minnesota [whose home was visited by the guman]. She had grandchildren with her and they had been out of their house. The shooter had gone to her house at a moment when they could have easily been home. It was just a very powerful moment where she was talking about [how] lawmakers’ information is public record. But then there's also just other instances where family members have been targeted or end up being at the same location. The story she told gave me goosebumps.

When the Minnesota shootings [happened] and the chase [for the suspect] was on, I was at a town hall and my phone was blowing up. There was a flurry of messages where people were checking in on each other. A few of us were concerned about Steve Elkins [a Minnesota state representative who was on the shooter’s target list] and then he said, ‘I'm being guarded.’ But Kristin just had somebody show up to her house. It was a moment of shared terror for our colleagues … where everybody was wondering if this was a hyper Minnesota-focused attack or was it going to be more national. 

RFN: How would you describe the momentum in the room at the convening? You've been working on data privacy for a long time, including on how to combat what data brokers do. You've been watching this. Do you feel like there is a new level of energy and commitment to getting something done after what happened in Minnesota based on the tenor of this initial multistate steering committee meeting?

MP: The intensity and the urgency was felt on the call because of Minnesota, but it was also an interesting call because I have worked so closely with so many of the legislators, or adjacent to some of the legislators that showed up, on artificial intelligence and data privacy legislation. It's a group that is highly technical. They understand the space and also understand how intense the lobbying efforts can be.

RFN: How many states were represented at this meeting?

MP: At one point we had just under 40 participants and there was some overlap where a few states had multiple folks. I think it's safe to say we had at least 25 states represented.

RFN: How many of the states expressed interest in moving forward and trying to draft legislation to rein in data brokers?

MP: Fifteen states expressed immediate interest and that doesn't include people who already had expressed interest. It's safe to say that there's going to be at least 20 states that are interested in doing [legislation to rein in data brokers], if not more, depending on how much we can get the word out that we're trying to work together on this.

RFN: What is the significance of the multistate steering committee model and how has it been used to push privacy legislation forward across states in the past?

MP: The importance of establishing some kind of working group across different states is to make sure that we're working off of shared frameworks and definitions not only for our own benefit, but also for the benefit of industry that needs to comply with this. 

So many of us are part-time and may or may not have staff. We're also up against a multibillion dollar industry and so [we are] able to share educational information, bring in experts to talk and share the political landscape, the lobbying landscape and the resources that it takes to get a bill over the finish line.

RFN: Did you find that lawmakers who may be more hesitant to have very strict comprehensive data privacy legislation in their state were more amenable to data broker legislation that would protect lawmakers and other public officials?

MP: I definitely see that. One state [lawmaker] mentioned … that this is the type of legislation where they see a perfect fit for really trying to champion a private right of action [which most states have left out of other data privacy legislation].

RFN: Meaning that individuals can sue if the law is violated.

MP: Exactly. 

RFN: You’ve introduced several data privacy laws in Vermont and have said the lobbying effort to defeat your bills has been intense. Tell me about that.

MP: What I ended up sharing with lawmakers on the call was that there were some personal attacks. There was an ethics complaint threatened [saying that Priestley doesn’t live in her district, which is untrue]. I actually think that the purpose of threatening to file an ethics complaint that I don't live in my district was [meant] to get my address in public, basically in evidence, to be able to doxx me. …

We had [a lobbyist] show up in our cafeteria and she was talking to members of my committee.

RFN: So this is a data broker industry lobbyist?

MP: One of the big ones. The other [lobbying] entity that was getting involved was the automakers’ [lobbying association]. … [The data broker industry association] established a national PAC to fight data broker laws.

RFN: Can you talk about the different types of data broker legislation the multistate steering committee is exploring?

MP: The three buckets that we ended up discussing [includes] data broker registry legislation. Only Oregon, Vermont, California and Texas have data broker registries right now. For some states, it makes sense to start there. 

RFN: Why?

MP: In order to see the whole map of brokers who are active in a state. The second one was a Delete Act — this is modeled after the California Delete Act — allowing anyone to have their information deleted from data brokers by utilizing a registry to do so.

RFN: And to do so all at once, not having to go to each broker?

MP: Exactly because in some cases there's hundreds of data brokers active in any state. Jeff Jockisch [a data broker expert] from ObscureIQ, has a database of like 8,600 brokers internationally. So that's too much for people to be able to manage deletion requests on their own, through each entity. 

Also, data brokers generally have a third-party relationship [with the consumer] meaning that I don't necessarily know which brokers have my information because I didn't necessarily share it with a broker. I shared it with a first party, some other company, who then the data brokers got that information from, and so it provides some transparency for people to see who is buying and selling their data. 

The other [potential law discussed] is Daniel's Law modeled after New Jersey legislation that allows judges … and cops to remove their personal information, like home address and other contact information from people search engines. 

RFN: Getting inside the room, what did some of the experts on the call say that may have been particularly alarming about how data brokers operate? 

MP: People are buying and selling pieces of people's identities all the time, constantly, in order to have hyper-focused ads. That just means we are more at risk of companies selling everything that we like on Facebook and, in some cases, who we're talking to and where we're traveling and what we're eating and where we're staying at hotels and who we're friends with. All of that is now involved in a constant auction for our eyeballs. 

RFN: Did some of the lawmakers on the call indicate that that was new information for them?

MP: In general, there was a lot of surprise from people as far as the extent to which stuff is happening and how easy it is to get people's personal information. I told a story of being in my committee in House Commerce and in the time it took another member to ask a witness a question I paid 95 cents on Spokeo and got all of the home addresses for everyone on the committee and all of their family members [including addresses].

RFN: For people who say, ‘Oh, well, you can just go to the courthouse and get this information,’ what is your response to that?’

MP: It takes a lot more energy to physically go into a courthouse or go into a town hall to get somebody's address than it does in the heat of a moment when they're angry or they want to kill to go online and pay 95 cents and get your information.

RFN: What was the mood on the call?

MP: There was a mix of a lot of anger from people on the call and wanting to do something. There was also a level of despair expressed — is it too late to do anything? And also an expression of hopelessness that it is too late.

RFN: Is it too late, meaning all of our addresses are already out there?

MP: Exactly. But the great thing about that kind of question was that it was met by myself and others expressing that it's not too late and we have a real opportunity to funnel all of our anger and fear into working together to create change.

RFN: What's next?

MP: A number of different lawmakers have reached out with a request to share resources and be a part of a working group. Members of civil society and experts who were on the call have expressed an interest in helping.

RFN: This working group would be for lawmakers who want to actually draft legislation?

MP: Yes and actually, today I had a follow up call with the Minnesota reps who were on the call, Steve Elkins and Kristen Bahner, talking about the fact that this is a moment where, in particular, Minnesota can lead on this because they saw the effects of what it means to not have this space regulated.