Assembly Standing Committee on Privacy and Consumer Protection

All right, good afternoon, everybody. Welcome to the Assembly Privacy and Consumer Protection Committee hearing. I want to just start by welcoming everybody to our first hearing of the new year. Very excited to welcome a number of new Members to the Committee and some fantastic new Members of the Legislature. So we're excited to have them here with us today. And I will take a point of personal privilege to congratulate Assembly Member Wong on his recent nuptial. So it is nice to congratulations for that.

We are going to do a little housekeeping today, and hopefully some of our Members are going to join us, but relatively soon. So this is a invitation for all Members of the Committee who are not here to come join us. Thank you, Assemblymember Wicks. We can get started now. So here are the disclaimers. To effectively manage our time today, we will be limiting testimony to two witnesses for both support and opposition on each Bill. Each witness will be allowed three minutes to present their testimony.

After the support witnesses conclude their testimony, the Committee will call up additional supporters. No further testimony will be permitted. Additional supporters may only state their name, affiliation and position for the record. The same process will be followed after the opposition witnesses conclude their testimony. At that time, additional opposition will be called. They may only state their name, affiliation and position for the record. For this hearing and until further notice, the Committee will be returning to in person testimony only as reflected in the file notice.

However, we are accepting written testimony through the position letter portal on the Committee's website, which should give everybody an opportunity to weigh in. Who would like to. We have eight bills on the agenda today, and the following bills. Five bills have been approved for consent. AB 302. AB, 479. AB 522. AB 534. AB 801. However, as this is our first Bill hearing for the Committee for this Session, we need to adopt the Committee rules.

And I see that we are going to establish a quorum, and then I will be happy to entertain a motion so that we can adopt our Committee rules. So, Madam Secretary, can we establish a.

[Roll Call]

All right, we have established a quorum. At this time, I'm prepared to entertain a motion to adopt the Committee rules. We have a motion from assemblymember Wicks and a second from Assemblymember Wilson. Madam Secretary, please call the roll.

[Roll Call]

Okay, congratulations. We have rules. And since we like to do things in a very efficient manner here in this Committee, I will be happy to entertain a motion on the consent calendar at this time.

Okay. We have a motion by Assemblymember Wicks and a second by Assemblymember Wilson. We have five bills on the consent calendar, so we have the motion on AB 749 is Irwin do pass and rerefer to the Committee on Accountability and Administrative review with the recommendation of the consent calendar.

AB 522 Kalra, do pass and re refer to the Committee on Public Safety with the recommendation of the consent calendar, AB 534 McCarty, do pass with a recommendation of consent calendar, AB 801 Patterson, Joe Patterson, do Pass, as amended and rerefer to the education Committee with a recommendation of consent calendar. And AB 302 Ward, do pass as amended, and rerefer to the Committee on Appropriations with a recommendation to the consent calendar. Madam Secretary, you may call the roll.

[Roll Call]

All right, the consent calendar is approved. So now we can turn to business before us. We are going to handle the bills in sign in order. So first up is Assemblymember Nguyen with AB 386. Assemblymember, a motion by Assemblymember Fong and a second by Assemblymember Wilson. Assemblymember.

Thank you. Thank you, Mr. Chair. And know about two days ago, I received a text message. And the text message said, my PayPal account has been compromised and it listed a bank. So two things. One, I do not have a PayPal account. But two, they got the bank correct. And me in my 40s know that this was not real. This was not real.

And I can probably imagine and assume that every single one of you up here has received either a text message, a phone call, or even an email stating that your bank has been compromised or some sort of account has been compromised. Well, in 2031, in five Californians will be over the age of 65. That is double the amount of the population of over 65 today. And we know this, the population that is over 65 are targeted for financial abuse every single day. Every day.

And so our Bill here, AB 386, is going to help curtail the rising rampant financial attacks against our seniors. I can tell you this right now, if you are a victim of a financial crime, the one thing that they will do, the first thing they'll do is an investigation. But the investigation only goes 30 days prior to the incident and 30 days after. That is not enough time to take a look at your spending habits to see whether or not this really is financial abuse.

This Bill will ensure that there are 90 days prior and 90 days after existing laws now are not making it so. That way the investigators have access to information so that they can better do this job. This Bill will address that as well, too. I'll also say that the credit union League recently raised some concerns around privacy and we've worked with them to amend the Bill to try and address their concerns. And with me today, I have Amanda Kirchner from the County Welfare Directors Association and Maria lawyer representing Riverside County. Thank you.

Good afternoon, Mr. Chair and Members. Amanda Kirchner on behalf of the County Welfare Directors Association, we are the sponsor of the Bill and I want to thank the author and her staff, as well as your Committee staff for their work on this issue. As we know, elder abuse, particularly financial abuse, is unfortunately underrepresented in our seniors due to the stigma and the fear of losing Independence. The financial cost of seniors nationwide is in the billions annually.

So AB 386 helps our adult protective services investigators change the review process so they can look at a greater number of financial documents, as well as a long term pattern over a greater amount of time so they can look at some of these scams that are coming in for fraudulent transactions as well as change of address forms for identity theft. We appreciate the issues that were raised by the Credit Union League and we are in conversations with them to address those concerns.

Happy to answer any questions, but I'd like to turn it over to Maria Louira, who is here from Riverside County and their Department of Public Social Services.

Good afternoon, everyone. I am Maria Louira. I am with Riverside County Department of Public Social Services, the adult services division. So financial abuse a little bit closer to. Does that work? Okay, thank you. So financial abuse is a growing concern in many counties statewide, our county being one of them. About one third of all of the allegations that come into our system that have a suspected abuse by other are actually related to financial abuse.

Let me give you an example of an 85 year old female that we had recently. She did everything right and saved up about $1.2 million to take care of her end of life needs and make sure that her care was secured throughout the rest of her life. Let's call her Mrs. Smith. Mrs. Smith didn't have any family Members. She's widowed. She didn't have any children, and she actually met an alleged perpetrator at a casino.

He quickly befriended her, added himself to the bank account, went and obtained a power of attorney to submit to the bank. Despite knowing that Mrs. Smith was diagnosed with dementia. Dementia is the most commonly reported behavioral health condition. When we talk about alleged abuse and reports of abuse that come in through our system, this alleged perpetrator was able to take advantage of her and intervene so that she wouldn't have access to her bank statements or her mail in any way.

And he isolated her from any of her neighbors and any other friends that she had. We were not able to obtain information from the banks for her. I apologize from the client, because she was demented, no friends or family. We requested records from the alleged abuser, who was also her authorized rep. And he was very hesitant.

So during the time that we were in the process of obtaining a certification and then retrieving the bank records, this alleged abuser ended up purchasing two vehicles and further taking her account down and spending down her $1.2 million to $400.

So the current statutes, as they stand, really inhibit our ability to initiate an investigation quickly, and that really translates into our agency leaving folks vulnerable and opening up a window of susceptibility where if we had acted sooner, we may have been able to safeguard her assets in a different way, and she would have had more than $400 for the rest of her care. Thank you.

Thank you very much for that testimony. We will now see if there's anyone else in support of this Bill in the rim that would like to testify.

Sarah Dukett, on behalf of the Rural County Representatives of California, the Urban Counties of California, and the Riverside County Board of Supervisors in strong support.

Okay, thank you very much. At this time, we'll invite up witnesses in opposition.

Good afternoon, chair and Members. Robert Wilson with the California Credit Union League. I just want to start this off by thanking the author, staff, and sponsors for recent amendments in the Bill. Those did cause calm our biggest concerns with the Bill. Our credit unions are still a little concerned with the 90 days on both ends. It's going to increase the amount of records that are to be pulled, and those time frames have always been in place to ensure financial protection for individuals.

So we look forward to conversations with the author and staff. Want to thank the Committee and its staff for their great work on the Bill and look forward to continued conversations. It's an important issue. Credit unions take it very seriously. Thank you. Great.

Thank you very much. Is there anyone here in the room in opposition to the Bill? Okay, seeing none, we will bring it back to the Committee for questions. Comments.

Assemblymember Bauer-Kahan

Thank you, Mr. Chair. I just want to commend the author for the 90 day extension of someone who used to do investigation. I think it's really important to have the most information, and in these days, all records are kept electronically, and casting a net that's 60 days longer doesn't seem like an overdue burden for what could be really beneficial to California seniors. And so this is a really important thing to protect our most vulnerable, and I'm looking forward to supporting it.

Thank you, Assembly Member. Anybody else? Okay, well, I also want to align my comments with my colleague from Mirinda. Thank you, Assembly Member. Really, really important issue. Obviously, statistics suggest that one in 10 older Californians are victims of elder abuse and often defrauded. I think probably a lot of folks up here have had experience with older relatives who have, as they've aged, has struggled with cognition or other things that have made them particularly vulnerable.

And elder financial abuse can rob people of their life savings and also rob them of their dignity. And so I think that your efforts to help protect our vulnerable, aging seniors is very commendable. So I appreciate you bringing this Bill forward. I also want to commend you for working with the opposition. They are some of the good folks in the financial services space, so I know have the best interests of our communities at heart.

And so I appreciate the work you've done to take into consideration their comments. Understand that conversations are going to continue, and so applaud for that. And so with that, happy to support the Bill today. Happy to have an aye rec. And we have had a motion and a second. So with that, madam. oh, you may close if you wish.

I respectfully ask for aye vote.

All right, thank you very much, Madam Secretary.

[Roll Call]

Congratulations your Bill is out.

Thank you.

Thank you. All right, Assemblymember Lee, you are up. We have a motion by Assemblymember Bauer-Kahan. Second by Assemblymember Lowenthal.

Thank you. May I begin, Mr. Chair, chair Members, good afternoon. First, I'd like to thank the Committee staff for their work, and I accept the Committee's amendments which remove all opposition from this Bill. In the pandemic economy, many businesses have had to pivot to food delivery services to survive. It is incumbent upon us to ensure that all parties involved have clear information to make decisions that best suit their needs.

When I introduced AB 1444 last session to prohibit platforms like Yelp from listing third party phone numbers under businesses to charge referral commissions on forwarded calls, which this the Bill to do so today, Yelp actually changed their policy and ended this practice. AB 502 will codify this practice in statute to ensure that listing services do not post phone numbers that do not go directly to the restaurant so we can protect our small businesses from unscrupulous charges.

Consumers have a right to know exactly where their money is going, and the Bill provides greater knowledge. Consumers make informed choices. We must provide the necessary tools and protections to our small businesses so they're able to survive, recover and thrive. Respectfully ask for your ivote.

Okay, thank you very much, Assemblymember Lee. Do we have any witnesses in support? Okay, seeing none. Any witnesses in opposition to this Bill? You can have a seat, Dylan.

I'll be brief. Thank you, Mr. Chair. Dylan Hoffman, on behalf of Technet, appreciate the author and the Committee staff for the amendments, and we'll be removing our opposition. Thank you.

Thank you. Anybody else in the Committee room? All right, bringing it back to the Committee. Any questions? Summary Member Wicks?

No questions. I just want to thank the author for bringing this Bill back again. I think transparency is key, particularly for these types of apps, and I'd love to be added as a co author.

Thank you so much, Mr. Lowenthal.

Yeah. First of all, I commend you on the Bill. I made a career out of what's called intercarrier compensation. The cost of one carrier to make a phone call to another carrier, sending it into each other's network is not the same everywhere across the United States. To call to rural areas, they receive a higher amount than in other areas, and there's actually a lot of gaming that takes place in the system.

So phone companies that are providing phone numbers to services like these, there's actually a huge arbitrage involved here, and what you're doing is stamping out that arbitrage. I'm not even sure if you're aware of that economy amongst phone carriers themselves. So this exists everywhere. It is actually the economy that supported freeconferencecall.com, where you dial into a service that's free, but there's actually a payment for receiving the phone call. So I commend you on this completely.

There is actually a lot of this that takes place throughout the economy everywhere. We should find it and stamp it out.

Thank you. Thank you very much for that. Assembly Member, any other questions or comments from the Committee? All right, we're very fortunate to get some lived experience on this issue. So, Assembly Member, I also want to commend you for bringing this forward. I want to commend you for your continued work in this area. I view this as a common sense measure to protect small businesses. Our restaurants have struggled so much during the pandemic, something very near and dear to my heart.

And I know a lot of folks here sitting up on the dais and so appreciate your work standing up for them. They are still struggling, particularly with inflation and everything else that folks are going through, so I appreciate you doing work for them. This is similar to Bill that passed easily out of this Committee in 2021. I think you've heard support from the Members. I'm also happy to support it today.

And I do want to thank you for working with staff and for working with opposition in a very thoughtful way to address people's concerns. So thank you. Happy to support the Bill today. And you may close if you wish. Okay, I will take that as your close. Madam Secretary, please call the roll. The motion is due.

Pass as amended, AB 502 by Assembly Member Lee. The motion is do pass as amended. [Roll Call]

Congratulations. Your Bill is out. Okay. We are going to turn to our last Bill of today, which is mine, seen as how our Vice Chair is not here. I'm going to issue this as a personal invitation for the Vice Chair to come join us. But in his absence, I'm going to turn the gavel over to Mr. Fong.

Mr. Chair, you may proceed when ready.

Thank you, Committee Members. I am proud today to present AB 740 and I'm proud to co author this Bill with Assemblymember Petrie Norris, whose Bill, AB 955, was also referred to this Committee, and the contents of AB 955 have been incorporated into this Bill. So it is a joint effort to provide greater cybersecurity for drones, which are being used at all levels of government. So Caltrans uses drones to inspect bridges and other critical infrastructure.

CAL FIRE uses drones to assess wildfires and determine where to best deploy firefighting resources, and local police departments deploy drones as part of rapid first response when crimes are reported. Yet we have virtually no cybersecurity or privacy standards in place to govern the data collected and transmitted by government drones. This is in mark contrast to the Federal Government, which, in a series of bills and regulatory actions, has banned federal use of drones that are viewed as representing a threat to national security.

Many of the drones banned for federal use but continue to be used in California are manufactured by firms based in China. Chinese national law requires businesses to turn over sensitive data to the government on demand, and actually, people can face sanction if they fail to turn that information over. In response to the lack of state cybersecurity standards for drone use, AB 740 would do two things.

First, the Bill would require the California Department of Technology to issue regulations to ensure the confidentiality, integrity, and availability of data that the drones collect, transmit, and store. These regulations must, at a minimum, ban state and local government entities from using drones that federal law prohibits the Federal Government from using. The regulations would also ban state and local governments from selling data collected by drones.

Second, this Bill would require the Department of Technology to establish requirements for the sale and for state and local governments to comprehensively plan to phase out the use of drones that don't comply with these regulations. Governmental entities would have two full years, until January 12026 to discontinue the use of their noncompliant drones.

The alternative to passing this legislation is to leave the status quo in place, which means continuing to allow the use of drones for vital operations, exposing information about California's critical infrastructure and its methods of law enforcement response despite well documented cybersecurity vulnerabilities. To testify in support, I have with me Ben Hussich from Skydo, the bill's sponsor, and Kate Bell, on behalf of the Association of Uncrewed Vehicle Systems International. Thank you and respectfully request your aye vote.

We'll now move to witnesses and support. Please proceed.

Chair Gabriel, Vice Chair Patterson, Members of the Committee, thank you for the opportunity to appear before you today. My name is Ben Husch, Director of policy and community affairs for Skydio, the largest US drone manufacturer headquartered in San Mateo. I am happy to present this statement today in support of AB 740.

We are honored to testify alongside Ms. Banks, who, as I understand, will present remarks on behalf of Aubsi, the world's largest nonprofit organization dedicated to the advancement of uncrewed systems and robotics, which represents professionals and corporations from dozens of countries around the world. Originally developed as consumer toys, drones have evolved into critical tools that are often connected to the Internet.

As a result, drones are now part of the Internet of Things, the web of network connected devices on which government agencies and individuals alike rely to provide useful services every day. Because iot devices have the capability to connect to public networks, public and private organizations are increasingly taking action to ensure these devices comply with cybersecurity standards. AB 740 takes a measured approach to ensuring that drones used by state and local agencies in California are secure.

The Bill would require the creation of basic standards on the confidentiality, integrity, and availability of data collected by UAS. It would also ensure consistency with U. S. Export control laws and the threat represented by countries of concern. And with good reason. It would make little sense to establish cybersecurity standards but ignore the threat represented by nations with the capability and the intent to exploit those standards.

If you care about privacy, you care about protecting against nation state threats that could defeat even the most rigorous privacy protections in this sector. The threats are not just hypothetical. In October, President Biden's Defense Department placed the largest drone manufacturer, DJI, a company based in China, on the list of Chinese military companies operating in the United States. DJI is subsidized by the Chinese government and unfortunately has a nearly 80% of the state and local state and local public safety drone market.

In 2019, Congress banned the US military from using drones made by companies in China due to the threat of data exploitation. The threat stems from the obligation of DJI and other companies to comply with China's national security laws, which give the government the ability to demand the provision of information at will without due process. Apart from the cyber threat, DJI was placed on the US entity list for activities related to China's suppression of human rights of the Uyghur people.

It is important to address this issue in a measured manner that gives agencies time to transition. AB 740 does exactly that. In General, agencies would have until 2026 to become compliant. This nearly three year period from today will give agencies time to transition their fleets and take advantage of multiple budget cycles. We believe this period is critical. California agencies use drones to conduct valuable missions. It is important to transition to secure drones, but on a timeline to avoid undue disruption. AB 740 satisfies that objective.

In addition to a thoughtful transition period, the Bill also includes waivers and exemptions. Chair Gabriel and his staff correctly identified that there will always be special and unanticipated circumstances that require flexibility. This provision ensures that agencies will be able to conduct important missions without disruption even after the transition period. I appreciate the opportunity to appear before you. Today, we are grateful to the Committee for Advancing Privacy, security and Innovation in this thoughtful legislation. Thank you.

Good afternoon. Kate Bell on behalf of the Association for Uncrewed Vehicle Systems International, we strongly earn support of AB 740 and applaud the authors for bringing this forward. Drones of the future advanced Aviation the benefits of drone operations range from saving lives with drones as first responders, saving taxpayer money, enhancing safety, using drones for infrastructure inspection, and building a 21st century aviation workforce, just to name a few. All of that promise, however, is at risk if we do not take drone cybersecurity seriously.

AUVsi, through our trusted cyber program, has developed the green UAS compliance platform to assess and verify commercial drones through a security controls assessment and vulnerability and penetration test. We believe that by ensuring that drones meet a high standard for cybersecurity, we're ensuring the product and operational security and also establishing the US drone security is set apart from other certain foreign manufacturers.

By establishing the cybersecurity standards for drones, California would be ensuring that data obtained by drones, as well as the drone itself and the operation, are operating at the highest level of trust. This would help to combat the very real threat posed by the Chinese drone operating in the United States, effectively ensuring that they would no longer be used in California again in a range of two years. We applaud the authors and supporters of AB 740 for their leadership and urge respectfully ask for your aye vote.

Thank you very much. Are there any other individuals that would like to come forward in support of this Bill? Please state your name, organization, and position.

Brandon Knapp. Brandon Knapp with Corbin and Kaiser, representing Privacy Rights Clearinghouse, in support.

Thank you very much. Seeing no other individuals in support, we'll now move to witnesses in opposition. Any witnesses in opposition? Seeing none, we will bring it back to the Committee. Any questions?

Well, I want to thank some of them are Gabriel, this keeps coming up. As technology changes, so too must our laws. So I really appreciate the work that Skydio does. Being based in my district, I really appreciate the work that Skydio does. But I do think our time has come as it relates to unmanned air vehicles. And I feel very comfortable that we're doing this, and you've been most reasonable to allow the phase in. So thank you so much.

Thank you.

Ms. Bauer-Kahan, go ahead.

Thank you. I just would like to echo our colleagues comments and commend the chair on this really important work. Obviously, the data that can be gathered with these drones is really, really critical. The one thing I will I know this is not the fiscal Committee, and this will come down the line. But I was just with my fire Department the other day that uses these for really critical firefighting work, and they've spent tens of thousands of dollars on drones that this will likely phase out.

So we as a Legislature need to make sure that we're supporting our local agencies who can't afford to replace everything on their own to make sure they are protecting our privacy and have the ability to do the important work that they use to these drones for. Thank you.

Thank you very much. I also echo those comments as well, Joe,

Thank you. And thanks for fabulous Vice Chairman job there. So prior to being elected to the Assembly, I was on the Rockland Public Safety foundation and we would purchase what we called extras for our Police Department. And we did actually purchase three drones for the Police Department. I have no idea where they're from or anything like that.

But I do have some concerns, honestly, about until sometimes regulations go a little bit longer than we ask them to do regulations. So I'm a little concerned that basically they're going to be very limited vendors for the next, hopefully just 18 months or so.

Just wanted to say that maybe just as this Bill moves forward that perhaps there could be a provision that says, hey, well, until the regulations are created, you can continue to whatever purchasing you're able to do until that time, because there's also the software, because that's where a lot of the money is, is from the software, obviously, not just the hardware. So I do get a little uneasy about what's going to happen sort of in the interim until the regulations are made. But that said, I think it's a great idea to do this and thank you for bringing it to us. Would you like to respond?

Yeah, thank you very much. I appreciate the thoughtful comments. I think they're both excellent points. We've tried to think about how we might strike a balance here and obviously are open to continued conversations on those things. You'll notice, remember, it's not an outright ban on this. So we're giving localities an opportunity to make the argument that they need specific drones from specific manufacturers if the other purposes can't be intentioned. I think the concern that we had was threefold. It was about our national security.

Obviously, the idea that we would have Chinese drone manufacturers that were making drones surveying critical infrastructure in the State of California required by law in China to secretly turn that information over. Required by law in China to turn that information over. And so that's why we did this, all in reference to federal law, the National Defense Authorization act, what the intelligence agencies have told Congress we should be concerned about. So that is a primary motivation for this.

Also protecting the privacy rights of Californians, which I think is something that's very important to all of us. And third, something very important to me. The manufacturer of approximately 80% of these drones, as you heard, is a company that has been implicated in genocide against the Uyghur people in China. So I think for a lot of different reasons, both consistent with our values, consistent with our national security, consistent with protecting the privacy rights of California, this is something that we need to do.

But we do hear the fiscal concerns, we do hear the concerns about putting folks in an uncomfortable and difficult position, and that's why we're trying to find a way to strike the appropriate balance, and we'll continue to have those conversations as this Bill works its way forward.

Thank you very much. Would that be your close or would you like a closing statement?

I will respectfully request an aye vote.

I think we have a motion and a second, ma'am. Secretary, please call the roll.

AB 740 by Assembly Member Gabriel. The motion is do pass and re refer to the Committee on Accountability and Administrative Review. [Roll Call]

Congratulations, Mr. Chair. Bills out.

We're going to go back. Okay. We're going to go back. Thank you very much, everybody. So we aim to run an efficient Committee here. So that is what.

You want to do add ons? Yeah. We're going to do an opportunity now for Members to add on. So let's go back to AB, starting with AB 386. Nuen, which was the first Bill? Well, actually, let's do the consent calendar first. So, Madam Secretary, can you call the roll on the consent calendar?

[Roll Call]

Ok, the consent calendar, that is unanimous. What? Wait, no, that was for consent. Okay. All right, we're now going to go to file item number three, AB 386, new Min. Madam Secretary, can you call the roll.

AB 386 by Assembly Member Nguyen? The motion is do pass and refer to the Appropriations Committee. [Roll Call]

That Bill is out 11-0 and we are going to go back to file item two, AB 502.

[Roll Call]

That Bill is out. 11 to zero has everyone good? All votes on everything? Okay, do we need to go back on the Committee rules right now?

No.

Okay. All right. That concludes a very efficient hearing. Thank you, everybody. We will see you next time. This hearing is adjourned.