Florida may be next state to join the growing number of states with a consumer privacy law, as both chambers of Florida’s legislature are currently considering comprehensive state privacy legislation.  Both HB 969 and SB 1734 resemble the California Consumer Privacy Act (“CCPA”), though they contain some notable differences.  Florida Governor Ron DeSantis expressed support of these measures, stating that these proposals “finally check these companies’ unfettered ability to profit off our data and ensure the protection of Floridians’ personal and private information.”

Scope of Covered Entities

Both bills impose obligations on “businesses,” though the bills include different thresholds for entities to qualify as a “business.”

• HB 969 defines businesses similarly to the CCPA, but captures entities doing business in Florida instead of California.
• SB 1734, in contrast, defines a “business” as a for-profit entity that does business in Florida, collects personal information about consumers, determines the purposes and means of processing personal information, and satisfies at least one of the listed thresholds: (1) annually buys, sells, or shares personal information of more than 100,000 consumers, households, or devices; or (2) derives 50% or more of its global annual revenues from selling or sharing personal information about consumers.

 Exemptions

Both bills provide exceptions for certain types of entities or processing activities.  For example, neither bill applies to non-profit entities; entities subject to HIPAA; certain transfers of personal information to a credit reporting agency in accordance with FCRA; information collected, processed, or disclosed pursuant to the GLBA; or educational information covered by FERPA.

Personal Information

Both HB 969 and SB 1734 mirror the CCPA’s definition of personal information, including information that is  reasonably capable of being associated with a particular consumer or household.  Notably, SB 1734 also requires a business to obtain the consumer’s consent before processing “sensitive data,” though sensitive data is not defined by the statute.

Consumer Rights

Both the House and Senate bills provide consumers with certain rights, including access, portability, correction, and deletion rights.  Additionally both the House and Senate bills provide consumers with a right to opt-out of the “sale” of personal information.  The definitions of “sale” include the transfer of personal information “to another business or third party for monetary or other valuable consideration,” subject to certain exceptions.

• HB 969 also requires that businesses provide consumers the right to opt-out of the sharing of their personal information, and it defines “share” to include disclosing personal information for advertising, though notably, the bill does not define what activity qualifies as “advertising.”
• SB 1734 provides consumers with a right to opt-out of the processing of their personal information for targeted advertising and certain profiling activities, similar to the approach taken by the recently passed Virginia Consumer Data Protection Act. “Targeted advertising” is defined as “displaying an advertisement to a consumer when the advertisement is selected based on personal data obtained from a consumer’s activities over time and across businesses, websites, or online applications.”  The bill defines “profiling” as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”

Enforcement

Both bills empower the Florida Attorney General to enforce the statute, though HB 969 also contains a limited private right of action.

• Under HB 969’s private right of action, a consumer could bring a civil action for certain violations of the statute: (1) failure to protect nonencrypted and nonredacted “personal information” or email address, in combination with a password or security question and answer, that would allow access to a consumer’s account; (2) failure to delete or correct personal information in response to a consumer request, or (3) continuing to sell or share his or her personal data after the consumer chooses to opt out.  Although SB 1734 originally included a private right of action, this provision was struck in the latest amendment adopted on April 7th.
• Both bills grant the ability for the Attorney General to adopt rules for implementation.