Florida may be next state to join the growing number of states with a consumer privacy law, as both chambers of Florida’s legislature are currently considering comprehensive state privacy legislation.  Both HB 969 and SB 1734 resemble the California Consumer Privacy Act (“CCPA”), though they contain some notable differences.  Florida Governor Ron DeSantis expressed support of these measures, stating that these proposals “finally check these companies’ unfettered ability to profit off our data and ensure the protection of Floridians’ personal and private information.”

Scope of Covered Entities

Both bills impose obligations on “businesses,” though the bills include different thresholds for entities to qualify as a “business.”

  • HB 969 defines businesses similarly to the CCPA, but captures entities doing business in Florida instead of California.
  • SB 1734, in contrast, defines a “business” as a for-profit entity that does business in Florida, collects personal information about consumers, determines the purposes and means of processing personal information, and satisfies at least one of the listed thresholds: (1) annually buys, sells, or shares personal information of more than 100,000 consumers, households, or devices; or (2) derives 50% or more of its global annual revenues from selling or sharing personal information about consumers.

 Exemptions

Both bills provide exceptions for certain types of entities or processing activities.  For example, neither bill applies to non-profit entities; entities subject to HIPAA; certain transfers of personal information to a credit reporting agency in accordance with FCRA; information collected, processed, or disclosed pursuant to the GLBA; or educational information covered by FERPA.

Personal Information

Both HB 969 and SB 1734 mirror the CCPA’s definition of personal information, including information that is  reasonably capable of being associated with a particular consumer or household.  Notably, SB 1734 also requires a business to obtain the consumer’s consent before processing “sensitive data,” though sensitive data is not defined by the statute.

Consumer Rights

Both the House and Senate bills provide consumers with certain rights, including access, portability, correction, and deletion rights.  Additionally both the House and Senate bills provide consumers with a right to opt-out of the “sale” of personal information.  The definitions of “sale” include the transfer of personal information “to another business or third party for monetary or other valuable consideration,” subject to certain exceptions.

  • HB 969 also requires that businesses provide consumers the right to opt-out of the sharing of their personal information, and it defines “share” to include disclosing personal information for advertising, though notably, the bill does not define what activity qualifies as “advertising.”
  • SB 1734 provides consumers with a right to opt-out of the processing of their personal information for targeted advertising and certain profiling activities, similar to the approach taken by the recently passed Virginia Consumer Data Protection Act. “Targeted advertising” is defined as “displaying an advertisement to a consumer when the advertisement is selected based on personal data obtained from a consumer’s activities over time and across businesses, websites, or online applications.”  The bill defines “profiling” as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”

Enforcement

Both bills empower the Florida Attorney General to enforce the statute, though HB 969 also contains a limited private right of action.

  • Under HB 969’s private right of action, a consumer could bring a civil action for certain violations of the statute: (1) failure to protect nonencrypted and nonredacted “personal information” or email address, in combination with a password or security question and answer, that would allow access to a consumer’s account; (2) failure to delete or correct personal information in response to a consumer request, or (3) continuing to sell or share his or her personal data after the consumer chooses to opt out.  Although SB 1734 originally included a private right of action, this provision was struck in the latest amendment adopted on April 7th.
  • Both bills grant the ability for the Attorney General to adopt rules for implementation.
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws.

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state laws, including the California Consumer Privacy Act, the Colorado AI Act, and other state laws. As part of her practice, she also regularly represents clients in strategic transactions involving personal data, cybersecurity, and artificial intelligence risk and represents clients in enforcement and litigation postures.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations. 

Chambers USA 2024 ranks Libbie in Band 3 Nationwide for both Privacy & Data Security: Privacy and Privacy & Data Security: Healthcare. Chambers USA notes, Libbie is “incredibly sharp and really thorough. She can do the nitty-gritty, in-the-weeds legal work incredibly well but she also can think of a bigger-picture business context and help to think through practical solutions.”

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder provides strategic advice to national and multinational companies across industries on existing and emerging data privacy, cybersecurity, and artificial intelligence laws and regulations.

Jayne’s practice focuses on helping clients launch and improve products and services that involve laws governing data privacy…

Jayne Ponder provides strategic advice to national and multinational companies across industries on existing and emerging data privacy, cybersecurity, and artificial intelligence laws and regulations.

Jayne’s practice focuses on helping clients launch and improve products and services that involve laws governing data privacy, artificial intelligence, sensitive data and biometrics, marketing and online advertising, connected devices, and social media. For example, Jayne regularly advises clients on the California Consumer Privacy Act, Colorado AI Act, and the developing patchwork of U.S. state data privacy and artificial intelligence laws. She advises clients on drafting consumer notices, designing consent flows and consumer choices, drafting and negotiating commercial terms, building consumer rights processes, and undertaking data protection impact assessments. In addition, she routinely partners with clients on the development of risk-based privacy and artificial intelligence governance programs that reflect the dynamic regulatory environment and incorporate practical mitigation measures.

Jayne routinely represents clients in enforcement actions brought by the Federal Trade Commission and state attorneys general, particularly in areas related to data privacy, artificial intelligence, advertising, and cybersecurity. Additionally, she helps clients to advance advocacy in rulemaking processes led by federal and state regulators on data privacy, cybersecurity, and artificial intelligence topics.

As part of her practice, Jayne also advises companies on cybersecurity incident preparedness and response, including by drafting, revising, and testing incident response plans, conducting cybersecurity gap assessments, engaging vendors, and analyzing obligations under breach notification laws following an incident.

Jayne maintains an active pro bono practice, including assisting small and nonprofit entities with data privacy topics and elder estate planning.

Photo of Olivia Vega Olivia Vega

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and…

Olivia Vega provides strategic advice to global companies on a broad range of privacy, health care, and technology issues, including in technology transactions, mergers and acquisitions, and regulatory compliance. Within her practice, Olivia counsels clients on navigating the complex web of federal and state privacy and data security laws and regulations, including on topics such as HIPAA, California’s Confidentiality of Medical Information Act, and the California Consumer Privacy Act. In addition, Olivia maintains an active pro bono practice.