Florida may be next state to join the growing number of states with a consumer privacy law, as both chambers of Florida’s legislature are currently considering comprehensive state privacy legislation.  Both HB 969 and SB 1734 resemble the California Consumer Privacy Act (“CCPA”), though they contain some notable differences.  Florida Governor Ron DeSantis expressed support of these measures, stating that these proposals “finally check these companies’ unfettered ability to profit off our data and ensure the protection of Floridians’ personal and private information.”

Scope of Covered Entities

Both bills impose obligations on “businesses,” though the bills include different thresholds for entities to qualify as a “business.”

  • HB 969 defines businesses similarly to the CCPA, but captures entities doing business in Florida instead of California.
  • SB 1734, in contrast, defines a “business” as a for-profit entity that does business in Florida, collects personal information about consumers, determines the purposes and means of processing personal information, and satisfies at least one of the listed thresholds: (1) annually buys, sells, or shares personal information of more than 100,000 consumers, households, or devices; or (2) derives 50% or more of its global annual revenues from selling or sharing personal information about consumers.

 Exemptions

Both bills provide exceptions for certain types of entities or processing activities.  For example, neither bill applies to non-profit entities; entities subject to HIPAA; certain transfers of personal information to a credit reporting agency in accordance with FCRA; information collected, processed, or disclosed pursuant to the GLBA; or educational information covered by FERPA.

Personal Information

Both HB 969 and SB 1734 mirror the CCPA’s definition of personal information, including information that is  reasonably capable of being associated with a particular consumer or household.  Notably, SB 1734 also requires a business to obtain the consumer’s consent before processing “sensitive data,” though sensitive data is not defined by the statute.

Consumer Rights

Both the House and Senate bills provide consumers with certain rights, including access, portability, correction, and deletion rights.  Additionally both the House and Senate bills provide consumers with a right to opt-out of the “sale” of personal information.  The definitions of “sale” include the transfer of personal information “to another business or third party for monetary or other valuable consideration,” subject to certain exceptions.

  • HB 969 also requires that businesses provide consumers the right to opt-out of the sharing of their personal information, and it defines “share” to include disclosing personal information for advertising, though notably, the bill does not define what activity qualifies as “advertising.”
  • SB 1734 provides consumers with a right to opt-out of the processing of their personal information for targeted advertising and certain profiling activities, similar to the approach taken by the recently passed Virginia Consumer Data Protection Act. “Targeted advertising” is defined as “displaying an advertisement to a consumer when the advertisement is selected based on personal data obtained from a consumer’s activities over time and across businesses, websites, or online applications.”  The bill defines “profiling” as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”

Enforcement

Both bills empower the Florida Attorney General to enforce the statute, though HB 969 also contains a limited private right of action.

  • Under HB 969’s private right of action, a consumer could bring a civil action for certain violations of the statute: (1) failure to protect nonencrypted and nonredacted “personal information” or email address, in combination with a password or security question and answer, that would allow access to a consumer’s account; (2) failure to delete or correct personal information in response to a consumer request, or (3) continuing to sell or share his or her personal data after the consumer chooses to opt out.  Although SB 1734 originally included a private right of action, this provision was struck in the latest amendment adopted on April 7th.
  • Both bills grant the ability for the Attorney General to adopt rules for implementation.
Print:
EmailTweetLikeLinkedIn
Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.