Skip to main content

Florida Proposes New Data Privacy Legislation

Philip R. Stein & Enza G. Boderone

Privacy Portal Blog ImageOn February 15, 2021, Florida introduced House Bill 969, aimed at consumer privacy protection. A prior attempt last year by the Florida legislature to pass similar legislation failed to become law. If this bill passes, and there is some skepticism that it will, given the potential for a significant increase in litigation, Florida will join the rapidly-growing list of states expanding their regulation of the sharing and selling of personal data.

HB 969, which borrows language from the California Consumer Privacy Act, which was passed in 2018, would enable consumers to:

  • find out from businesses what personal information of theirs has been collected;
  • ask that it be deleted or corrected and provide requirements for compliance with any such request;
  • determine whether the data was sold or shared and have a private right of action if a business fails to comply;
  • require businesses to disclose to consumers certain information regarding data collection and sale practices at the time or before the data is collected;
  • require businesses to provide consumers additional specific information upon request;
  • opt-out of third party-disclosure of personal information collected by a business and prohibit disclosure of data of opted-out consumers;
  • prohibit a business from collecting additional categories of personal information or using personal information for additional purposes without notifying the consumer;
  • require businesses that collect personal information to implement “reasonable security procedures and practices” to safeguard that information;
  • require businesses to make available two or more methods for consumers to request their personal information and to provide such information free of charge within a certain time frame and format; and
  • prohibit businesses from taking retaliatory action against a consumer who exercises any of these rights;

The bill also seeks to ensure that a contract or agreement that waives or limits consumer rights of the types set forth above would be deemed void and unenforceable. If enacted into law in its current form, it would provide a private right of action and civil remedies for consumers whose personal information or email addresses are subject to unauthorized access. In addition, it would authorize the Florida Department of Legal Affairs to bring a civil action for intentional or unintentional violations and would provide a 30-day time period for companies notified of alleged violations to cure them.

The proposed law would apply to any company doing business in the state that satisfies one or more of the following criteria:

  • Global annual gross revenues in excess of $25 million;
  • Annually buys, receives, sells, or shares for commercial purposes the personal information of 50,000 or more Florida consumers, households, or devices; or
  • Derives 50 percent or more of its global annual revenues from selling or sharing personal information about Florida consumers.

Businesses that fail to comply would be subject to suit by the aggrieved consumer, who would be entitled to damages in an amount not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater and civil penalties by the Florida Office of the Attorney General of up to $2,500 for each unintentional violation, or $7,500 for each intentional violation.

Though the passing of this proposed legislation is not at all certain, the law, if enacted, would take effect on January 1, 2022. Therefore, businesses should begin considering how this proposed law would affect their operations and also begin to plan for implementation of changes to their consumer privacy practices that may become necessary as a consequence of the enactment of this proposed legislation.

Related Practices
Client Alert April 15, 2021
We have previously reported on two data privacy protection bills in the Florida legislature akin to California’s sweeping Consumer Privacy Act. Yesterday the Florida House Commerce Committee passed House Bill 969, mirroring Florida Senate Bill 1734 but with one critical difference.
Blog January 28, 2022
Today (January 28, 2022), is National Data Privacy Day. What can we safely expect to see by the time National Data Privacy Day rolls around in 2023? The short answer is, “plenty.”
Speaking Engagement March 4, 2024
Ryan J. Coyle speaks on the panel Stiff Winds, New Currents and Rough Seas: Navigating the Private Client World in Turbulent Times at the 29th Annual International Private Client Tax Conference. The panel discusses recent changes and salient topics in tax law in different jurisdictions, the use of a...