Data Privacy Legislation Stalls Again in Florida Legislature

Florida ends its legislative season without consumer data privacy legislation. Two legislative bills, SB 1864 and HB 9, were “indefinitely postponed and withdrawn from consideration.” Companies doing business in Florida can sigh in relief, at least for now.

The 2022 Florida Legislature once again considered consumer data privacy legislation that would have required significant and costly changes to how certain businesses collect, sell, and share personal information about their customers.  The Senate and House bills were a continuation of legislative efforts in the 2021 Florida Legislature to enact similar legislation, but there had been various changes to the bills since last year’s failed efforts.  One of the most significant differences involved a consumer’s private right of action. The 2022 House bill contained a more limited private right of action. Only businesses committing violations enumerated in the bill and meeting certain revenue thresholds were exposed to private lawsuits. On the other hand, the Senate bill did not establish a private cause of action. Instead, under that bill only the Florida Department of Legal Affairs can take action with respect to violations deemed unfair and deceptive trade practices. 

Last month, Florida TaxWatch, a nonprofit, government watchdog group, released a Session Spotlight report  estimating that the cost of initial compliance of the legislation would have ranged between $6.2 billion and $21 billion. For ongoing compliance, the direct costs would have ranged between $4.6 billion and $12.7 billion annually. In addition, it found that HB 9’s inclusion of a private cause of action, though limited, would have inevitably sparked some extent of frivolous litigation due to its lack of a cure period by which a business could respond to a customer’s demand letter.

Citing a study by the Information and Technology & Innovation Foundation (ITIF), the watchdog group also reported that of the top five data-intensive industries in the study that would have been affected by consumer data privacy legislation, three of them -- Telecommunications, Finance and Insurance, and Utilities-- account for $116.3 billion of Florida’s gross state product.  The Real Estate industry, which contributes $214.2 billion to Florida’s economy, was the 13th-most data-intensive industry in the ITIF study. This study suggests that, for some of Florida’s largest industries, data privacy legislation would have had a far-reaching effect even though the legislation was primarily intended to focus on information technology sectors.

In any event, we will have to wait until the next legislative session to see whether there is a resuscitation of this legislation. For now, the status quo remains in effect.