An Update on Florida’s Overhaul of Data Privacy Statutes

On Tuesday, April 6, the Florida Senate Rules Committee substantively amended Senate Bill 1734, which would create the “Florida Privacy Protection Act.” This is the Senate version of the dueling Florida House and Senate measures to bring California-like consumer data privacy protection to Florida. The Florida Privacy Protection Act would grant Florida consumers the ability to share personal information as they wish, including opting out of a business’s sale of their personal information. Both the House and Senate versions would require companies to notify consumers of their privacy rights, and to enact internal controls that would permit those companies to delete or correct personal information collected upon a consumer’s request.

Critics of the Act cited concerns about the heavy burdens the Act would have for companies that share information with their affiliates, including subjecting companies to liability in private rights of action from consumers for violations. The House limits “violations” to data breaches, while the earlier version of Senate Bill 1734 also subjected companies to liability for violations of the statute’s privacy protection provisions.

The proposed new version of Senate Bill 1734 out of the Senate Rules Committee makes several changes that may quiet the critics. First, the new version reduces the Act’s scope, by removing the revenue thresholds. The previous version of the Act would have applied to any business that generated more than $25 million in revenues and collected personal information. The new version applies only to companies that annually buy, sell or share the personal information of 100,000 or more consumers, households or devices, or derive 50% or more of their global annual revenue from selling or sharing personal information about consumers. This means that the Act may spare smaller companies that merely collect information from having to drastically alter their collection practices to comply with the law.

Second, and perhaps more importantly, yesterday’s amendment has defanged significantly Senate Bill 1734. The Rules Committee removed the private right of action in its entirety. As with the existing Florida data privacy law, enforcement of the Act would be left to the Florida Attorney General.

After passing in the Senate Rules Committee on Tuesday, April 6, the new version of Senate Bill 1734 will head to the Senate floor for an eventual vote from the full Florida Senate. In the meantime, House Bill 969 continues to make its way through House Committees. We will be monitoring the House Committees for any amendments to bring the bill in line with the more business-friendly current version of Senate Bill 1734.