Florida Businesses Dodge a Data Privacy Bullet - for Now

After months of will-they-or-won’t-they, the Florida legislature went with “won’t” on enacting Florida House Bill 969, the “Florida Privacy Protection Act.” After a dramatic few weeks, with dueling data privacy bills competing in the Florida House and Senate, HB 969, the last bill standing, died in House committee on April 30, 2021, the last day of the Florida legislative session.

Had it passed, HB 969 would have been the strictest data privacy bill on record in the United States, with a private right of action allowing consumers to sue businesses directly for violations of the bill.  The bill would also have authorized the Florida Attorney General to continue to regulate data privacy under the ambit of consumer protection, and to impose civil penalties and other remedies against offending businesses.  

HB 969 would have applied not just to the “Big Tech” companies such as Google or Facebook doing business in Florida, but also to smaller Florida businesses that collected personal information such as Social Security numbers, financial account numbers and PINs, phone numbers and Driver’s License numbers, from Florida consumers.

While HB 969 made its way through Florida House committees with few amendments, the Florida Senate’s competing bill, Senate Bill 1734, took a decidedly more moderate approach, omitting the private right of action and limiting its application to businesses that earn revenues by selling or sharing consumer data. 

After HB 969 passed with overwhelming support in the House on Tuesday, April 27, 2021, the Florida Senate amended HB 969 in its entirety on Wednesday, April 28, 2021. The amended HB 969 omitted the private right of action and permitted the Florida Attorney General to offer businesses in violation a 30-day right to cure. Amended HB 969 was a win for Florida businesses that no longer faced the threat of plaintiff’s class actions for even minor violations, but also gave consumers far more control over their data than had Florida law ever afforded to them.  Florida would have been only one of a handful of states in the United States to offer such power to consumers to control the information companies collect.

The final hurdle was a review and vote in the Florida House on amended HB 969. On Friday, April 30, 2021, HB 969 officially died “In Messages” in House Committees. The Florida House was unwilling to compromise on killing the private right of action. 

What should businesses do now? The answer should not be “nothing.” This is the closest that Florida has come to enacting real data privacy reform, and no one should assume that this is the last Florida businesses have heard of this issue.  While it is certainly not mandatory, it is good business for companies to know precisely the data they collect from consumers, how they collect and store that data, how secure their storage and retention procedures are, and what they do with the data once it is no longer necessary or relevant to them. It’s critical to stay informed and vigilant.