T-2 Days: Will the Data Privacy Bill Pass in Florida?

With just over two full days left in the current Florida legislative session, the Florida House and Senate continue to play tug-of-war over their respective bills for comprehensive data privacy reform in Florida. The Florida House passed its bill, HB 969, on Tuesday, April 27, 2021, moving HB 969 into the Florida Senate for consideration. In response, the Florida Senate passed a strike-all amendment that shredded HB 969 in its entirety, and replaced it with a modified version of the Senate’s bill, SB 1734. Florida Senator Jennifer Bradley, a Republican who represents District 5 in Northern Florida, filed the Senate’s amendment Wednesday morning. The ball is now back in the House’s court for final negotiations before the legislative session ends on Friday.

Senator Bradley’s version of SB 1734, now titled the “Florida Privacy Protection Act,” tempers some of the more onerous provisions in HB 969. The amendment strips the private right of action from HB 969, leaving enforcement solely in the purview of the Florida Attorney General. The bill affords the Attorney General discretion to offer an offending business a 30-day cure period, after considering the business’s other violations, if any, the substantial likelihood of injury to the public, and the safety of persons or property. If passed in its current form, the absence of the private right of action, and the potential for a cure period to rectify violations would be wins for Florida businesses and losses for Florida plaintiff’s lawyers eyeing the next wave of class action litigation. Another critical change comes to the effective date, which would be delayed from July 1, 2022 to July 1, 2023, affording businesses over two years to get their internal controls in order and prepare for compliance.

The Florida Privacy Protection Act would apply to businesses that, during the calendar year, control the processing of personal information of 100,000 or more consumers, or, alternatively, control or process the personal information of at least 25,000 consumers and derive over 50 percent or more of their global annual revenues from selling personal information about consumers. The bill limits its application to the collection and sale of consumer data. It does not apply to businesses that collect information from their own employees or from job applicants.

There are two realistic outcomes to this process: (1) The House and Senate negotiate an acceptable version of Senator Bradley’s amendment, which passes and becomes law as of its effective date; or (2) the Florida legislative session closes without a vote, killing the bill and maintaining the status quo in Florida at least until the next legislative session. The likely outcome is anyone’s guess at this point.