Florida House advances broad privacy bill as states weigh data protections

The Florida House of Representatives on Wednesday approved data privacy legislation that would offer residents broad protections on how their personal data is collected by online businesses and the ability to sue companies that misuse that information.

The bill, which was supported by all but one member of the 120-seat chamber, despite heavy lobbying from the tech industry, would require any company that conducts business in Florida and takes in at least $50 million in annual revenue to disclose to its customers what personal information it collects and how that data is used. It would also apply to any company that collects, shares or sells the information of at least 50,000 customers annually or derives at least half its revenue from data sales.

Floridians would also gain the rights to ask that their data not be collected or resold, and the ability to sue personally companies that violate those requests, a measure known as a “private right of action.”

But the bill’s definition of what counts as sensitive personal information, as well as a guarantee that any successful plaintiffs would recoup attorney fees, would make it far more aggressive than any other state’s privacy law, including the landmark California Consumer Protection Act of 2018, said Alfred Saikali, a Miami attorney whose firm represents businesses that could be sued under the legislation.

While the bill covers the types of data widely accepted as sensitive personally identifiable information — including Social Security and driver’s license numbers, financial information and medical histories — it also mentions consumer preferences, which Saikali said could easily extend to a person’s shopping habits, which are used by online merchants to deliver individualized advertisements.

“This thing is going to have more teeth than any other privacy law because it’s so broad,” he said. “You’re going to see a flood of lawsuits that’s incentivized by these attorneys fees.”

‘Wanting to punish big tech’

Counterpart legislation underway in the Florida Senate does not take as wide a view as what passes for personal information and removes the individual right to sue, leaving enforcement in the hands of the state attorney general, similar to a law recently enacted in Virginia. Saikali said that version would be preferable to the House’s, but he also suggested the data-privacy push stems from a desire by Florida Republicans, who control state government, to punish tech companies over perceived grievances like Twitter and Facebook suspending former President Donald Trump’s accounts.

“Ninety percent of it is motivated by wanting to punish big tech, what they perceive as liberal big tech,” he said. “That’s the reason why it’s gotten this far.”

The privacy bill’s original introduction came about the same time Florida Gov. Ron DeSantis, a close ally of Trump, also backed legislation that would allow the state to fine social media companies that ban candidates for office, saying he was taking aim at a “big tech cartel.”

Private right is contentious

The Florida bill is one of several being considered by lawmakers around the country in the latest wave of states attempting to write their own data privacy statutes in the absence of any federal policy.

“Once CCPA established basic privacy rights for consumers, other states became interested in ensuring their states have protections,” said Maureen Mahoney, a policy analyst at Consumer Reports, which praised the Florida House’s passage of its bill. “It’s not right for someone in California to have privacy protections while in other states they don’t.”

While Consumer Reports has not officially taken a position on the Florida legislation, Mahoney said the House version’s inclusion of targeted advertising and an individual right to sue gave it “strong enforcements” compared to a Senate version that leaves out those details. But she said the Senate version includes a requirement that companies honor browser-based privacy settings, like the Global Privacy Control extension, that attempt to block the collection of personal information.

Several other states are considering privacy bills, including Connecticut, Colorado and New York. The New York legislation would preserve individuals’ right to sue, though similar language was taken out of Connecticut’s and did not appear in Colorado’s.

Washington state was poised to pass a privacy bill backed by the tech industry, though it has stalled in committee since lawmakers added in a private right of action, similar to language that led previous attempts to pass consumer data protections to collapse.