On February 15, 2021, Governor Ron Desantis and House Speaker Chris Sprowls announced that Florida would become one of a growing list of states seeking to pass legislation aimed at establishing consumer data protections for personal information. The legislation, House Bill 969, filed by Representative Fiona McFarland of Sarasota, would establish comprehensive consumer data privacy protections aimed at for profit businesses that collect personal information about consumers.
Under the proposed legislation, any for profit business, doing business in Florida, that collects personal information about consumers could be subject to the requirements of the law. The proposed law would apply to businesses that satisfy one or more of the following thresholds:
- Global annual revenues in excess of $25 million dollars;
- Annually buys, receives, sells or shares (for commercial purposes) the personal information of 50,000 or more consumers, households or devices; or
- Derives 50 percent or more of its global annual revenues from selling or sharing personal information about consumers.
Businesses required to comply with the proposed legislation would need to take a number of steps aimed at informing consumers about the business’s data collection practices, as well as explaining to consumers their rights with regard to the personal information about them that is collected. Briefly, covered businesses would be required to:
- Maintain and make available an online privacy policy;
- Provide consumers with the ability to request and be provided a copy of the personal data about the individual that has been collected by the business;
- Disclose to the consumer, upon request, information about the types of personal information that may have been sold or shared by the business and for what purpose;
- Allow consumers the right to opt-out of the sale or sharing of their personal information to third parties;
- Ensure that consumers who exercise their rights under the law are not discriminated against; and
- Set up at least two methods for consumers to request information about the use of their personal information including, but not limited to, a toll-free number and a link on the business’s internet homepage.
Businesses covered by the proposed legislation would be subject to civil penalties, to be sought by the Florida Attorney General’s Office, for violations of the law. Additionally, consumers would have a limited private right of action against businesses that failed to maintain reasonable security procedures and practices to properly protect consumer information from unauthorized disclosure.
The 2021 Florida legislative session does not formally get underway until March, however, businesses that would be impacted by HB 969 should keep a close watch on the bill as it moves through the legislative process.
Bill Dillon is a Certified Information Privacy Professional and is a member of Gunster’s Cyber Security and Data Protection team.
If you have any questions, please contact Gunster Tallahassee Office Managing Shareholder Bill Dillon.
