With privacy legislation sweeping the nation, Florida is one of the latest states — in addition to Indiana, Oregon, Washington, and Wisconsin — to draft privacy-related bills for consideration in this legislative session.
Find out the status and timeline for Florida’s current bills, SB 1864 and HB 9 — and what you can do to prepare if they pass.
What Is Florida Senate Bill 1864 (SB 1864)?
SB 1864 would create the Florida Privacy Protection Act (FPPA). According to the current version of the bill, the purpose behind the FPPA would be to recognize the importance of an individual’s right to privacy. Thus, it provides for a number of consumer rights, including:
- the right to opt out of the sale and processing of personal information by a controller
- the right to prohibit controllers from selling the personal information of consumers that are younger than 13 years of age
- the right to opt out of targeted advertising.
However, there are exceptions to most of the rights provided in SB 1864. For example, controllers may process the personal information of minors if the controller obtains consent from the minor’s parent or guardian.
SB 1864 was filed on January 7. Five days later, it was referred to the Senate committees on Commerce and Tourism, Regulated Industries, and Rules. The bill was introduced in the Senate Judiciary Committee on January 18, where it has remained idle.
What Is Florida House Bill 9 (HB 9)?
HB 9 is the House’s response to SB 1864. It remains to be seen whether either bill will pass this year.
HB 9 provides for many of the consumer rights as seen in the proposed privacy bills of other states. It also contains requirements for controller and processors, opt-out measures, allows for a private cause of action, and notably, contains a retention schedule requirement for personal information that is processed or collected.
HB 9 was voted out of the House Commerce Committee on February 10. The bill was then referred to the House Judiciary Committee, which passed an amended version roughly two weeks later. This version of HB 9 was added to a Special Order calendar and received a first reading. Lawmakers then filed thirteen amendments to the bill on February 25.
The amended bill received a third reading before it was voted out of the House on March 2. The bill was then assigned to the Senate Judiciary Committee where it is presently awaiting a hearing date. The Florida legislature is scheduled to close on March 11, 2022. Thus, unless Florida follows in Utah’s footsteps, it is unlikely that HB 9 will pass this session.
Who Does HB 9 Apply To?
The amended version of HB 9 would apply to for-profit companies that meet at least two of the following criteria:
- earns a global revenue of more than $50M
- purchases, sells, shares, or receives the personal information of 50k or more consumers, households, or devices for targeted advertising; and/or
- derives 50% or more of its revenue from the sharing or selling of consumers’ personal information.
HB 9 would require controllers to provide notice to consumers on data collection, sharing, and selling practices, as well as provide consumer rights to correct, delete, or access data and to opt-out of the sale or sharing of personal data. If passed, the bill would take effect on January 1, 2023.
SB 1864 vs HB 9 — Where Is the Overlap?
SB 1864 is comparable to HB 9. HB 9 was filed in the House on January 11 and was referred to the House Commerce Committee one day later. Along with SB 1864, the bill is also linked to HB 1565.
Most of the provisions in HB 9 can be found in SB 1864. One significant difference between the two bills, however, is that SB 1864 appears to embrace the threshold conditions required by the Virginia Consumer Data Protection Act (VCDPA) for coverage. SB 1864 would apply to for-profit entities that either:
- control the processing of personal information of 100,000 or more consumers; or
- control or process the personal information of at least 25,000 consumers and derive 50% or more of their global annual revenue from selling personal information.
Some additional differences between the two bills include that:
- SB 1864 contains a requirement for businesses that participate in targeted advertising to include a link on their websites that states, “Do Not Advertise To Me.”
- SB 1864 has opt-in requirements for the collection of sensitive personal information.
- SB 1864 would take effect on December 31, 2022, whereas HB 9 would not take effect until July 1, 2023.
Whether both, only one, or none are passed this year, BigID helps businesses comply with privacy regulations all over the globe. With BigID, enterprises can classify and catalog sensitive and personal data, automate data subject requests to fulfill them at scale, and discover all regulated data across the organization, no matter where it lives. Find out how BigID can help your company meet compliance.