With the Florida legislative session long over, advertising agencies breathe a sigh of relief that Florida House Bill 969 was killed in committee and never reached a floor vote. Good thing too, because the bill had overwhelming support on both sides of the aisle. Mission accomplished, right? Time to pack it in and go home?

You wish.

The Florida legislature has a lot on their mind for the upcoming legislative year. So far, this data privacy bill hasn’t been mentioned, but it would be wishful thinking to believe it won’t come up again next year.

Just a refresher: HB 969, or the “Florida Privacy Protection Act,” was set to be the strictest data privacy bill in the United States (yes, even tighter than the CCPA in California). If it passed in April, the law would have gone into effect July of next year. The gist of the law is that any company involved in a data breach that subjected consumers to the compromise of their personal information would have to privately offer each person affected by the data breach the option to opt out of future use of their personal information or require the company to delete said information.

Who would be subjected to this law? If your business met any one of the following criteria, then you would be susceptible to the action required in a data breach:

• Global annual gross revenue over $25m
• Annually buy, receives (for your business’s commercial purposes), sells, or shares for commercial purposes the personal information of at least 50,000 consumers, households, or devices
• Derive at least half of your global annual revenue from selling or sharing personal information about consumers

HB 969 was later revised in the 2021-2022 session so that the law would only apply to for-profit businesses that meet at least two of the above requirements. Also, the annual gross revenue cut-off was increased to $50m.

Any business that failed to act within 30 days of a breach could be fined up to $2,500 for unintentional violations or $7,500 for unintentional violations per violation. Yes, that’s right: per violation. The fine could be tripled if the violation included consumer information of someone who is 16 or younger.

But wait, there’s more! This Act would also allow consumers to sue businesses that failed to act within the required 30 days. Civil action would be allowed to proceed for damages or injunctive relief. Damages could range from $100 to $750 per consumer, per violation, or actual damages (whichever is greater).

So that’s $2,500 to $7,500 per violation (tripled if the consumer is under 16), plus damages in civil court per consumer, per violation.

Woof.

Ultimately, HB 969 died in committee. However, given at the start of the 2021 legislative session both Governor DeSantis and House Speaker Chris Sprowls made a point that data privacy and security would be a “priority,” we can safely assume that an iteration of this bill is coming up in the next legislative session. Data privacy and protection is a hot topic in numerous state legislatures and is often considered an easy bipartisan win (which is why HB 969 was introduced by both conservatives and progressives alike).

It’s important to contact your state representative now and let them know how you feel about this bill (just a head’s up: every Florida House Representative, with the exception of one, voted “Yea” on HB 969).

The first committee week starts September 20 and runs through September 24. The legislative session will start on January 11.

//

Stay in the loop about our upcoming in-person and virtual events by signing up for our email newsletter, where you'll also find industry inspo, freebies, job postings, and more. Follow us on Facebook, Twitter, Instagram, and LinkedIn to join the conversation!

About the Author: David Renna is a professional grant writer with a penchant for freelance marketing. He current serves as the Government Relations Chair of AAF Orlando. When David isn’t blogging about Florida government, he’s usually hiking in the Florida wilderness and photographing all of the wonderful wildlife.