Keypoint: Florida lawmakers have proposed legislation that would require certain operators of websites to make online disclosures and accept requests to opt-out of sales of personal data but that would stop far short of creating CCPA-like privacy rights for Florida residents.
Florida lawmakers have introduced companion bills in the Florida House (HB 963) and Senate (SB 1670) that would create limited online privacy rights and obligations in the state. The legislation – which is yet to be named but for our purposes will be referred to as the 2020 Florida Consumer Privacy Act (Act) – appears to be very similar to the Nevada Online Privacy Protection Act, which was amended last year to add a right to opt-out of sales of covered information. The Act is therefore distinguishable from the California Consumer Privacy Act (CCPA) and more akin to the California Online Privacy Protection Act (CalOPPA).
Florida joins a number of other states considering consumer privacy legislation, including Illinois, Washington state, Nebraska, New Jersey, New Hampshire, Virginia, and Hawaii. Members of Husch Blackwell’s privacy and data security practice group will be hosting a webinar on February 4 at noon CST to discuss these proposed laws and to provide an update on the CCPA. To register, click here.
Below is our analysis of the Florida legislation (as introduced).
To Whom Does it Apply?
“Consumers,” which is defined as “a person who seeks or acquires, by purchase or lease, any good, service, money, or credit for personal, family, or household purposes from the website or online service of an operator.”
What Entities are Covered?
The Act would apply to “operators” which is defined as a person who (1) owns or operates a website or online service for commercial purposes, (2) collects and maintains covered information from consumers who reside in Florida and use or visit the website or online service, and (3) purposefully directs activities toward Florida or purposefully executes a transaction or engages in any activity with Florida or a Florida resident.
Excluded from the definition of operators are (1) third-parties that host a website on behalf of an operator, (2) GLBA and HIPAA-regulated entities, and (3) motor vehicle manufacturers/repairers under certain circumstances.
What Information is Covered?
“Covered information,” which is defined as the following types of information if collected through a website or online service: (1) first and last name; (2) home or other physical address which includes the name of a street and the name of a city or town; (3) email address; (4) telephone number; (5) Social Security number; (6) identifier that allows a consumer to be contacted either physically or online; and (7) any other information concerning a consumer that is collected from the consumer through the website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.
What Rights are Created?
Consumers would have the right to submit a verified request to an operator directing the operator not to sell any covered information the operator has or will collect about the consumer.
The Act defines “sale” narrowly to mean “the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.” There are also five exceptions to the definition of sale, including the disclosure of information to processors, the disclosure of information to other persons for purposes of providing a product or service requested by the consumer, and the disclosure of information to affiliates.
Are there Any Exemptions?
In addition to the above noted exemptions, the proposed law would not apply to an operator: (1) who is located in Florida, (2) whose revenue is derived primarily from a source other than the sale or lease of goods, services, or credit on websites or online services, and (3) whose website or online service has fewer than 20,000 unique visitors per year.
Would Companies Need to Update their Online Privacy Policies?
Maybe. Similar to CalOPPA and comparable laws in Nevada and Delaware, the law would require operators to provide a notice that:
- Identifies the categories of covered information that the operator collects through its website or online service about consumers who use or visit the website or online service and the categories of third parties with whom the operator may share such covered information.
- Provides a description of the process, if applicable, for a consumer who uses or visits the website or online service to review and request changes to any of his or her covered information that is collected through the website or online service.
- Describes the process by which the operator notifies consumers who use or visit the website or online service of material changes to the notice.
- Discloses whether a third party may collect covered information about a consumer’s online activities over time and across different websites or online services when the consumer uses the operator’s website or online service.
- States the effective date of the notice.
Operators that already comply with the laws in California, Nevada and Delaware presumably would not need to update their disclosures (unless there was some unique aspect of the data being collected about Florida residents).
Notably, as is the case with Nevada’s law, the Act does not appear to require operators to disclose the right to opt-out in their online privacy notice. However, operators that have chosen to provide such a notice to Nevada residents could, in theory, just add a comparable Florida notice.
How Would it be Enforced?
The law would be enforced by the Florida Attorney General’s office. Prior to bringing an enforcement action, operators would need to be notified of the violation and provided 30 days to cure. It is not clear that the notice would need to come from the AG’s office (as opposed to a consumer complaint). The AG’s office could seek a civil penalty of up to $5,000 per violation.
Would it Create a Private Right of Action?
No.
When Would it be Effective?
July 1, 2020
Anything Else?
The Act would prohibit the use of personal data contained in public records for certain marketing, soliciting, and contact without the person’s consent.
