Turns out that Florida’s greatest rivalry is not between FSU and UF. Rather, it appears to be between businesses and consumers. At least, that is how it appears to be if you examine the Florida Legislature’s latest maneuverings on the proposed Florida Consumer Data Privacy Act.

If you have read my previous writings on this subject or watched the video, you may safely skip the next two paragraphs. In February, the Legislature took up consideration of a bill (in both Houses) that would have aligned Florida with California and Europe in its treatment of consumer privacy. Consumers would have rights concerning the data that businesses possess about them. Governor DeSantis stood behind the bill apparently as a means of striking back at evil “Big Tech” (full disclosure, I am a tech and data governance lawyer).

The proposed law in its previous form (foreshadowing here) would have applied to for-profit businesses that met certain revenue thresholds, possessed a certain number of Florida consumer records, or exceeded a certain percentage of its business that was data sales or sharing. The original bill would have allowed a private right of action that the Plaintiff’s Bar would get to enforce, as well as enforcement by the Florida Department of Legal Affairs.

Well, you may be able to forget at least some of that.

On April 6 (yesterday), the Senate Committee on Commerce and Tourism proposed replacing everything in the bill after the enacting clause (that is, all the meaningful language) with new language. If the Legislature passes the revised bill, it would still enact a consumer privacy bill, but one that is now somewhat more measured in its application to business (or perhaps less protective of consumers).

The new language removes the private right of action and reduces the applicability of the law to for-profit businesses that “annually buy, sell or share the personal information [defined broadly in the statute] of 100,000 or more consumers, households or devices.” Alternatively, the law would also apply to a for-profit business that “derives 50 percent or more of global annual revenues from selling or sharing personal information about consumers.” No longer would a business trigger coverage of the new law based simply on annual revenues regardless of possession of consumer records (personal information).

The net effect of this new language should be to avert what would otherwise have been a stampede to the courthouse to sue businesses for every minor infraction and perceived error. To that point, I laude the Legislature and point to the application of the ADA to websites as an example of private rights of action gone rogue.

On the other hand, if you are a consumer, the reduced scope of this law will obviously reduce the rights you would otherwise have had with regard to a vast swathe of businesses in the State of Florida. Rhetorically speaking, simply because a business is too small revenue-wise or deals in too-few records to trigger the law doesn’t matter much if it is your information that the business has and is using against your wishes. As one wag once said, “A minor injury is one that happens to someone else.”

This issue also sets-up a classic problem for the non-regulated, which is, “Do I [the business] need to provide the same rights as a covered business in order to meet what could (and will be) recharacterized by the covered business as a competitive advantage?” When I was in business school, it was pounded into us that consumers want to do business with companies that they perceive to be—rightly or wrongly—ethical. Given that law and ethics are not-synonymous, is it ethical for a large company with “few” records to withhold rights from consumers when other smaller (i.e. revenues) and perhaps less sophisticated business cannot?

Perhaps the “correct answer” is the opposite of what the Legislature proposes to do. That is, make the statute apply to every business that deals in Florida consumer personal information so that there is uniformity in applicability. At the same time, streamline the now burdensome proposed requirements placed on those same companies by this new iteration of the law. Sometimes (frequently) governments are not good at “simple.” For what simple might look like, tune in another time.

We still have several weeks before Florida’s legislative session closes, but this is probably a good first step and appears to be a move consistent with the Governor’s anti-Big-Tech agenda.

In closing, it should be noted that the proposed bill still contains what I believe to the most amusing provision—the defining of a person’s “olfactory” information as “personal information.” The actual technological reason for this could seriously be the subject of an entire article. In the meantime, take comfort in knowing your choice of anti-perspirant, even if not “Secret”, will remain a secret