The Florida House of Representatives today passed HB 9 by a vote of 103 to 8. The bill would be Florida’s first “comprehensive” data privacy law. You can read this post to learn more about what the bill would do; this one for a deeper dive; and, this one for the latest amendments.

Floor Debate

Unsurprisingly, the floor debate was filled with the same arguments we heard in committee hearings. Unfortunately, that included the myth that HB 9 applies only to companies that buy or sell personal information.  At one point, Rep. Eskamani (D) said, “If you’re not selling data, you are fine. If you are not making off personal identifying information, then you are fine.”  Similarly, Representative Beltran (R) said, “This bill only applies to people who buy and sell people’s data. If you’re not in that business then you shouldn’t have a problem.”

Let’s be clear – this argument is patently and objectively false. As I’ve pointed out in a previous blog post and in my public comment directly to the House Commerce and Judiciary committees, the mere “access” to personal information can trigger this bill’s scope. Nevertheless, from HB 9’s inception, the House leadership promoted the bill as limited only to “companies that buy or sell information” and “companies that earn at least 50% of their revenue from buying or selling personal information.” Why? Because it’s an easier pill to swallow if the House members think the bill is narrowly tailored such that it won’t adversely impact Florida businesses. It’s easier to “vilify” companies that exist primarily to buy/sell personal information. But it’s intellectually dishonest and it festers the growing distrust people have of certain elected leaders.

One of the most insightful comments was by Rep. Diamond (D), who hesitatingly predicted, “I think that this issue is not going to be resolved this session, most likely, as I understand the posture we’re in with regard to the Senate.” Rep. Diamond voted in favor of the bill but encouraged further consideration of a right to cure in the private right of action provision similar to the right to cure built into the Florida Attorney General’s enforcement authority:  “I just wanted to encourage the members of the House that are going to continue to work on this project going forward to the extent it’s not resolved this session to think about the enforcement provisions in this bill versus other ways we could enforce these provisions. Because I do think 99% of the businesses in this state are going to want to come into compliance with these new regulations and we want to provide opportunities for businesses to come into compliance. And that is there in the enforcement mechanism that the representative has in this bill for the Attorney General. It’s geared around businesses coming into compliance. It’s not quite there yet with regard to the private cause of action because there isn’t a formal notice and opportunity to cure provision, but you can’t let the perfect be the enemy of the good.”

Ultimately, 75% of the members who opposed the bill were Democrats, yet Democrats make up only one-third of the House membership.

What’s Next?

After the bill passed the House, it was sent to the Senate and the Senate referred the bill to the Judiciary Committee.  The Judiciary Committee has a number of options at this point, including:

• Doing nothing. With a little over a week remaining in the legislative session and many priorities still for the Senate to consider, there simply may not be enough time for the Senate Judiciary Committee to consider any draft of a privacy bill. It’s also possible that the Judiciary Committee may not meet again at all.
• Amending HB 9 with a proposed strike-all (approved by the Senate President). The strike-all would replace HB 9 with a more business-friendly version of a privacy bill that does some or all of the following: removes the private right of action; builds in a right to cure (if a private right of action remains); limits the bill’s scope to companies that only buy or sell personal information; changes the scope to focus on certain kinds of companies; and/or eliminates some of the compliance challenges created by HB 9. That version would pass the Judiciary Committee, then the Senate Floor, and the Senate President would then engage in horse-trading with the House Speaker to pick a version for the Governor to sign.
• Consider SB 1864. We have forgotten that the Senate has its own privacy bill (which was actually the first privacy bill to be introduced this legislative session). That bill’s sponsor ( Jennifer Bradley) is a member of the Senate Judiciary Committee. That could be the version of a privacy law the Senate Judiciary Committee considers.
• Consider HB 9 in its current form. Pretty self-explanatory.

If I were forced to pick the most likely option, I’d go with the second one, but the first and third options wouldn’t surprise me either. I don’t think the fourth option is realistic. The next 48 hours could be revealing.

Governor DeSantis, who for the most part has stayed out of the public debate on HB 9 this year, will likely weigh in behind the scenes to push one version over the other. We know the Governor is a supporter of Florida businesses, wants to encourage investment in Florida, and is concerned about the potential for abuse of an unnecessary private right of action, but we also know he supports a law that gives Floridians more control over their data and creates an ability to punish “big tech” for any lack of compliance. A version of HB 9 with a more narrowly-tailored scope and without a private right of action would strike that balance because the Republican Attorney General could still use the law to pursue companies she determined to be in violation of it.

It will be interesting to see how things unfold over the next week.