Today, the Florida House of Representatives Commerce Committee voted unanimously to allow HB 969, which would be the most aggressive privacy law in the country, to move forward for a full House floor vote. This post explains what happened, what will happen next, and some of the unique political forces and considerations behind HB 969.
The Current Version of HB 969
HB 969 is similar to the CCPA in many of its requirements (though the scope is now more limited). But the bill departs from the CCPA in two important ways. First, HB 969 creates a private right of action for data breaches of any personal information, while the CCPA’s private right of action is limited to sensitive personal information and requires an opportunity to cure. Second, HB 969 creates a private right of action for a company’s failure to comply with a verifiable consumer request to delete, correct, or stop selling personal information, and it would provide for attorney’s fees (only to the plaintiff). The CCPA has no private right of action for violation of the privacy provisions of that law. In other words, California’s privacy law is more business-friendly than Florida’s.
Today’s Developments and Next Steps
Today, the House Commerce Committee voted unanimously to move HB 969 favorably out of committee. Next, the bill moves to the House floor for consideration and a vote by the full House. But the 22-0 vote doesn’t reflect the level of concern expressed by the Commerce Committee members during today’s hearing.
I was fortunate enough to testify today. (Go to the 3 hour and 22-minute mark.) One thing I realized from being in the room is that Republicans understand the problems with HB 969’s private right of action and they’re very concerned about it. Indeed, most committee members said they would not support the bill in its current form. But those representatives have their hands tied for now because the House Speaker wants to punish Big Tech and sees an aggressive privacy bill as one way to do that. As a general rule, legislators who cross a House Speaker of their own party risk a big hit to campaign funding.
This strange dynamic of Republicans wanting to oppose the bill but not formally doing so seemed further evident when Committee Chair Ingoglia asked William large (the Florida Justice Reform Institute), an opponent of the privacy bill, whether he would support the bill if the private right of action were removed. Large said he probably would. The exchange felt like a question and answer that was meant for others inside and outside the Committee’s chambers. Why would Representative Ingoglia ask the question when he knew there was no chance of that change occurring today? I would not be surprised if he was astutely trying to send a message to Representative McFarland and the House Speaker that there’s a way to pass a privacy bill without upsetting the Republicans’ longstanding and loyal corporate base.
In any event, it would be fair to conclude based on today’s discussion that if the private right of action is not removed or significantly dialed back, HB 969 will not pass the House. As a result, I expect we will see a dialed back or removed private right of action in the version of HB 969 considered by the House floor. (My money is on a dialed-back version of the private right of action because the House Speaker wants to punish Big Tech and thinks a private right of action in this bill will allow for that.)
Regardless of what the House passes, the Senate’s version does not include a private right of action. So the language of a final privacy law will depend on who wants their version more – the House Speaker or the Senate President.
TAKEAWAY — businesses that oppose HB 969 would be well-served to contact the House Speaker, express concern about the private right of action, and encourage the Senate President to stand by any version passed by the Senate.
It’s possible that nothing comes of all this. If there is no resolution on a final law before April 30th, when the Florida legislative session concludes, the clock runs out. I don’t believe this is a highly likely outcome, but it’s definitely possible given the differences between the House and Senate versions.
Have Privacy Advocates Found Their Model for Privacy Laws in “Red States”?
Stepping back and looking at the big picture, is it possible that privacy advocates have found their model for getting a privacy bill (even one with a private right of action) passed in red states? To date, privacy advocates have had trouble garnering Republican support for privacy laws, especially those with private rights of action. Here, however, proponents of HB 969 have successfully persuaded Republican politicians at all levels (who are usually pro-business) that these laws can be used to attack a new enemy – big tech. It will be interesting to see whether this model will be replicated in other states. If this theory is correct, it will mean a significant unexpected consequence of Twitter’s Trump ban and a perceived liberal bias on other social media platforms. But is this a smart long-term play for Republicans? It’s only a matter of time before conservatives launch their own social media platforms and these rules will apply to those companies, too. Who will be better prepared to defend the private rights of action and enforcement actions – big tech companies that have had over a decade head start, or new social media upstarts?
I continue to believe that Representative Fiona McFarland is one of the most talented and promising politicians in the State of Florida. She is sharp, measured in her comments, understands how to leverage her relationships with those “across the aisle”, has a strong work ethic, she’s modest, relatable, and is extremely well-liked by her colleagues. You also have to appreciate how she has carved out a niche in technology (she notched wins not just for her privacy bill but for her autonomous vehicle bill today, too). All of this is a recipe for long-term success.
I predict in the next ten years we’re going to see Representative McFarland do BIG things in Florida politics, and I want to be able to say “I told you so!”
TAKEAWAY — if I were Tesla, Apple, Google, or one of the other big tech companies, I’d want to develop strong relationships with Representative McFarland and her staff to shape the future of technology law in Florida. I’d also want to invest in creating a long-term dialogue that supports McFarland and her staff in maintaining awareness of trends and developments in technology.
Who is Propel?
The mysterious advocacy group, Propel, was the only organization to publicly support the Florida privacy law today. No representative from the organization was present (or has ever been present) at a legislative hearing to publicly express support for the law. My guess is that it’s a privacy advocacy organization, a specific individual with a lot of money trying to shape Florida law (a la California), the plaintiff’s bar, or a combination.
Most Random Exchange of Any Privacy Hearing . . . Probably Ever
Finally, my award for strangest exchange during a hearing on a privacy bill goes to this one today between Representative Geller and Committee Chair:
Geller to McFarland – So would this prohibit our DNA from being shared with aliens who want to use it to clone us?
Chair Ingoglia – I’m sensing a wet noodle coming out soon.
I could go in so many directions with that exchange, but it was funny, and it was generally refreshing to watch the bipartisan banter throughout the hearing between Representative Geller, the Chair, and their colleagues.