Florida Justice Reform Institute

Have Privacy Advocates Found A New Path Forward in Red States?

/in

 

JD Supra

April 15, 2021

Have Privacy Advocates Found A New Path Forward in Red States?

Header

WRITTEN BY:
Shook, Hardy & Bacon L.L.P.
Alfred Saikali

Today, the Florida House of Representatives Commerce Committee voted unanimously to allow HB 969, which would be the most aggressive privacy law in the country, to move forward for a full House floor vote. This post explains what happened, what will happen next, and some of the unique political forces and considerations behind HB 969.    

The Current Version of HB 969

HB 969 is similar to the CCPA in many of its requirements (though the scope is now more limited). But the bill departs from the CCPA in two important ways. First, HB 969 creates a private right of action for data breaches of any personal information, while the CCPA’s private right of action is limited to sensitive personal information and requires an opportunity to cure.  Second, HB 969 creates a private right of action for a company’s failure to comply with a verifiable consumer request to delete, correct, or stop selling personal information, and it would provide for attorney’s fees (only to the plaintiff).  The CCPA has no private right of action for violation of the privacy provisions of that law. In other words, California’s privacy law is more business-friendly than Florida’s.

Today’s Developments and Next Steps

Today, the House Commerce Committee voted unanimously to move HB 969 favorably out of committee. Next, the bill moves to the House floor for consideration and a vote by the full House. But the 22-0 vote doesn’t reflect the level of concern expressed by the Commerce Committee members during today’s hearing.

I was fortunate enough to testify today. (Go to the 3 hour and 22-minute mark.) One thing I realized from being in the room is that Republicans understand the problems with HB 969’s private right of action and they’re very concerned about it. Indeed, most committee members said they would not support the bill in its current form. But those representatives have their hands tied for now because the House Speaker wants to punish Big Tech and sees an aggressive privacy bill as one way to do that. As a general rule, legislators who cross a House Speaker of their own party risk a big hit to campaign funding.    

This strange dynamic of Republicans wanting to oppose the bill but not formally doing so seemed further evident when Committee Chair Ingoglia asked William Large (the Florida Justice Reform Institute), an opponent of the privacy bill, whether he would support the bill if the private right of action were removed. Large said he probably would. The exchange felt like a question and answer that was meant for others inside and outside the Committee’s chambers. Why would Representative Ingoglia ask the question when he knew there was no chance of that change occurring today? I would not be surprised if he was astutely trying to send a message to Representative McFarland and the House Speaker that there’s a way to pass a privacy bill without upsetting the Republicans’ longstanding and loyal corporate base.

In any event, it would be fair to conclude based on today’s discussion that if the private right of action is not removed or significantly dialed back, HB 969 will not pass the House. As a result, I expect we will see a dialed back or removed private right of action in the version of HB 969 considered by the House floor. (My money is on a dialed-back version of the private right of action because the House Speaker wants to punish Big Tech and thinks a private right of action in this bill will allow for that.)

Regardless of what the House passes, the Senate’s version does not include a private right of action. So the language of a final privacy law will depend on who wants their version more – the House Speaker or the Senate President. 

TAKEAWAY — businesses that oppose HB 969 would be well-served to contact the House Speaker, express concern about the private right of action, and encourage the Senate President to stand by any version passed by the Senate.    

It’s possible that nothing comes of all this. If there is no resolution on a final law before April 30th, when the Florida legislative session concludes, the clock runs out. I don’t believe this is a highly likely outcome, but it’s definitely possible given the differences between the House and Senate versions.

Have Privacy Advocates Found Their Model for Privacy Laws in “Red States”?

Stepping back and looking at the big picture, is it possible that privacy advocates have found their model for getting a privacy bill (even one with a private right of action) passed in red states? To date, privacy advocates have had trouble garnering Republican support for privacy laws, especially those with private rights of action. Here, however, proponents of HB 969 have successfully persuaded Republican politicians at all levels (who are usually pro-business) that these laws can be used to attack a new enemy – big tech.  It will be interesting to see whether this model will be replicated in other states. If this theory is correct, it will mean a significant unexpected consequence of Twitter’s Trump ban and a perceived liberal bias on other social media platforms.  But is this a smart long-term play for Republicans? It’s only a matter of time before conservatives launch their own social media platforms and these rules will apply to those companies, too. Who will be better prepared to defend the private rights of action and enforcement actions – big tech companies that have had over a decade head start, or new social media upstarts?       

Representative McFarland

I continue to believe that Representative Fiona McFarland is one of the most talented and promising politicians in the State of Florida. She is sharp, measured in her comments, understands how to leverage her relationships with those “across the aisle”, has a strong work ethic, she’s modest, relatable, and is extremely well-liked by her colleagues. You also have to appreciate how she has carved out a niche in technology (she notched wins not just for her privacy bill but for her autonomous vehicle bill today, too). All of this is a recipe for long-term success.   

I predict in the next ten years we’re going to see Representative McFarland do BIG things in Florida politics, and I want to be able to say “I told you so!”

TAKEAWAY — if I were Tesla, Apple, Google, or one of the other big tech companies, I’d want to develop strong relationships with Representative McFarland and her staff to shape the future of technology law in Florida. I’d also want to invest in creating a long-term dialogue that supports McFarland and her staff in maintaining awareness of trends and developments in technology.     

Who is Propel?

The mysterious advocacy group, Propel, was the only organization to publicly support the Florida privacy law today. No representative from the organization was present (or has ever been present) at a legislative hearing to publicly express support for the law. My guess is that it’s a privacy advocacy organization, a specific individual with a lot of money trying to shape Florida law (a la California), the plaintiff’s bar, or a combination.

Most Random Exchange of Any Privacy Hearing . . .  Probably Ever

Finally, my award for strangest exchange during a hearing on a privacy bill goes to this one today between Representative Geller and Committee Chair:

Geller to McFarland – So would this prohibit our DNA from being shared with aliens who want to use it to clone us?

Chair Ingoglia – I’m sensing a wet noodle coming out soon.

I could go in so many directions with that exchange, but it was funny, and it was generally refreshing to watch the bipartisan banter throughout the hearing between Representative Geller, the Chair, and their colleagues.

https://www.jdsupra.com/legalnews/have-privacy-advocates-found-a-new-path-5037287/

Florida Justice Reform Institute

Florida Privacy Legislation Moves Forward

/in

 

JD Supra

March 11, 2021

Florida Privacy Legislation Moves Forward

Header

HB 969, a comprehensive privacy law that would immediately become the most onerous in the United States, sailed through the Florida House of Representatives’ Regulatory Reform Subcommittee yesterday.

Before diving deeper into the House subcommittee hearing, it should be noted that the Florida Senate is now considering SB 1734 (the “Florida Consumer Protection Act”) that would create a similarly sweeping privacy law but go one step further in allowing for a private right of action for any violation of the privacy obligations in addition to data breaches. The potential litigation risks to companies doing business in Florida created by this bill are enormous.

Back to the House subcommittee hearing. The subcommittee hearing began with consideration and unanimous approval of five amendments that incorporated minor changes and fixed drafting errors. Representative Fiona McFarland then provided an opening statement. She was knowledgeable about her 38-page bill, demonstrated effective use of her military background, and was highly likeable. Throughout the more than one-hour hearing, Rep. McFarland struck the right tone – expressing an eagerness to pass the law but open to changes. She is, without question, someone to watch in Florida politics, and if this bill becomes law it will in large part be because of its effective sponsor.

The hearing then moved to questions from the 18 subcommittee members.  Examples of the discussion include:

Representative Giallombardo (R) mentioned his background in technology and asked about compliance costs. Later in the hearing he stated that it is “not difficult to be in compliance [with HB 969] these days” because companies that collect personal information are likely already in compliance with other similar laws and standards (like the Payment Card Industry’s Data Security Standards), so the cost should be minimal. Representative McFarland deftly avoided providing a price tag, arguing that if a company chooses to collect personal information of a Florida resident, the price tag is somewhat irrelevant. (As discussed in a previous post, the bill would require companies to incur potentially hundreds of thousands of dollars to perform a data inventory, establish a data subject request process, prepare policies and procedures, perform a third-party cybersecurity risk assessment, and engage legal counsel to understand the law’s application and negotiate new contract requirements. Additionally, most small and mid-sized companies use third-party payment processors to shift the PCI DSS burdens Rep. Giallombardo referenced.)

Representative Dan Daley (D) mentioned his own experience counseling clients with GDPR enforcement and expressed “a lot of heartburn” over the private cause of action. He (like all other members) nevertheless voted for the bill to pass the subcommittee.

Representative Eskamani (D) expressed concern that the law was not aggressive enough and floated a softball to Rep. McFarland for examples of how businesses are using data to make money. McFarland responded with an example of how an angry father learned his daughter was pregnant when a department store targeted her with baby product advertisements. (The veracity of this story, which has become lore for privacy advocates, has recently been challenged here and here.)

Representative Sirois (R) expressed concern that the law required companies to delete personal information faster than necessary. Rep. McFarland conceded that this was an area of the bill that continues to be explored for further changes.

Representative Harding (R) asked about loopholes we have learned from other state privacy laws. Rep. McFarland noted that other state laws create exemptions for entire industries and conceded that HB 969 required more work on identifying appropriate exemptions.

Representative Gregory (R) suggested that the Florida Attorney General’s Office (rather than private class action lawsuits) may be the better way to address the underlying concerns of data breaches. Rep. McFarland conceded a few times throughout the hearing that the private right of action is the part of the law that has come under the greatest criticism from the general public.

Representative Overdorf (R) asked how many businesses Rep. McFarland believed would have to comply with this bill in light of the fact many may already be in compliance with other similar laws. McFarland did not know or hazard a guess.

Representative Robinson (R) wanted to learn where HB 969’s scope requirements originated. McFarland stated that the scope matches that of California’s law.  Rep. Robinson pointed out that costs of implementation will surely be passed on to consumers, almost as a tax. Rep. McFarland conceded that they likely would and that “consumers are OK with that.” Rep. McFarland also said she was open to extending the January 1, 2022 compliance deadline.

The subcommittee then took comment from the public.  Perhaps the most effective argument was by William Large of the Florida Justice Reform Institute, who made two strong points previously made in this previous blog post. First, Mr. Large expressed concern that the expansive definition of personal information will create a massive windfall for lawyers (particularly the plaintiff’s bar). He provided the example of a cyberattack resulting in the disclosure of something minor about one-million Florida residents (like their preference for a certain toothpaste). HB 969 would allow for a class action lawsuit based on such an incident resulting in damages of $750,000,000 and millions of dollars more in attorney’s fees. Mr. Large also expressed concern that the private right of action would create an incentive in “gray area” data security incidents (where a breach of personal information is not clear) to not notify impacted individuals out of fear of large class action lawsuits. Rep. McFarland did not address the “gray area” incentive not to notify and seemed to support the large class action lawsuit on the ground that learning one’s toothpaste preference would be an invasion of their private home.

Another fairly persuasive public commenter was a representative from Associated Industries of Florida who argued that HB 969 would effectively constitute a tax on small businesses, with an estimated implementation cost of $55 million.

The other public commenters were less effective.  A representative from the Florida Bankers Association requested a limited exemption for entities governed by the GLBA, similar to the exemption in the CCPA.  A representative from the Florida Retail Federation expressed a general concern about the private cause of action and short implementation within approximately 15 seconds.

The subcommittee then debated the bill before all 18 members voted unanimously to pass the bill out of subcommittee.  The bill will now move to another subcommittee for further consideration while Rep. McFarland considers additional amendments. If you’d like to watch the entire one hour and 10 minutes of the hearing, you can do so here.

My Personal Takeaway

With the Governor’s endorsement of HB 969, the Senate’s consideration of its “CCPA on Steroids” bill, and the way HB 969 sailed through subcommittee consideration (thanks in large part to its highly effective Republican sponsor), it will be interesting to see whether anything will slow down momentum for a comprehensive privacy law in Florida with a strong private right of action.  Stay tuned . . .

https://www.jdsupra.com/legalnews/florida-privacy-legislation-moves-7284836/ 

Florida Justice Reform Institute

Florida Justice Reform Institute

  • Phone

    (850) 222-0170

  • Hours of Operation

    Monday – Friday, 9 a.m.-5 p.m.

  • Address

    210 S Monroe Street
    Tallahassee, FL 32301

Site Links