A consumer privacy bill that Gov. Ron DeSantis described as a check on “Big Tech” is undergoing changes to make its private litigation provisions less objectionable to business interests, according to the sponsor’s legislative assistant.
Rep. Fiona McFarland (R-Sarasota) is spearheading House Bill 969, which recently cleared the House Civil Justice and Property Rights Subcommittee. The bill would require businesses to take reasonable steps to protect consumers’ personal information, including biometric data such as fingerprints and DNA identifiers, and report data breaches.
Larger businesses would also have to publish privacy policies under the provisions of HB 969. In addition, consumers would have the right to see their collected data, correct the information if needed and block the sale or sharing of their information.
Some of the key changes to the bill now under consideration involve which businesses the bill’s provisions would cover, when consumers could file private legal actions against companies for privacy violations and when the bill would take effect, according to Clay Gunter, McFarland’s legislative assistant.
“The cause of actions is probably the biggest thing that we’re going to have to address before the bill goes to the floor,” Gunter told the Florida Record.
Under the current text of the bill, a consumer could bring a civil lawsuit against a business only in certain circumstances. These include a firm’s failure to protect the consumer’s unencrypted personal information or email address, password and other identifiers. A suit could also go forward if a firm failed to delete or correct a consumer’s personal data after a formal request was made – or if a company shared or sold personal data against a consumer’s stated wishes.
Damages in such cases would have to be from $100 to $750 per incident, and a consumer who prevails in such litigation would recover reasonable attorney costs as well.
“A lot of amendments we’ve made are specifying different definitions and things that would not allow frivolous lawsuits,” Gunter said.
Another matter of contention is the bill’s impact on smaller businesses. In its current form, the bill covers businesses with worldwide yearly revenues exceeding $25 million or businesses that handle the personal information of 50,000 or more consumers. Those numbers could go up to $50 million and 100,000 consumers, according to Gunter, as discussions with stakeholders continue.
The current effective date of the bill is Jan. 1, 2022, but that could be extended, Gunter said.
The aim of any changes is to clarify the original intent of the measure while keeping legislative leaders, the governor and business representatives happy with the final product, according to Gunter.
“It hasn’t gotten watered down yet, so we’re happy about that,” he said.