Renzo Downey
Over opposition from business and legal groups, a House panel gave its unanimous approval to a bill to protect internet users’ data privacy.
That measure (HB 969), filed by Sarasota Republican Rep. Fiona McFarland, would give consumers the right to control how their personal data is shared and sold. That data helps businesses know more about individual consumers and help make things like targeted ads possible.
The proposal is a priority of Gov. Ron DeSantis and House Speaker Chris Sprowls, announced as part of their plans this Session to combat Big Tech, both in social media and on consumer privacy.
The social media half of that package has drawn opposition, mainly from Democrats. But McFarland attempted to distance her bill from that mostly partisan effort during the Wednesday House Regulatory Reform Subcommittee meeting.
“This bill is purely about a Florida consumer who through interacting with a for-profit business online hands over troves of personal, very intimate information about themselves that could reasonably be used to identify them,” McFarland said, “whether that be their name, address, phone number or things like their IP address or their browsing history or even that they’re classified as a 30-something, White, heterosexual female with a college degree.”
Committee members passed the measure out of its first committee stop by a unanimous vote.
The bill would require businesses to publish a privacy policy and tell consumers, if asked, what data they have on them, how they got it, and how they use it. Consumers could ask to have that information deleted or corrected.
Consumers could opt out of having their data sold or shared. Minors would have to opt in for data sharing.
The bill would add biometric data to the list of protected information. That builds off of Sprowls’ bill, which DeSantis signed into law last year, making Florida the first state to guarantee DNA privacy for customers’ life, disability, and long-term care insurance.
The Attorney General would have the power to enforce intentional and unintentional violations of the bill.
McFarland told the committee she enjoys targeted ads and finds them helpful. However, she highlighted one case of a minor who had not told her parents she was pregnant, but her household received baby formula through targeting.
“That is to me where it stops being useful and starts being very invasive when companies know us better than we and our family know one another,” she said.
McFarland told the committee she has worked with and continues to work with industry specialists both for and against her proposal. She is pulling ideas from Europe and states like California and Virginia and building off of them to create a “uniquely Floridian version.”
Businesses are concerned the strict regulations and January 2022 implementation date could overly burden Florida businesses. Even restaurants with mailing lists, as Merritt Island Republican Rep. Tyler Sirois mentioned.
The bill would touch every single Florida resident and business, committee Chair Rep. Bob Rommel cautioned.
McFarland said she was aware of the additional efforts businesses would have to take to maintain compliance and added she doesn’t want to halt innovation. But making it easier for businesses would be “giving up” on the rights of consumers.
The bill would also allow businesses to charge consumers for denying them information to compensate for missing out on selling personal data, if the businesses could prove those losses.
The Representative said some companies could decide to absorb the costs as the right thing to do and the cost of doing business. She conceded that some businesses would certainly shift costs to consumers, but many users would accept the additional fees.
“They are OK with understanding that if their data is better protected or more in their own control then perhaps that would be a handoff that they are willing to either pay slightly more for or have a different user experience,” McFarland said.
However, Cape Coral Republican Rep. Mike Giallombardo, a tech entrepreneur with experience in cybersecurity, didn’t foresee a huge cost for businesses. Many security and privacy mechanisms already exist, he told the committee.
“It is not that difficult to be in compliance these days with cloud services like Azure, AWS, Red Hat,” Giallombardo said. “A lot of times, the access control is the only thing that the business needs to really comply by.”
Among those in support of the measure were CFO Jimmy Patronis. In a statement after the committee, he thanked the Governor, Sprowls and McFarland for prioritizing holding Big Tech accountable.
“There’s nothing more valuable to a person than one’s own identity, and Big Tech has figured out a way to cash-in while leaving the consumer in the dark,” he said. “Floridians deserve to have their data protected and I’m proud to support House Bill 969, it’s good for Florida consumers, good for small businesses and most importantly, it’s the right thing to do.”
Florida Justice Reform Institute President William Large said the bill’s current definition of personal information is more expansive than California’s.
“If a group of hackers hack a business, and it gets out that I buy Crest toothpaste, normally that would be a big so what, but under the private cause of action’s penalties, and there’s a million people hacked, that could result in a potential class action worth $750 million, and that’s the problem with this bill,” he told the committee.
With comparisons to California, lawmakers’ perennial boogeyman, and its existing law, McFarland offered a defense of the Golden State’s business climate.
“The sky does not appear to have fallen in the state of California,” she said.
The bill next advances to the House Civil Justice & Property Rights Subcommittee. Fleming Island Republican Sen. Jennifer Bradley‘s version (SB 1734) has not been scheduled for its first hearing.
