Florida privacy bill tanks over individuals’ right to sue

A bill in Florida that could’ve given the state some of the most aggressive consumer data privacy rules in the country will not become law after the state House and state Senate could not agree on a key provision involving the right of individuals to sue companies that mishandle their personal information.

The bill, which had been supported by all but one member of the 120-seat House — as well as Gov. Ron DeSantis — would have required any company that conducts business in Florida and takes in at least $50 million in annual revenue to disclose to its customers what personal information it collects and how that data is used. It also would’ve given Floridians the right to ask those companies that information, from names and dates of birth to shopping histories, not be collected at all.

If passed, it the bill would have had “more teeth than any other privacy law because it’s so broad,” Alfred Saikali, a Miami attorney who represents companies that would have been required to comply, told StateScoop last month when the bill was under consideration.

But the measure died as Florida’s legislative session came to an end before the chambers could resolve their differences over what’s known as a private right of action — the ability for people to sue companies for individual complaints. The Florida Senate, as well as many lobbyists representing businesses that could’ve been subjected to the bill, opposed that right and would have left enforcement in the hands of Florida’s attorney general, similar to a law recently enacted by Virginia.

Florida’s privacy bill also created an odd alignment between DeSantis and his fellow Republicans — who have been waging an ideological war against mainstream social media companies that booted former President Donald Trump from their platforms for repeatedly violating their content guidelines — and Democrats and left-leaning groups that’ve historically backed consumer protections. Saikali told StateScoop last month the bill was “motivated by wanting to punish Big Tech.”

The fight over a private right of action is not specific to Florida, or even to states dominated by Republican elected officials. Data privacy legislation in Washington state has failed three years in a row over the same dispute. Privacy legislation being considered in Connecticut at one point contained an individual right to sue, but that language has been removed.

The California Consumer Protection Act, the 2018 law that’s been the benchmark for other states’ privacy laws, contains a limited private right of action, permitting people to sue companies only if their Social Security numbers, driver’s license numbers or medical or financial records are exposed in a data breach.

Florida’s legislature will reconvene in Jan. 2022.