Fla. Panel Shines Bipartisan Green Light on Privacy Bill With PRA

The majority-Republican Florida panel voted 23-0 for HB-9 by Rep. Fiona McFarland (R) with a McFarland amendment to align exemptions across various sections, add guidance for courts on damages and increase the bill’s maximum age for a minor to 18 from 16. Last year's bill passed the House but died after the Senate cut the PRA (see 2104300059). Companies collecting and using data can be convenient, but "it's time to put some Florida sunlight on how our personal data is being used,” McFarland said.

Calling the bill “fantastic,” Rep. Lawrence McClure (R) said his lingering concerns for businesses are “nowhere close” to those he has for consumers. Rep. Bob Rommel (R) said concerns he has about PRA could be alleviated by adding a cure process to give companies a chance to remedy violations before private suits are filed. “If we can work on that cure, I'm willing to help you there.” Rep. Tom Fabricio (R) supported the bill despite his concerns that litigation and compliance costs could raise prices. Rep. Randall Maggard (R) also said he supports the bill despite PRA fears.

The PRA gives Rep. Dan Daley (D) “some heartburn” because he doesn’t want growth of a “cottage industry,” but the bill is a step in the right direction, he said. He disagreed with opponents’ argument that a privacy law isn't needed because consumers aren’t asking for one. Average consumers don’t realize how much data businesses have on them, Daley said. “It’s candidly kind of scary.” HB-9 strikes a good balance, though language about its scope might need clarification to relieve opponents’ concerns that it would apply to more companies than legislators intend, said another Democrat, Rep. Joseph Geller.

Chair Blaise Ingoglia (R) countered industry arguments that Florida should wait for a national privacy law: “The federal government is totally inept, and they're never going to pass anything of substance.” He also questioned whether regulatory costs would be as high as opponents say. Shook Hardy privacy attorney Alfred Saikali testified compliance could cost $300,000 to $700,000 yearly. Ingoglia asked why businesses wouldn’t already have data officers and similar professionals helping businesses comply with existing regulations from other states and Europe.

Business group witnesses opposing HB-9 made “a lot of specious arguments,” said Rep. Chuck Clemons (R). It was “some of the dumbest stuff” he has ever heard, including the argument it would be better for Congress to act, he said: "This is Florida. We don't wait on the federal government for anything."

Recognizing a PRA is a “heavy tool to wield,” McFarland said, she's open to adjusting it to avoid frivolous suits. She stressed the bill would apply only to companies that sell their customer’s data, not companies that use data they collected themselves on their own customers. “There is going to be a compliance cost if you're a business that profits off of your consumers,” she said. “That hurts me … as a pro-business lawmaker, but we are entrusting companies with personal information about us that is so sophisticated that our digital version of ourselves is more true to who we are than our friends know about us.” McFarland said: “If I could write a bill that said, 'Don't do creepy things,' I would, but that's not how you write laws.”

Better to engage states than Congress on privacy, said Weiser at the FPF event recognizing several privacy policy papers from the past year: “The federal level is a painful story that a number of us lived through.” Congress hasn’t been able to act, but in Colorado, the legislature unanimously passed a bipartisan privacy law, he said: "Something has gone wrong with our Article I branch. The idea of dialogue and policymaking that we used to have in Washington -- that the founders envisioned -- is absent."