David M. Stauss, left, and Malia Rogers, right, with Husch Blackwell in Denver.

Florida lawmakers have introduced companion bills in the Florida House (HB 963) and Senate (SB 1670) that would create limited online privacy rights and obligations in the state. The legislation—which is yet to be named but for our purposes will be referred to as the 2020 Florida Consumer Privacy Act (act)—appears to be very similar to the Nevada Online Privacy Protection Act, which was amended last year to add a right to opt-out of sales of covered information. The act is therefore distinguishable from the California Consumer Privacy Act (CCPA) and more akin to the California Online Privacy Protection Act (CalOPPA).

Florida joins a number of other states considering consumer privacy legislation, including Illinois, Washington state, Nebraska, New Jersey, New Hampshire, Virginia and Hawaii.

Below is our analysis of the Florida legislation (as introduced).

To Whom Does It Apply?

Consumers, which is defined as "a person who seeks or acquires, by purchase or lease, any good, service, money or credit for personal, family or household purposes from the website or online service of an operator."

What Entities Are Covered?

The act would apply to "operators," which is defined as a person who owns or operates a website or online service for commercial purposes, collects and maintains covered information from consumers who reside in Florida and use or visit the website or online service, and purposefully directs activities toward Florida or purposefully executes a transaction or engages in any activity with Florida or a Florida resident.

Excluded from the definition of operators are third-parties that host a website on behalf of an operator, GLBA and HIPAA-regulated entities, and motor vehicle manufacturers/repairers under certain circumstances.

What Information Is Covered?

Covered information, which is defined as the following types of information if collected through a website or online service: first and last name; home or other physical address that includes the name of a street and the name of a city or town; email address; telephone number; Social Security number; identifier that allows a consumer to be contacted either physically or online; and any other information concerning a consumer that is collected from the consumer through the website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.

What Rights Are Created?

Consumers would have the right to submit a verified request to an operator directing the operator not to sell any covered information the operator has or will collect about the consumer.

The act defines "sale" narrowly to mean "the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons." There are also five exceptions to the definition of sale, including the disclosure of information to processors, the disclosure of information to other persons for purposes of providing a product or service requested by the consumer and the disclosure of information to affiliates.

Are There Any Exemptions?

In addition to the above noted exemptions, the proposed law would not apply to an operator: who is located in Florida, whose revenue is derived primarily from a source other than the sale or lease of goods, services or credit on websites or online services, and whose website or online service has fewer than 20,000 unique visitors per year.

Would Companies Need to Update Their Online Privacy Policies?

Maybe. Similar to CalOPPA and comparable laws in Nevada and Delaware, the law would require operators to provide a notice that:

• Identifies the categories of covered information that the operator collects through its website or online service about consumers who use or visit the website or online service and the categories of third parties with whom the operator may share such covered information.
• Provides a description of the process, if applicable, for a consumer who uses or visits the website or online service to review and request changes to any of his covered information that is collected through the website or online service.
• Describes the process by which the operator notifies consumers who use or visit the website or online service of material changes to the notice.
• Discloses whether a third party may collect covered information about a consumer's online activities over time and across different websites or online services when the consumer uses the operator's website or online service.
• States the effective date of the notice.

Operators that already comply with the laws in California, Nevada and Delaware presumably would not need to update their disclosures (unless there was some unique aspect of the data being collected about Florida residents).

Notably, as is the case with Nevada's law, the act does not appear to require operators to disclose the right to opt-out in their online privacy notice. However, operators that have chosen to provide such a notice to Nevada residents could, in theory, just add a comparable Florida notice.

How Would It be Enforced?

The law would be enforced by the Florida Attorney General's office. Prior to bringing an enforcement action, operators would need to be notified of the violation and provide 30 days to cure. It is not clear that the notice would need to come from the AG's office (as opposed to a consumer complaint). The AG's office could seek a civil penalty of up to $5,000 per violation.

Would It Create a Private Right of Action?

No.

When Would It be Effective?

It goes into effect July 1.

Anything Else?

The act would prohibit the use of personal data contained in public records for certain marketing, soliciting and contact without the person's consent.

David M. Stauss is a partner at Husch Blackwell and co-leader of the firm's privacy and data security practice group. He regularly assists clients in preparing for and responding to data security incidents, including managing multi-state breach notifications. Malia Rogers is an attorney in the firm's Denver office and assists clients on emerging data privacy issues.