Breaking news out of Florida: On April 21, 2021, the Florida House, in a near unanimous vote, passed the Florida Privacy Protection Act (FPPA). Largely modeled after the California Consumer Privacy Act (CCPA), the FPPA would have made Florida the third state to pass a comprehensive privacy and data security law, following Virginia’s passage of its Consumer Data Protection Act (CDPA).

Just as quickly as it passed the Florida House, though, it was killed by the Senate on April 30, 2021, after disagreement between the House and Senate as to whether the bill should give individuals a private right of action to sue companies that violate their privacy rights under the FPPA. The pro-private-right-of-action camp believes a privacy act without a private right of action is an impotent law, while the anti-private-right-of-action camp believes the right unduly burdens businesses with costly compliance obligations.

Washington’s version of the CCPA, the Washington Privacy Act, suffered a similar fate a month ago after a similar fallout over the same private right of action question.

The failure of both Washington and Florida to pass comprehensive privacy laws – along with California’s and Virginia’s passage of comprehensive privacy laws that include a private right of action – demonstrates that the tension between individual privacy rights and concerns for businesses to collect personal information go beyond political, cultural, and geographic divisions. States continue to weigh the proper balance, and as more states start to consider and pass legislation, it will be critically important to stay updated on how each jurisdiction regulates the processing of personal information.