It was a busy week for HB 9 in Tallahassee. There was a strike-all amendment, several proposed unfriendly amendments, a House Judiciary Committee meeting, a second strike-all, more unfriendly amendments, and a date for a House floor vote. This post will summarize what happened and provide a roadmap for the final two weeks of the Florida legislative session.
For those who want the TL;DR version, HB 9 was amended: (1) to add a tiered private right of action based on the defendant’s wealth; and (2) to reduce the scope to targeted advertising and to eliminate “receives” from the triggering activity. The tiered private right of action has little impact and could be unconstitutional. Similarly, removing companies that merely “receive” data is meaningless because the bill still applies to companies that “share” personal information and the definition of “share” includes having “access” to personal information. Once amended, HB 9 passed the House Judiciary Committee and now moves to a Tuesday House floor vote. While a few minor changes may still occur, the current version of HB 9 will likely be 95% of what is passed on Tuesday. The focus will then turn to the Senate, which is not expected to pass a privacy law that contains a private right of action or such a broad scope. Governor DeSantis will likely need to weigh in on the version he wants to see become law.
The Recap
Rep. McFarland’s Strike-All
On the evening before the House Judiciary Committee was set to hear HB 9 (the bill’s last stop before a floor vote), Rep. McFarland offered a proposed strike-all amendment. (Remember that a strike-all is where the entire language of a bill is deleted and replaced with new language.) In this case, the strike-all made several changes:
(1) You will recall that a controller must meet two of three requirements – (a) annual revenue greater than $50 million; (b) annually buys, receives, sells, or shares personal information of 50,000 or more Florida residents; and (c) derives 50% or more revenue from selling or sharing personal information. Rep. McFarland’s strike-all sought to eliminate “receives” personal information from the second threshold, which is the threshold that will capture almost all Florida businesses to whom the law would apply. The problem, however, is that the definition of “shares” includes “access” to a consumer’s personal information, as I discussed in my last post. So, this change really has no effect on the bill’s scope.
(2) In a positive change for businesses to whom the law would apply, the bill’s scope was dialed back to companies that buy, sell, or share the personal information for targeted advertising only. As I mentioned in an earlier blog post, the bill previously applied to companies that buy, receive, sell, or share personal information for targeted advertising or any other purpose that is not explicitly exempted by the numerous exceptions listed at the beginning of the law. So, for example, the bill would have applied to companies that receive personal information from their customers and use it to better understand their customers’ behavior. Rep. McFarland’s strike-all removes the “or any other purpose” language, so that the bill would apply only to targeted advertising.
(3) The strike-all changed the private right of action to limit it to the wealthiest companies. Specifically, the private right of action would not apply to companies with annual revenue less than $50 million. For companies with annual gross revenue between $50 million and $500 million, the private right of action would apply, but the plaintiff would not be entitled to recover attorney’s fees. For companies with annual gross revenue over $500 million, the private right of action would apply, and the plaintiff would be entitled to recover attorney’s fees. The proposed amendment was problematic for several reasons. First, as a practical matter, it doesn’t recognize how privacy litigation actually works. Plaintiff’s attorneys will disregard the revenue threshold requirement – they either won’t know the defendant’s revenue or won’t care to find out. Why? Because they know that once served with the lawsuit, the small company defendant will need to either resolve the lawsuit with the plaintiff for $750 plus $25,000 in the attorney’s fees, or fight the lawsuit and pay his own lawyer similar attorney’s fees. So there really is no real safe harbor from the lawsuit for a small company. Second, a private right of action that is based entirely on what the defendant is worth strikes me as unconstitutional and in violation of the Equal Protection Clause. Third, a private right of action based on the defendant’s wealth is an easy way to disincentivize larger companies from doing business in Florida. It also creates a bad precedent that will surely be repeated in other Florida laws (beyond privacy).
(4) The strike-all created an optional attorney’s fees provision for companies where: (a) the lawsuit is dismissed with prejudice; (b) there is fraud on the part of the consumer; (c) the consumer is not a Florida consumer. (You will notice there is no “or” or “and” between (b) and (c). That’s because it’s not in the strike-all either. It’s not clear which was intended, but for the purpose of this post, I’ll assume it’s “or”). Setting aside the fact that the right to attorney’s fees is optional, the plaintiff controls whether that option is even available. How? The plaintiff (or the court) can voluntarily dismiss her lawsuit without prejudice, thereby avoiding fees entirely. The optional nature of this attorney’s fees provision is in contrast to the mandatory provision for attorney’s fees, and is in contrast to Florida’s leading consumer protection law (the Florida Deceptive and Unfair Trade Practices Act) which simply awards attorney’s fees to the “prevailing” party.
(5) The strike-all added a one-year statute of limitations for the claim, which would start to run “after discovery of the violation.” A plaintiff who learns ten years later that the company had not complied with a request to delete her information could sue a decade after-the-fact. The company, which is required by HB 9’s retention requirement to delete the plaintiff’s information no later than 3 years after the last interaction, would no longer have evidence to defend itself against such a lawsuit.
(6) The strike-all amended the exemption in (1)(g) in an attempt to clarify that the bill wouldn’t apply to companies that share personal information with their marketing vendors to market their own goods and services. Instead of simply saying that, however, the exemption says it applies to:
- “Personal information obtained through the controller’s direct interactions with the consumer,” – stuff you collect;
- “if collected in accordance with the provisions of this section” – no clue what this means as the bill doesn’t provide a specific way in which you must collect the personal information;
- “that is used by the controller or the processor that the controller directly contracts with for advertising or marketing services” – if the personal information is used by the company or its marketing vendor;
- “to advertise or market products or services that are produced or offered directly by the controller.” – to advertise the controller’s stuff (and nobody else’s stuff).
- But the exemption wasn’t finished – “Such information may not be sold, shared, or disclosed unless otherwise authorized under this section.” In other words, please comply with this law – it is unclear why this additional sentence is necessary.
Painfully missing from the strike-all was a right to cure, any fix to the 48-hour requirement to comply with a request to opt out of selling/sharing personal information, and a fix to the problem created by the above-referenced three-year retention requirement.
Rep. Learned’s Amendments
One of my new personal heroes, Rep. Andrew Learned (D), attempted a LeBron-like “get that mess out of my House” move with several amendments of his own. Those amendments would have:
- Limited HB 9 to all three threshold requirements (ensuring that the bill would apply only to companies that generate at least 50% of their annual revenue from buying/selling personal information);
- Removed “receives” and “shares” from the second threshold requirement (referenced above), which would have solved the issue of not removing the term “access” from the definition of “shares”;
- Eliminated the three-year retention requirement, which would have put companies in the position of deleting information they might need later to exercise their legal rights or defend themselves in litigation;
- Changed the 48-hour requirement to comply with a request to stop selling/sharing personal information to 45 days (like the other consumer rights in HB 9);
- Explicitly applied HB 9 to political entities (as I mentioned in a recent post, I believe HB 9 already applies to political entities, so the amendment was likely unnecessary); and,
- Most importantly, created a 45-day right to cure and allowed the prevailing party to obtain attorney’s fees. This amendment would have also raised the statutory penalties to $1,000.
In short, Rep. Learned addressed almost every concern companies have had with HB 9.
The House Judiciary Committee Meeting
The full House Judiciary Committee Meeting can be viewed here, beginning at the 20:07 mark. Rep. McFarland was her usual rock-star self in defending HB 9 against incoming fire from many different directions – unfriendly amendments, concerns expressed by fellow Judiciary Committee members, and concerns expressed in public testimony. (You can substantively disagree with parts of HB 9, but you cannot criticize the way Rep. McFarland has advocated for HB 9, her commitment to preparing Florida for a more digital economy, and her willingness to listen to and learn from a variety of stakeholders. If she is not running for a statewide office or Speaker of the House within the next five years, the Republican party is missing out on a great opportunity.)
Without question, the biggest surprise during the hearing was the galvanized opposition by Democratic members of the committee. Representatives Alexander, Diamond, Grieco, Hart, and Learned all voted against HB 9 and/or in favor of some or all of Rep. Learned’s amendments. The Democrats were vocal about their concerns regarding the lack of a right to cure in the private right of action, the potential compliance challenges and costs, and the potential that the law will be abused against small companies. Rep. Diamond (a centrist Democrat) spoke at length about how the right to cure seemed like a no-brainer – mitigating frivolous lawsuits, giving companies that make mistakes a chance to fix them, yet still allowing individuals to have a private right of action. He expressed frustration with a technical position Rep. Beltran (R) took regarding the amendment’s line numbers that led to the right to cure’s defeat.
Meanwhile, the Republican committee members held their ground against the business community, voting in favor of the strike-all and opposing all of Rep. Learned’s amendments. During debate, Rep. Beltran seemed unconcerned about the strike-all’s biggest change (a private right of action based on corporate wealth), arguing that companies exempted from the private right of action who are improperly sued need only pay $5,000 to their own lawyer to obtain an early motion for summary judgment. Setting aside whether this would be an acceptable outcome, his analysis was inconsistent with how many privacy cases are litigated. Before filing an “early motion for summary judgment” counsel would need to perform some preliminary factual investigation, file an answer or motion to dismiss in response to the complaint, develop or identify some record evidence, and draft the motion for summary judgment. That will all cost the company money. But even if the company found a lawyer who would do all that for $5,000, the amount of a company’s wealth is typically treated as a factual issue. So it would be simple for a plaintiff’s lawyer to find data that would create a question of fact that makes summary judgment inappropriate.
Everyone’s interest was piqued, however, when debate turned to Rep. Learned’s amendment that would have explicitly applied HB 9 to political committees. Scrambling to avoid debate on the substance of the amendment, Republican committee members tried to raise a “point of order.” When that failed, Rep. Learned pointed out the hypocrisy of members who would vote for the strike-all but then vote not to apply these same privacy protections to themselves, particularly when political campaigns are the biggest offenders of SPAM emails, phone calls, and text messages.
Ultimately, the strike-all passed and all of Rep. Learned’s amendments died in a blaze of glory. Nevertheless, I am eager to see what comes of this interesting reversal of roles in the long term – where Democrats are tempering laws that would harm companies, and Republicans are creating private rights of action that target the wealthy. The role reversal was clear to everyone in the room, including Rep. McFarland who said she felt like Alice in Wonderland, where things are not as they should be. Will Democrats continue to make a hard push for corporate support as the Republican party feeds a more populist, anti-corporate base? Companies are not happy with the Republican-led unwavering support for HB 9, and everyone has taken for granted the Democratic support of HB 9 thus far. This could potentially be a smart play by the Democrats to build their political resources and forge more centrist bonds with corporate stakeholders. While I’d still be surprised to see Democrats oppose HB 9 on the House floor, this was the first time in the two years of committee hearings on a Florida privacy bill that we have seen all of the committee Democrats stand up in favor of companies who would be harmed by HB 9. Could we see similar Democratic-led arguments against other populist legislative measures beyond data privacy?
More Amendments Proposed
Since the hearing, Rep. McFarland has introduced yet another strike-all. This one makes minor changes to the bill. First, it carves out exemptions for – personal information necessary to fulfill the terms of a warranty; personal information necessary for a product recall; and, perhaps most significantly, personal information processed for measuring or reporting advertising or content performance.
Second, it extends the 48-hour requirement to comply with a request to opt out from selling/sharing personal information to four calendar days. This is hardly enough time to determine whether the request is valid, research whether an exception applies, and implement the request throughout the company and its processors.
Finally, it limits a defendant’s attorney’s fees to only those instances where the plaintiff’s lawsuit is deemed frivolous. This adds nothing, as section 57.105, Florida Statutes already provides this kind of relief. But as we all know, it’s incredibly difficult to convince a judge that a case is frivolous, and most companies don’t want to waste the money trying to do so. In short, an already company-unfriendly position on attorney’s fees would become more unfriendly with this latest strike-all.
In addition to Rep. McFarland’s strike-all, Rep. Learned will be back on the scene with his same set of amendments. I cannot wait to see the debate on the amendment applying HB 9 to political entities and the amendment on the right to cure.
What to Expect Next
Florida’s legislative session ends on March 11th. The House will pass its version of a privacy bill next week. I anticipate that the passed version will look very much like Rep. McFarland’s current proposed strike-all.
The focus will then turn to the Senate, where its version (SB 1864) has yet to be heard by a single committee. By all accounts, the Senate has no appetite for a privacy bill with a private right of action or a scope as broad as HB 9’s. Nevertheless, a committee hearing is expected on a privacy bill of some form. That hearing will likely take place next week.
There are a few possibilities of what the bill before that committee would look like. First, we could see an amendment that would amend SB 1864’s scope to companies that generate 50% or more of their revenue from buying or selling personal information. Interestingly, SB 1864 includes greater consumer rights than HB 9, like an opt-in requirement for processing sensitive information and the creation of a dedicated data privacy unit within the Attorney General’s Office. But the Senate’s version has no private right of action.
Alternatively, we could see a strike-all that replaces SB 1864 with the language the House passes in HB 9 but removes the private right of action, narrows the scope to companies that generate 50% or more of their revenue from buying or selling personal information, and fixes the operational issues (e.g., the short opt-out period for a request to stop selling/sharing, and the three-year retention requirement).
All of this comes down to three men – Senate President Wilton Simpson, House Speaker Chris Sprowls, and Governor DeSantis – and where they stand on the private right of action and the bill’s scope. My sense is we may see Governor DeSantis as the deciding vote, and in an election year he’d like to be able to split the baby – tell people that he signed and spearheaded a law that gives Floridians control over their data; limit the bill’s scope to companies that truly profit from buying and selling personal information; and, remove any private right of action that will inevitably be abused against companies of all sizes. But my guess on the politics is as good as anyone else’s.
