In my last post, I wrote about my impression that legislators and staff do not intend for HB 9 to apply to companies that merely “receive” personal information (i.e., those that do not engage in buying or selling personal information). Based on that understanding, I suggested the second threshold of the bill’s scope be amended as follows: “Annually buys, receives, sells, or shares the personal information of 50,000 of more consumers, households, and devices for the purpose of targeted advertising in conjunction with third parties or for a purpose that is not listed under subsection (1).” (You’ll recall that the other two threshold requirements under HB 9 are global annual gross revenue of more than $50 million, and at least 50% of global annual revenue from selling or sharing personal information about consumers.)
I now realize that I missed an important additional change to the definition of “share” that would need to be made in conjunction with the above changes. The bill defines “share” as “to share, rent, release, disclose, disseminate, make available, transfer, or access a consumer’s personal information for advertising or marketing.” Which of those words is not like the other? Access. Access is a passive activity that does not require the provision of personal information to another entity.
Why is this change important? Because the removal of “receives” is based on the proposition that companies that merely receive personal information, but do not buy or sell it, should not fall within the bill’s scope. But if the definition of share includes “access” then companies that merely receive (i.e., access) personal information without buying/selling the information would still be within the bill’s scope.
In short, the bill should also remove the term “access” from definition of share if it is to truly be limited to companies that buy and sell personal information for targeted advertising purposes.
What’s Next for HB 9 and SB 1864?
HB 9 is expected to be heard by the House Judiciary Committee on Wednesday.
The Senate, however, is far more concerned about the $300,000 to $750,000 annual “tax” (in the form of compliance costs) and the potential abuse from a private right of action with statutory damages that a bill like HB 9 will impose on companies doing business in Florida. If HB 9 were to pass, Florida would become the first state in the country to create a private right of action for violation of privacy provisions like right of access, deletion, correction, and opt-in consent. None of these developments are consistent with the state’s attempt to brand itself as business-friendly. In contrast, just north of the border, Georgia has introduced its own privacy bill that would be limited to companies that generate at least 50% of their revenue from selling/buying personal information.
This promises to be an interesting week ahead.
One Last Consideration As We Enter The Final Stretch
I have wondered whether lawmakers have contemplated the impact of HB 9 on their own campaigns. Political campaigning and the research that goes into creating strategy and identifying voters have become extremely sophisticated, as we saw from the Cambridge Analytica issue. To be sure, some of the collected information is public or deidentified/aggregated (and therefore exempt) but much of the information that goes into profiling and research is not. Additionally, political committees/entities are not typically considered “not for profit” entities that would be exempt from the definition of a controller. Nor is much of the information collected directly from the Florida resident.
If political candidates and their campaign committees become controllers (or third parties) under the law, one could see how HB 9 could create problems for legislative and executive branch candidates who will need to devote scarce resources to build compliance programs and potentially defend lawsuits from their opponents supporters that use the private right of action with statutory damages and attorney’s fees to spend money on litigation and create negative publicity.
