The Florida privacy legislation appears to be dead, and the best way to explain it is with the southern adage that “pigs get fat, hogs get slaughtered.” With a strong privacy bill in hand that gave privacy advocates 95% of everything they wanted and approved by the Senate, the House decided it wanted more. It really wanted its private right of action.
Realizing that wasn’t going to happen, the House decided it was better to do nothing than pass a comprehensive privacy law enforced only by the Florida Attorney General. As a result, Florida privacy legislation is dead for 2021.
There will be a lot of Monday-morning-quarterbacking by privacy advocates who pushed too hard and ultimately came away with nothing. Would it have been smarter to start with AG enforcement, then add a private right of action later after a year or two showing that AG enforcement does not meet the mark? All along, was it only important to the House and privacy advocates that the bill provide a private right to sue? Was this bill always just a tool of the plaintiffs’ bar to generate a ton of new revenue through class action lawsuits, and having lost the most important part of that tool, they walked away? How else do we explain the House’s refusal to take up the Senate version that had 95% of the rest of the House version and in some ways was stronger? None of that seems good for Floridians, businesses, or the development of privacy law.
Stepping back, I still believe the blueprint for privacy laws in Red states has been shaped by this process — strong consumer rights accompanied by significant compliance obligations, lots of exceptions/exemptions (initially), but no private right of action. We will see what impact Florida’s legislative roller coaster has on other states and Congress. But for now, I get to enjoy not having to prepare a bunch of webinar slides this weekend on what the new Florida privacy law means to in-house counsel!
