Regulatory Reform Subcommittee, Florida House of Representatives (2021-03-10)
Summary
A meeting packet for the Florida House Regulatory Reform Subcommittee containing HB 969 and HB 971 of the 2021 session. HB 969, a consumer data privacy bill, defines terms such as aggregate consumer information, biometric information and business purpose. It would cover businesses that collect consumers' personal information and either have global annual gross revenues above $25 million, handle the personal information of 50,000 or more consumers, households or devices, or derive 50 percent or more of revenue from selling or sharing it. HB 971 would create a public records exemption for proprietary information, such as trade secrets, submitted under the privacy law, and would take effect with HB 969.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Regulatory Reform Subcommittee, Florida House of Representatives (2021-03-10).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2021-03-10-3101-regulatory-reform-subcommittee-meeting-packets-fn-rrs-a5fd33d8e9/
, SHA-256 1989bdd50ecba81244b52a2fa61f6b65c9741d712863e17c23f59ecf5bc97dc7.Full text
Text recognized from a scanned document; may contain errors.
FLORIDA HOUSE O F REP RES EN TATIUIVE§
HB 969 2021
101 (a) "Aggregate consumer information" means information
102] that relates to a group or category of consumers, from which the
103} identity of an individual consumer has been removed and is not
104] reasonably capable of being directly or indirectly associated or
105} linked with, any consumer or household, including via a device.
106 The term does not include one or more individual consumer
107 records that have been deidentified.
108 (bo) “Biometric information" means an individual's
109] physiological, biological, or behavioral characteristics,
110 including an individual's deoxyribonucleic acid (DNA), that can
111} be used, singly or in combination with each other or with other
112] identifying data, to establish individual identity. The term
113 includes, but is not limited to, imagery of the iris, retina,
114} fingerprint, face, hand, palm, vein patterns, and voice
115] recordings, from which an identifier template, such as a
116} faceprint, a minutiae template, or a voiceprint, can be
117 extracted, and keystroke patterns or rhythms ait patterns or
FLORIODA H O US E O F REP RES EN TATIV ES
HB 969 2021
126 b. Does business in this state;
127 c. Collects personal information about consumers, or is
128] the entity on behalf of which such information is collected;
129 d. Determines the purposes and means of processing
130] personal information about consumers alone or jointly with
L3t others; and
132 e. Satisfies one or more of the following thresholds:
133 (I) Has global annual gross revenues in excess of $25
134] million, as adjusted in January of every odd-numbered year to
135] reflect any increase in the Consumer Price Index.
136 (II) Annually buys, receives for the business's commercial
137] purposes, sells, or shares for commercial purposes, the personal
138 information of 50,000 or more consumers, households, or devices.
139 (III) Derives 50 percent or more of its global annual
140} revenues from selling or sharing personal information about
141 consumers.
142 2. Any entity that controls or is controlled by a business
143) and that shares common branding with the business. As used in
144) this subparagraph, the term:
145 a. "Control" means:
146 (I) Ownership of, or the power to vote, more than 50
147| percent of the outstanding shares of any class of voting
148] security of a business;
149 (II) Control in any manner over the election of a majority
150} of the directors, or of individuals exercising similar
Page 6 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H O US E O F REP RES EN TAT IVES
HB 969 2021
151 functions; or
152 (III) The power to exercise a controlling influence over
153] the management of a company.
154 b. "Common branding" means a shared name, servicemark, or
L55 trademark.
156 (d) "Business purpose" means the use of personal
157} information for the operational purpose of a business or service
158] provider, or other notified purposes, provided that the use of
159] personal information is reasonably necessary and proportionate
160| to achieve the operational purpose for which the personal
161} information was collected or processed or for another
162| operational purpose that is compatible with the context in which
163] the personal information was collected. The term includes:
164 1. Auditing relating to a_ current interaction with a
165] consumer and concurrent transactions, including, but not limited
166] to, counting ad impressions to unique visitors, verifying
167} positioning and quality of ad impressions, and auditing
168} compliance with this specification and other standards.
169 2. Detecting security incidents; protecting against
170} malicious, deceptive, fraudulent, or illegal activity; and
171] prosecuting those responsible for that activity.
172 3. Debugging to identify and repair errors that impair
173] existing intended functionality.
174 4. Short-term, transient use, provided that the personal
175] information is not disclosed to another third party and is not
Page 7 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FtLORIODA H O US E O F REP RES EN TAT IV ES
HB 969 2021
176) used to build a profile about a consumer or otherwise alter an
177 individual consumer's experience outside the current
178 interaction, including, but not limited to, the contextual
179} customization of ads shown as part of the same interaction.
180 5. Performing services on behalf of the business or
181] service provider, including maintaining or servicing accounts,
182] providing customer service, processing or fulfilling orders and
183} transactions, verifying customer information, processing
184] payments, providing financing, providing analytic services, or
185|} providing similar services on behalf of the business or service
186] provider.
187 6. Undertaking internal research for technological
188} development and demonstration.
189 7. Undertaking activities to verify or maintain the
190} quality or safety of a service or device that is owned,
191 manufactured, manufactured for, or controlled by the business,
192] and to improve, upgrade, or enhance the service or device that
193 is owned, manufactured, manufactured for, or controlled by the
194 business.
195 (e) "Collect" means to buy, rent, gather, obtain, receive,
196} or access any personal information pertaining to a consumer by
197 any tieans. The term includes, but is mot limited to, actively’ or
198) passively receiving information from the consumer or by
199| observing the consumer's behavior.
200 (f£) "Commercial purposes" means to advance the commercial
Page 8 of 37
CODING: Words sticker are deletions; words underlined are additions.
hb0969-00
FtLORIODA HOU S E O F REP RES EN TATIVE §S
HB 969 2021
201] or economic interests of a person, such as inducing another
202 person to buy, rent, lease, join, subscribe to, provide, or
203] exchange products, goods, property, information, or services, or
204] directly or indirectly enabling or effecting a commercial
205 transaction.
206 (gq) "Consumer" means a natural person who resides in or is
207} domiciled in this state, however identified, including by any
208] unique identifier, and who is:
209 1. In this state for other than a temporary or transitory
210} purpose; or
211 2. Domiciled in this state but resides outside this state
212) for a temporary or transitory purpose.
213 (h) "Deidentified" means information that does not
214] reasonably identify, relate to, or describe a particular
215] consumer, or is not reasonably capable of being directly or
216] indirectly associated or linked with a particular consumer,
217) provided that a business that uses deidentified information:
218 1. Implements technical safeguards that prohibit
219| reidentification of the consumer to whom the information may
220} pertain.
221 2. Implements business processes that specifically
222| prohibit reidentification of the information.
223 3. Implements business processes to prevent inadvertent
224 release of deidentified information.
225 4. Does not attempt to reidentify the information.
Page 9 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIDA H OU S E O F REP RES EN TAT IV ES
HB 969 2021
226 (i) "Department" means the Department of Legal Affairs.
227 (j) “Health insurance information" means a consumer's
228 insurance policy number or subscriber identification number, or
229) any unique identifier used by a health insurer to identify the
230} consumer, or any information in the consumer's application and
231} claims history, including any appeals records, if the
232] information is reasonably capable of being directly or
233| indirectly associated or linked with a consumer or household,
234} including via a device, by a business or service provider.
235 (k) "Homepage" means the introductory page of an Internet
236| website and any Internet webpage where personal information is
237} collected. In the case of a mobile application, the homepage is
238|} the application's platform page or download page, a link within
239} the application, such as the "About" or "Information"
240| application configurations, or settings page, and any other
241 location that allows consumers to review the notice required by
242 subsection (9), including, but not limited to, before
243] downloading the application.
244 (1) "Person" means an individual, proprietorship, firm,
245} partnership, joint venture, syndicate, business trust, company,
246| corporation, limited liability company, association, committee,
247} and any other organization or group of persons acting in
248 concert.
249 (m) "Personal information" means information that
250 identifies, relates to, or describes a particular consumer or
Page 10 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HO US E O F REP RES EN TATIV ES
HB 969 2021
251} household, or is reasonably capable of being directly or
252 indirectly associated or linked with, a particular consumer or
253 household.
254 1. The term includes, but is not limited to, the
255 following:
256 a. Identifiers such as a real name, alias, postal address,
257) unique identifier, online identifier, internet protocol address,
258 email address, account name, social security number, driver
259} license number, passport number, or other similar identifiers.
260 b. Information that identifies, relates to, or describes,
261 or could be associated with, a particular individual, including,
262} but not limited to, a name, signature, social security number,
263 physical characteristics or description, address, telephone
264| number, passport number, driver license or state identification
265 card number, insurance policy number, education, employment,
266} employment history, bank account number, credit card number,
267 debit card number, or any other financial information, medical
268 information, or health insurance information.
269 c. Characteristics of protected classifications under
270 state or federal law.
271 d. Commercial information, including records of personal
2712 property, products or services purchased, obtained, or
273|/ considered, or other purchasing or consuming histories or
274 tendencies.
275 e. Biometric information.
Page 11 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FtORIODA HO US E O F REPRESENTATIVES
HB 969 2021
276 f. Internet or other electronic network activity
Z2ij information, including, but not limited to, browsing history,
278| search history, and information regarding a consumer's
279] interaction with an Internet website, application, or
280 advertisement.
281 g. Geolocation data.
282 h. Audio, electronic, visual, thermal, olfactory, or
283 similar information.
284 i. Professional or employment-related information.
285 j. Education information that is not publicly available,
286| personally identifiable information as defined in the Family
287| Educational Rights and Privacy Act, 20 U.S.C. s. 1232(g) and 34
288] C.F.R. part 99.
289 k. Inferences drawn from any of the information identified
290] in this paragraph to create a profile about a consumer
291 reflecting the consumer's preferences, characteristics,
292| psychological trends, predispositions, behavior, attitudes,
293| intelligence, abilities, and aptitudes.
294 2. The term does not include consumer information that is:
295 a. Publicly and lawfully made available from federal,
296] state, or local government records.
297 b. Deidentified or aggregate consumer information.
298 (n) "Probabilistic identifier" means the identification of
299) a consumer or a device to a degree of certainty of more probable
300] than not based on any categories of personal information
Page 12 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HOUSE O F REP RES EN TATIV ES
HB 969 2021
301 included in, or similar to, the categories listed under
302| paragraph (m).
303 (o) "Processing" means any operation or set of operations
304 that are performed on personal data or on sets of personal data,
305) whether or not by automated means.
306 (p) "Pseudonymize" means the processing of personal
307 information in a manner that renders the personal information no
308 longer attributable to a specific consumer without the use of
309} additional information, provided that the additional information
310} is kept separately and is subject to technical and
311] organizational measures to ensure that the personal information
312 is not attributed to an identified or identifiable consumer.
313 (q) "Research" means scientific, systematic study and
314 observation, including, but not limited to, basic research or
315 applied research that is in the public interest and that adheres
316} to all other applicable ethics and privacy laws or studies
317) conducted in the public interest in the area of public health.
318] Research with personal information that may have been collected
¢ a consu in e course o e consumer's interactions
319 from mer th — th ! t ie
320} with a business's service or device for other purposes must be:
321 1. Compatible with the business purpose for which the
322| personal information was collected.
323 2. Subsequently pseudonymized and deidentified, or
324| deidentified and in the aggregate, such that the information
325} does not reasonably identify, relate to, or describe, or is not
Page 13 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HO US E O F REP RES EN TAT IV ES
HB 969 2021
326| capable of being directly or indirectly associated or linked
327 with, a particular consumer.
328 3. Made subject to technical safeguards that prohibit
329| reidentification of the consumer to whom the information may
330} pertain.
331 4. Subject to business processes that specifically
332) prohibit reidentification of the information.
333 5. Made subject to business processes to prevent
334 inadvertent release of deidentified information.
335 6. Protected from any reidentification attempts.
336 7. Used solely for research purposes that are compatible
337] with the context in which the personal information was collected
338 and not used for any commercial purpose.
339 8. Subjected by the business conducting the research to
340) additional security controls that limit access to the research
341] data to only those individuals in a business necessary to carry
342 out the research purpose.
343 (x) "Sell" means to sell, rent, release, disclose,
344 disseminate, make available, transfer, or otherwise communicate
345) orally, in writing, or by electronic or other means, a
346] consumer's personal information by a business to another
347| business or a third party for monetary or other valuable
348 consideration.
349 (s) "Service" means work or labor furnished in connection
350} with the sale or repair of goods.
Page 14 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H OU S E O F REP RES EN TATIV ES
HB 969 2021
351 (t) "Service provider" means a sole proprietorship,
352] partnership, limited liability company, corporation,
353] association, or other legal entity that is organized or operated
354| for the profit or financial benefit of its shareholders or other
355| owners, that processes information on behalf of a business and
356} to which the business discloses a consumer's personal
357| information for a business purpose pursuant to a written
358] contract, provided that the contract prohibits the entity
359] receiving the information from retaining, using, or disclosing
360} the personal information for any purpose other than for the
361] specific purpose of performing the services specified in the
362 contract for the business, or as otherwise permitted by this
363] section, including retaining, using, or disclosing the personal
364] information for a commercial purpose other than providing the
365] services specified in the contract with the business.
366 (u) "Share" means to share, rent, release, disclose,
367 disseminate, make available, transfer, or access a consumer's
368] personal information for advertising. The term includes:
369 1. Allowing a third party to use or advertise to a
370] consumer based on a consumer's personal information without
371] disclosure of the personal information to the third party.
372 2. Monetary transactions, nonmonetary transactions, and
373 transactions for other valuable consideration between a business
374 and a third party for advertising for the benefit of a business.
375 {(v) "Third party" means a person who is not any of the
Page 15 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIDA H OU S E O F REP RES EN TATIV ES
HB 969 2021
376 following:
S77 1. A business that collects personal information from
378 consumers under this section.
379 2. A person to whom the business discloses personal
380] information about consumers for a business purpose pursuant to a
381 written contract.
382 (w) “Unique identifier" means a persistent identifier that
383| can be used to recognize a consumer, a family, or a device that
384| is linked to a consumer or family, over time and across
385| different services, including, but not limited to, a device
386 identifier; an Internet Protocol address; cookies, beacons,
387| pixel tags, mobile ad identifiers, or similar technology;
388] customer number, unique pseudonym, or user alias; telephone
389] numbers, or other forms of persistent or probabilistic
390} identifiers which can be used to identify a particular consumer
391] or device. As used in this paragraph, the term "family" means a
392] custodial parent or guardian and any minor children of whom the
393] parent or guardian has custody, or a household.
394 (x) "Verifiable consumer request" means a request that is
395} made by a consumer, by a consumer on behalf of the consumer's
396] minor child, or by a natural person or a person authorized by
397 the consumer to act on the consumer's behalf, and that the
398| business can reasonably verify pursuant to rules adopted by the
399} department to be the consumer about whom the business has
400} collected personal information. A business is not obligated to
Page 16 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FtLORI ODA HOU S E O F R EP RES EN TATHIV E S$
HB 969 2021
401] provide information to the consumer if the business cannot
402] verify that the consumer making the request is the consumer
403] about whom the business has collected information or is a person
404 authorized by the consumer to act on the consumer's behalf.
405 (2) PRIVACY POLICY FOR PERSONAL INFORMATION.—
406 (a) A business that collects personal information about
407 consumers shall maintain an online privacy policy, make such
408] policy available on its Internet website, and update the
409 information at least once every 12 months. The online privacy
410] policy must include the following information:
411 1. Any Florida-specific consumer privacy rights.
412 2. A list of the categories of personal information the
413] business collects or has collected about consumers.
414 3. Of the categories identified in subparagraph 2., a list
415} that identifies which categories of personal information the
416 business sells or shares or has sold or shared about consumers.
417 If the business does not sell or share personal information, the
418 business shall disclose that fact.
419 4. Of the categories identified in subparagraph 2., a list
420| that identifies which categories of personal information the
421 business discloses or shares or has disclosed or shared about
422 consumers for a business purpose. If the business does not
423| disclose or share personal information for a business purpose,
424 the business shall disclose that fact.
425 o. The right to opt-out of the sale or sharing to third
Page 17 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HO US E O F REP RES EN TA TI V ES
HB 969 2021
426), Parties and the ability to request deletion or correction of
427 certain personal information.
428 {b) A consumer has the right to request that a business
429) that collects personal information disclose to the consumer the
430] categories and specific pieces of personal information the
431 business collects from or about consumers.
432 (c) A business that collects personal information shall,
433] at or before the point of collection, inform consumers of the
434 categories of personal information to be collected and the
435| purposes for which the categories of personal information will
436 be used.
437 (d) A business may not collect additional categories of
438] personal information or use personal information collected for
439| additional purposes without providing the consumer with notice
440 consistent with this section.
441 (e) A business shall provide the information specified in
442) paragraph (b) to a consumer only upon receipt of a verifiable
443 consumer request.
444 (f) A business shall provide and follow a retention
445} schedule that prohibits the use and retention of personal
446| information after satisfaction of the initial purpose for
447| collecting or obtaining such information, or after the duration
448) of a contract, or 1 year after the consumer's last interaction
449} with the business, whichever occurs first. This paragraph does
450] not apply to biometric information used for ticketing purposes
Page 18 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLO RI ODA HO US E O F REP RES ENTAT IVE §S
HB 969 2021
451} and does not apply if such information is only kept for the time
452 related to the duration of the ticketed event.
453 (3) CONSUMER RIGHT TO REQUEST COPY OF PERSONAL DATA
454 COLLECTED .—
455 (a) A consumer has the right to request that a business
456] that collects personal information about the consumer disclose
457 the personal information that has been collected by the
458 business.
459 (bob) A business that receives a verifiable consumer request
460] from a consumer to access personal information shall promptly
461 take steps to disclose and deliver, free of charge to the
462 consumer, the personal information required by this section. The
463} information may be delivered by mail or electronically, and if
464} provided electronically, the information must be in a portable
465 and, to the extent technically feasible, readily useable format
466 that allows the consumer to transmit this information to another
467| entity without hindrance. A business may provide personal
468 information to a consumer at any time, but may not be required
469| to provide personal information to a consumer more than twice in
470} a 12-month period.
471 (c) A business shall disclose the following to the
472| consumer:
473] 1. The specific pieces of personal information it has
474 collected about the consumer.
475 2. The categories and sources from which it collected the
Page 19 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HOUSE O F REP RES EN TAT IV ES
HB 969 2021
476| consumer's personal information.
477 3. The business or commercial purpose for collecting or
478| selling the consumer's personal information.
479 4, The categories of third parties which the business
480] shares the consumer's personal information.
481 (d) A business that collects personal information about a
482] consumer shall disclose the information specified in paragraph
483 (a) to the consumer upon receipt of a verifiable consumer
484 request from the consumer.
485 (e) This subsection does not require a business to do the
486 following:
487 1. Retain any personal information about a consumer
488] collected for a single one-time transaction if, in the ordinary
489| course of business, that information about the consumer is not
490] retained.
491 2, Reidentify or otherwise link any data that, in the
492 ordinary course of business, is not maintained in a manner that
493] would be considered personal information.
494 (4) RIGHT TO HAVE PERSONAL INFORMATION DELETED OR
495 CORRECTED .—
496 (a) A consumer has the right to request that a business
497| delete any personal information about the consumer which the
498
business has collected from the consumer.
499 (bob) A business that receives a verifiable consumer request
500 from_a consumer to delete the consumer's personal information
Page 20 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H OU S E O F R EP RES EN TAT IVE 8S
HB 969 2021
501} shall delete the consumer's personal information from its
502] records and direct any service providers to delete the
503} consumer's personal information from their records.
504 {c) A business or a service provider may not be required
505] to comply with a consumer's request to delete the consumer's
506] personal information if it is necessary for the business or
507} service provider to maintain the consumer's personal information
508} to do any of the following:
509 1. Complete the transaction for which the personal
510] information was collected.
511 2. Fulfill the terms of a_written warranty or product
512 recall conducted in accordance with federal law.
513 3. Provide a good or service requested by the consumer, or
514) reasonably anticipated within the context of a business' ongoing
515} business relationship with the consumer, or otherwise perform a
516| contract between the business and the consumer.
517 4. Detect security incidents, protect against malicious,
918] deceptive, fraudulent, or illegal activity; or prosecute those
519] responsible for that activity.
520 5. Debug to identify and repair errors that impair
521] existing intended functionality.
o22 6. Engage in public or peer-reviewed scientific,
523 historical, or statistical research in the public interest that
524] adheres to all other applicable ethics and privacy laws when the
525] business' deletion of the information is likely to render
Page 21 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H O US E O F REP RES EN TAT IVE S
HB 969 2021
526} impossible or seriously impair the achievement of such research,
527| if the consumer has provided informed consent.
528 7. Enable solely internal uses that are reasonably aligned
529] with the expectations of the consumer based on the consumer's
530} relationship with the business.
53:1 8. Comply with a legal obligation.
532 9. Otherwise internally use the consumer's personal
533] information in a lawful manner that is compatible with the
534] context in which the consumer provided the information.
535 (d) A consumer has the right to request a business that
536| maintains inaccurate personal information about the consumer to
537) correct the inaccurate personal information, taking into account
538] the nature of the personal information and the purposes of the
539] processing of the personal information. A business that receives
540} a verifiable consumer request to correct inaccurate personal
541 information shall use commercially reasonable efforts to correct
542| the inaccurate personal information as directed by the consumer.
543 (5) RIGHT TO REQUEST PERSONAL DATA SOLD OR SHARED.—
544 (a) A consumer has the right to request that a business
545| that sells or shares personal information about the consumer, or
546] discloses such information for a business purpose, to disclose
547 to the consumer:
548 1. The categories of personal information about the
549 consumer the business sold or shared.
550 2. The categories of third parties to which the personal
Page 22 of 37
CODING: Words sticker are deletions; words underlined are additions.
hb0969-00
FLORIODA HO US E O F REP RES EN TATIV ES
HB 969 2021
551 information about the consumer was sold or shared by category of
552] personal information for each category of third parties to which
553} the personal information was sold or shared.
554 3. The categories of personal information about the
555] consumer that the business disclosed for a business purpose.
556 (b) A business that sells or shares personal information
557 about consumers or discloses such information for a business
558] purpose shall disclose the information specified in paragraph
509 (a) to the consumer upon receipt of a verifiable consumer
560} request from the consumer.
561 (c) A third party may not sell or share personal
562 information about a consumer that has been sold or shared to the
563] third party by a business unless the consumer has received
564] explicit notice and is provided an opportunity to opt-out.
565 (6) RIGHT TO OPT-OUT OF THE SALE OR SHARING OF PERSONAL
566 INFORMATION TO THIRD PARTIES.—
567 (a) A consumer has the right at any time to direct a
568| business that sells or shares personal information about the
569] consumer to third parties to not sell or share the consumer's
570} personal information. This right may be referred to as the right
571] to opt-out.
512 (o) A business that sells or shares personal information
573] to third parties shall provide notice to consumers that this
574 information may be sold and shared and that consumers have the
575| right to opt-out of the sale or sharing of their personal
Page 23 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIDA H O US E O F R EP RES EN TAT IVE 8S
HB 969 2021
576 information.
ST] (c) Notwithstanding paragraph (a), a business may not sell
578 or share the personal information of a consumer if the business
579) has actual knowledge that the consumer is not 16 years of age or
580 older, unless the consumer, in the case of consumers between 13
581 and 15 years of age, or the consumer's parent or guardian, in
582 the case of consumers who are 12 years of age or younger, has
583] affirmatively authorized the sale or sharing of the consumer's
584) personal information. A business that willfully disregards the
585} consumer's age is deemed to have had actual knowledge of the
5986] consumer's age. This right may be referred to as the right to
588 (d) A business that has received direction from _a_ consumer
589| prohibiting the sale or sharing of the consumer's personal
590} information or that has not received consent to sell or share a
591] minor consumer's personal information is prohibited from selling
592] or sharing the consumer's personal information after its receipt
593 of the consumer's direction, unless the consumer subsequently
594] provides express authorization for the sale or sharing of the
595 consumer's personal information.
596 (e) A business does not sell personal information when:
597 1. A consumer uses or directs the business to
598 intentionally disclose personal information or uses the business
599} to intentionally interact with a third party, provided the third
600} party does not also sell the personal information, unless that
Page 24 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORtItODA H O U S E O F REP RES EN TATIV ES
HB 969 2021
601} disclosure would be consistent with the provisions of this
602 section. An intentional interaction occurs when the consumer
603); intends to interact with the third party, via one or more
604] deliberate interactions. Hovering over, muting, pausing, or
605} closing a given piece of content does not constitute a
606| consumer's intent to interact with a third party.
607 2. The business uses or shares an identifier fora
608] consumer who has opted out of the sale or sharing of the
609] consumer's personal information for the purposes of alerting
610} third parties that the consumer has opted out of the sale or
611 sharing of the consumer's personal information.
612 3. The business uses or shares with a service provider
613] personal information of a consumer that is necessary to perform
614| a business purpose if both of the following conditions are met:
615 a. The business has provided notice that the personal
616} information of the consumer is being used or shared in its terms
617 and conditions consistent with subsection (9).
618 b. The service provider does not further collect, sell,
619| share, or use the personal information of the consumer except as
620} necessary to perform the business purpose.
621 4. The business transfers to a third party the personal
622 information of a consumer as an asset that is part of a merger,
623} acquisition, bankruptcy, or other transaction in which the third
624) party assumes control of all or part of the business, provided
625| that information is used or shared consistently with subsections
Page 25 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIO A H O US E O F R EP RES EN TAT IVE S&S
HB 969 2021
626 (3) and (5). If a third party materially alters how it uses or
627 shares the personal information of a consumer in a manner that
628| is materially inconsistent with the promises made at the time of
629) collection, it shall provide prior notice of the new or changed
630} practice to the consumer. The notice must be sufficiently
631} prominent and robust to ensure that existing consumers can
632| easily exercise their choices consistently with this subsection.
633 (f£) A business does not share personal information when:
634 1. A consumer uses or directs the business to
635] intentionally disclose personal information or intentionally
636] interact with one or more third parties.
637 2. The business uses or shares an identifier for a
638} consumer who has opted-out of sharing the consumer's personal
639) information for the purposes of alerting persons that the
640| consumer has opted-out of sharing the consumer's personal
641 information.
642 (7) DISCRIMINATION AGAINST CONSUMERS WHO EXERCISE THEIR
643] RIGHTS.—
644 (a)1l. A business may not discriminate against a consumer
645) who exercised any of the consumer's rights under this section.
646| Discrimination under this subparagraph includes, but is not
647 limited to:
648 a. Denying goods or services to the consumer.
649 b. Charging different prices or rates for goods or
650} services, including through the use of discounts or other
Page 26 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLO RIODA H OU S E O F REPRESENTATIVE §S
HB 969 2021
651| benefits or imposing penalties.
652 c. Providing a different level or quality of goods or
653 services to the consumer.
654 d. Suggesting that the consumer will receive a different
655} price or rate for goods or services or a different level or
656| quality of goods or services.
657 2. This paragraph does not prohibit a business from
658] charging a consumer a different price or rate, or from providing
659] a different level or quality of goods or services to the
660 consumer, if that difference is reasonably related to the value
661| provided to the business by the consumer's data,
662 (b)1. A business may offer financial incentives, including
663} payments to consumers as compensation, for the collection, sale,
664} or deletion of personal information.
665 2. A business may offer a different price, rate, level, or
666] quality of goods or services to the consumer if the price or
667| difference is directly related to the value provided to the
668} business by the consumer's personal information.
669 3. A business that offers any financial incentives shall
670} notify consumers of the financial incentives.
671 4. A business may enter a consumer into a financial
672) incentive program only if the consumer gives the business prior
673 consent that clearly describes the material terms of the
674 financial incentive program. The consent may be revoked by the
675| consumer at any time.
Page 27 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLoORIODA H O US E O F REP RES EN TA TIVES
HB 969 2021
676 5. A business may not use financial incentive practices
677 that are unjust, unreasonable, coercive, or usurious in nature.
678 (8) REQUESTS FOR PERSONAL INFORMATION.—
679 (a) To comply with this subsection, a business shall, ina
680| form that is reasonably accessible to consumers, make available
681] two or more methods for submitting verifiable consumer reguests,
682] including, but not limited to, a toll-free number and, if the
683] business maintains an Internet website, a link on the homepage
684| of the website. The business may not require the consumer to
685 create an account with the business in order to make a
686] verifiable consumer request.
687 (bo) The business shall deliver the information required or
688| act on the request in subsections (3) through (6) to a consumer
689| free of charge within 45 days after receiving a verifiable
690} consumer request. The response period may be extended once by 30
691) additional days when reasonably necessary, taking into account
692] the complexity of the consumer's requests, provided the business
693} informs the consumer of any such extension within the initial
694 45-day response period along with the reason for the extension.
695] The information must be delivered in a readily usable format
696 that allows the consumer to transmit the information from one
697) entity to another entity without hindrance.
698 (c) If a third party assumes control of all or part of a
699| business and acquires a consumer's personal information as part
700} of the transfer, and the third party materially alters how it
Page 28 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIDA H OU S E O F R EP RES EN TAT IVE §S
HB 969 2021
701| uses a consumer's personal information or shares the information
702) ain a manner that is materially inconsistent with the promises
703) made at the time of collection, the third party must provide
704] prior notice of the new or changed practice to the customer. The
705] notice must be sufficiently prominent and robust to ensure that
706| existing consumers can easily exercise their choices.
707 (d) Any contract between a business and a service provider
708| must prohibit the service provider from:
709 1. Selling or sharing the personal information;
710 2. Retaining, using, or disclosing the personal
711 information for any purpose other than for the business purposes
712) specified in the contract for the business, including retaining,
713] using, or disclosing the personal information for a commercial
714] purpose other than the business purposes specified in the
715 contract with the business;
716 3. Retaining, using, or disclosing the information outside
717!) of the direct business relationship between the service provider
718 and the business; or
TLS 4. Combining the personal information that the service
720} provider receives from or on behalf of the business with
721| personal information that it receives from or on behalf of
722| another person or entity or that the service provider collects
723 from its own interaction with the consumer, provided that the
724) service provider may combine personal information to perform any
725| business purpose.
Page 29 of 37
CODING: Words sticker are deletions; words underlined are additions.
hb0969-00
FLORIODA HO US E O F R EP RES EN TAT IVE S$
HB 969 2021
726 (e) Any contract between a business and a third party must
f27| prohibit the third party that receives «4 consumer's personal
728| information from the following:
429 1. Selling or sharing the personal information.
730 2. Retaining, using, or disclosing the personal
731| information for any purpose other than the specific purpose of
732| performing the services specified in the contract, including
733| retaining, using, or disclosing the personal information for a
734| commercial purpose other than providing the services specified
735 in the contract.
736 3. Retaining, using, or disclosing the personal
737| information for any purpose other than for the specific purpose
738| of performing the services specified in the contract, including
739| retaining, using, or disclosing the personal information for a
740} commercial purpose other than providing the services specified
741 in the contract.
742 4, Retaining, using, or disclosing the information outside
743| of the direct business relationship between the person and the
744 business.
745
746| The contract must include a certification made by the person or
747| entity receiving the personal information stating that the
748] person or entity understands and will comply with the
749! restrictions under this paragraph.
750 (f) Any contract between a business and a third party or
Page 30 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLOR IODA H O US E O F REP RES EN TAT IV E §S
HB 969 2021
751] between a business and a service provider for receiving personal
752| information must include a provision that any contract between a
753| third party and any subcontractor or between a service provider
754| and any subcontractor must require the subcontractor to meet the
755) obligations of the third party or service provider with respect
756| to personal information.
737 (g) A third party or service provider or any subcontractor
758] thereof who violates any of the restrictions imposed upon it
759| under this section is liable for any violations. A business that
760| discloses personal information to a third party or service
761] provider in compliance with this section is not liable if the
762! person receiving the personal information uses it in violation
763 of the restrictions under this section, provided that at the
764) time of disclosing the personal information, the business does
765} not have actual knowledge or reason to believe that the person
766 intends to commit such a violation.
767 (9) FORM TO OPT-OUT OF SALE OR SHARING OF PERSONAL
768 INFORMATION .—
769 (a) A business shall, in a form that is reasonably
770 accessible to consumers:
771 1. Provide a clear and _ conspicuous link on the business's
772 Internet homepage, entitled "Do Not Sell or Share My Personal
773) Information," to an Internet webpage that enables a consumer, or
774| a person authorized by the consumer, to opt-out of the sale or
775| sharing of the consumer's personal information. A business may
Page 31 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H O US E O F REP RES EN T ATIVE S
HB 969 2021
776| not require a consumer to create an account in order to direct
777 the business not to sell the consumer's personal information.
778 2. Include a_ description of a_consumer's rights along with
779| a separate link to the "Do Not Sell or Share My Personal
780) Information" Internet webpage in:
781 a. Its online privacy policy or policies.
782 b. Any Florida-specific consumer privacy rights.
7183 3. Ensure that all individuals responsible for handling
784| consumer inguiries about the business's privacy practices or the
785/ business's compliance with this section are informed of all
786| requirements in subsection (6) and this subsection and how to
787) direct consumers to exercise their rights subsection (6) and
788 this subsection.
789 4, For consumers who opt-out of the sale or sharing of
790! their personal information, refrain from selling or sharing
791| personal information collected by the business about the
792 consumer.
793 5. For consumers who opted-out of the sale or sharing of
794 their personal information, respect the consumer's decision to
795) opt-out for at least 12 months before requesting that the
796| consumer authorize the sale of the consumer's personal
797 information.
798 6. Use any personal information collected from the
799 consumer in connection with the submission of the consumer's
800} opt-out request solely for the purposes of complying with the
Page 32 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
HB 969 2021
801] opt-out request.
802 {o) This subsection does not require a business to include
803] the required links and text on the homepage that the business
804] makes available to the public generally, if the business
805} maintains a_ separate and additional homepage that is dedicated
806] to Florida consumers and that includes the required links and
807 text, and the business takes reasonable steps to ensure that
808| Florida consumers are directed to the homepage for Florida
809| consumers and not the homepage made available to the public
810} generally.
811 (c) A consumer may authorize another person to opt-out of
812] the sale or sharing of the consumer's personal information on
813] the consumer's behalf, and a business shall comply with an opt-
814] out request received from a person authorized by the consumer to
815) act on the consumer's behalf, pursuant to rules adopted by the
816] department.
818 (a) This section does not restrict any business' or third
819] party's ability to do any of the following:
820 1. Comply with federal, state, or local laws.
821 2. Comply with a civil, criminal, or regulatory inquiry,
822 investigation, subpoena, or summons by federal, state, or local
823 authorities.
824 3. Cooperate with law enforcement agencies concerning
825 conduct or activity that the business, service provider, or
Page 33 of 37
CODING: Words stricken are deletions; words underlined are additions,
hb0969-00
FLORIODA HOUSE O F R EP RES EN TATIVE §$
HB 969 2021
826] third party reasonably and in good faith believes may violate
827 federal, state, or local law.
828 4. Exercise legal rights or privileges.
829 5. Collect, use, retain, sell, or disclose deidentified
830] personal information or aggregate consumer information. If a
831] business uses deidentified information, the business shall:
832 a. Implement technical safeguards that prohibit
833) reidentification of the consumer to whom the information may
834 pertain;
835 b. Implement business processes that specifically prohibit
836 reidentification of the information;
837 c. Implement business processes to prevent inadvertent
838 release of deidentified information; and
839 dad. Not attempt to reidentify the information.
840 (b) This section does not apply to:
841 1. A business that collects or discloses its employees’
842] personal information, so long as the business is collecting or
843} disclosing such information within the scope of its role as an
844 employer.
845 2. Health information that is collected by a covered
846] entity or business associate governed by the privacy, security,
847 and breach notification rules issued by the United States
848] Department of Health and Human Services in 45 C.F.R. parts 160
849| and 164.
850 3. A covered entity governed by the privacy, security, and
Page 34 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA HOUSE O F REP RES EN TATIV ES
HB 969 2021
851] breach notification rules issues by the United States Department
852 of Health and Human Services in 45 C.F.R. parts 160 and 164, to
853] the extent the provider or covered entity maintains patient
854 information in the same manner as medical information or
855] protected health information as described in subparagraph 2.
856 4. Information collected as part of a clinical trial
857} subject to the Federal Policy for the Protection of Human
858] Subjects pursuant to good clinical practice guidelines issued by
859 the International Council for Harmonisation of Technical
860] Requirements for Pharmaceuticals for Human Use or pursuant to
861] human subject protection requirements of the United States Food
862| and Drug Administration.
863 5. Sale or sharing of personal information to or froma
864] consumer reporting agency if that information is to be reported
865] in or used to generate a consumer report as defined by 15 U.S.C.
866 s. 1681(a), and if use of that information is limited by the
867} federal Fair Credit Reporting Act, 15 U.S.C. s. 1681 et seq.
868 6. Personal information collected, processed, sold, or
869} disclosed pursuant to the Gramm-Leach-Bliley Act, 15 U.S.C. s.
870} 6801 et seq. and implementing regulations.
871 7. Personal information collected, processed, sold, or
872] disclosed pursuant to the federal Driver's Privacy Protection
873] Act of 1994, 18 U.S.C. s. 2721 et. seq.
874 8. Education information covered by the Family Educational
875} Rights and Privacy Act, 20 U.S.C. s. 1232(g) and 34 C.F.R. part
Page 35 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLO RIODA H O US E O F REP RES EN TAT IV E S
HB 969 2021
876] 99
877 9. Information collected as part of public or peer-
878 reviewed scientific or statistical research in the public
879] interest.
880 (11) CONTRACTS.—Any provision of a contract or agreement
881} of any kind that waives or limits in any way a consumer's rights
882} under this section, including, but not limited to, any right to
883] a remedy or means of enforcement, is deemed contrary to public
884] policy and is void and unenforceable. This section does not
885} prevent a consumer from declining to request information from a
886} business, declining to opt-out of a business's sale or sharing
887! of the consumer's personal information, or authorizing a
888} business to sell or share the consumer's personal information
889] after previously opting out. This subsection only applies to
890] contracts entered into after January 1, 2022.
891 (12) PRIVATE CAUSE OF ACTION.—A consumer whose
892 nonencrypted and nonredacted personal information or e-mail
893} address, in combination with a password or security question and
894 answer that would allow access to the account, is subject to an
895 unauthorized access and exfiltration, theft, or disclosure as a
896] result of a business' violation of the duty to implement and
897] maintain reasonable security procedures and practices
898) sppropriate to the mature of the information fo protect the
899| personal information may bring a civil action for any of the
900 following:
Page 36 of 37
CODING: Words stricken are deletions; words underlined are additions.
hb0969-00
FLORIODA H O U S E O F REP RES EN TAT IVE S
HB 969 2021
901 (a) Damages in an amount not less than $100 and not
902 greater than $750 per consumer per incident or actual damages,
903] whichever is greater.
904 (b) Injunctive or declaratory relief, as the court deems
905] proper.
906 (13) ENFORCEMENT AND IMPLEMENTATION .—
907 (a) If the department has reason to believe that any
908] business, service provider, or other person or entity is in
909} violation of this section and that proceedings would be in the
910| public interest, the department may bring an action against such
911] business, service provider, or other person or entity and may
912 seek a civil penalty of not more than $2,500 for each
913) unintentional violation or $7,500 for each intentional
914] violation. Such fines may be tripled if the violation involves a
O15 consumer who is 16 years of age or younger.
916 (b) The department may adopt rules to implement this
917 section.
918 (c) A business may be found to be in violation of this
919} section if it fails to cure any alleged violation within 30 days
920| after being notified in writing by the department of the alleged
921} noncompliance.
922 Section 3. This act shall take effect January 1, 2022.
Page 37 of 37
CODING: Words sticker are deletions; words underlined are additions.
hb0969-00
REGULATORY REFORM SUBCOMMITTEE
HB 969 by Rep. McFarland
Consumer Data Privacy
AMENDMENT SUMMARY
March 10, 2021
Amendment 1 by Rep. McFarland (line 375):
The amendment:
¢ Clarifies the definition of “third party,” and
¢ Clarifies the definition of “unique identifier” by including “linked to a consumer or family”
as used elsewhere in the bill.
Amendment 2 by Rep. McFarland (line 504):
The amendment:
e Allows consumers to self-correct information if the business provides a mechanism,
¢ Clarifies that business records may be retained for an existing legal dispute, and
e Provides that businesses and service providers are not required to delete personal
information under certain circumstances.
Amendment 3 by Rep. McFarland (line 597):
The amendment clarifies that certain intentional actions do not qualify as selling personal
information.
Amendment 4 by Rep. McFarland (line 687):
The amendment:
e Removes requirements that certain provisions be included in third party contracts,
e Removes two duplicate provisions, and
e Clarifies the time period for complying with a consumer request.
Amendment 5 by Rep. McFarland (line 840):
The amendment:
e Adds the words “business associate” to conform with language used in other parts of the
bill, and
e Adds applicants, interns, and volunteers to the list of types of employees that are
included under the employer exception.
Oo wa WD OO F W NY FH
10
11
13
14
16
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 1
COMMITTEE/SUBCOMMITTEER ACTION
ADOPTED __ (Y/N)
ADOPTED AS AMENDED __ (Y/N)
ADOPTED W/O OBJECTION —_— (Y/N)
FAILED TO ADOPT __ (Y/N)
WITHDRAWN __ (Y/N)
OTHER _
Committee/Subcommittee hearing bill: Regulatory Reform
Subcommittee
Representative McFarland offered the following:
Amendment
Remove lines 375-393 and insert:
(v) "Third party" means a person who is not any of the
p M4 per
following:
1. The business that collects personal information from
consumers under this section.
2. A service provider to whom the business discloses
personal information about consumers for a business purpose
pursuant to a written contract.
(w) "Unique identifier" means a persistent identifier that
can be used to recognize a consumer, a family, or a device that
is linked to a consumer or family, over time and across
589373 - h969-line375.docx
Published On: 3/9/2021 4:52:13 PM
Page 1 of 2
17
18
19
20
21
22
23
24
20
26
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. Il
different services, including, but not limited to, a device
identifier; an Internet Protocol address; cookies, beacons,
pixel tags, mobile ad identifiers, or similar technology;
customer number, unique pseudonym, or user alias; telephone
numbers, or other forms of persistent or probabilistic
identifiers that can be used to identify a particular consumer,
family, or device that is linked to a consumer or family. As
used in this paragraph, the term "family" means a custodial
parent or guardian and any minor children of whom the parent or
guardian has custody, or a household.
589373 - h969-line375.docx
Published On: 3/9/2021 4:52:13 PM
Page 2 of 2
Oo wat D OF FP W NY
10
11
12
13
14
16
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 2
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED _ (Y/N)
ADOPTED AS AMENDED __ (Y/N)
ADOPTED W/O OBJECTION __ (Y/N)
FAILED TO ADOPT __ (Y/N)
WITHDRAWN __ (Y/N)
OTHER
Committee/Subcommittee hearing bill: Regulatory Reform
Subcommittee
Representative McFarland offered the following:
Amendment
Remove lines 504-542 and insert:
(c) A business or a service provider acting pursuant to
its contract with the business or another service provider may
not be required to comply with a consumer's request to delete
the consumer's personal information if it is reasonably
necessary for the business or service provider to maintain the
consumer's personal information to do any of the following:
1. Complete the transaction for which the personal
information was collected.
2. Fulfill the terms of a written warranty or product
recall conducted in accordance with federal law.
658007 - h969-line504.docx
Published On: 3/9/2021 4:52:58 PM
Page 1 of 3
17
18
1%
20
22
23
24
26
26
27
28
29
30
32
33
34
35
36
37
38
39
40
41
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 2
3. Provide a good or service requested by the consumer, or
reasonably anticipated within the context of a business' ongoing
business relationship with the consumer, or otherwise perform a
contract between the business and the consumer.
4. Detect security incidents, protect against malicious,
deceptive, fraudulent, or illegal activity; or prosecute those
responsible for that activity.
5. Debug to identify and repair errors that impair
existing intended functionality.
6. Engage in public or peer-reviewed scientific,
historical, or statistical research in the public interest that
adheres to all other applicable ethics and privacy laws when the
business' deletion of the information is likely to render
impossible or seriously impair the achievement of such research,
if the consumer has provided informed consent.
7. Enable solely internal uses that are reasonably aligned
with the expectations of the consumer based on the consumer's
relationship with the business.
8. Comply with a legal obligation.
9. As reasonably needed to protect the business’s
interests against existing disputes, legal action, or
governmental investigations.
10. Otherwise internally use the consumer's personal
information in a lawful manner that is compatible with the
context in which the consumer provided the information.
658007 - h969-line504.docx
Published On: 3/9/2021 4:52:58 PM
Page 2 of 3
42
43
44
45
46
47
48
49
50
51
5.3
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 2
(d) A consumer has the right to make a request to correct
inaccurate personal information to a business that maintains
inaccurate personal information about the consumer, while taking
into account the nature of the personal information and the
purposes of the processing of the personal information. A
business that receives a verifiable consumer request to correct
inaccurate personal information shall use commercially
reasonable efforts to correct the inaccurate personal
information as directed by the consumer. If a business maintains
a_self-service mechanism to allow a consumer to correct certain
personal information, the business may require the consumer to
correct their own personal information through such mechanism.
658007 - h969-line504.docx
Published On: 3/9/2021 4:52:58 PM
Page 3 of 3
Oo A Dn oO F&F W DY FF
PoP P PR
So WN FP Oo wo
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 3
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED _ (Y/N)
ADOPTED AS AMENDED __ (Y/N)
ADOPTED W/O OBJECTION _ (Y/N)
FAILED TO ADOPT _ (Y/N)
WITHDRAWN _ (Y/N)
OTHER a
Committee/Subcommittee hearing bill: Regulatory Reform
Subcommittee
Representative McFarland offered the following:
Amendment
Remove lines 597-606 and insert:
1. A consumer uses or directs the business to
intentionally disclose personal information or uses the business
to intentionally interact with a third party. An intentional
interaction occurs when the consumer intends to interact with
the third party, via one or more deliberate interactions.
Hovering over, muting, pausing, or closing a given piece of
content does not constitute a consumer's intent to interact with
a third party.
578763 - h969-line597.docx
Published On: 3/9/2021 4:53:44 PM
Page 1 of 1
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 4
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED — (Y/N)
ADOPTED AS AMENDED _ (Y/N)
ADOPTED W/O OBJECTION _— (Y/N)
FAILED TO ADOPT oe (Y/N)
WITHDRAWN —_ (Y/N)
OTHER _
Committee/Subcommittee hearing bill: Regulatory Reform
Subcommittee
Representative McFarland offered the following:
Amendment
Remove lines 687-756 and insert:
(b) The business shall deliver the information required or
act on the request in subsections (3) through (5) to a consumer
free of charge within 45 days after receiving a verifiable
consumer request. The response period may be extended once by 30
additional days when reasonably necessary, taking into account
the complexity of the consumer's requests, provided the business
informs the consumer of any such extension within the initial
45-day response period along with the reason for the extension.
The information must be delivered in a readily usable format
747837 - n969-line687.docx
Published On: 3/9/2021 4:54:30 PM
Page 1 of 3
16
17
18
20
21
22
23
24
29
26
27
28
29
30
31
32
33
34
35
36
37
38
39
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 4
that allows the consumer to transmit the information from one
entity to another entity without hindrance.
(c) If a third party assumes control of all or part of a
business, acquires a consumer's personal information as part of
the transfer, and the third party materially alters how it uses
a consumer's personal information or shares the information ina
manner that is materially inconsistent with the promises made at
the time of collection, the third party must provide prior
notice of the new or changed practice to the customer. The
notice must be sufficiently prominent and robust to ensure that
existing consumers can easily exercise their rights under
subsections (3) through (6).
(d) Any contract between a business and a service provider
must prohibit the service provider from:
1. Selling or sharing the personal information;
2. Retaining, using, or disclosing the personal
information for any purpose, commercial or otherwise, other than
for the business purposes specified in the contract with the
business; or
3. Combining the personal information that the service
provider receives from or on behalf of the business with
personal information that it receives from or on behalf of
another person or entity or that the service provider collects
from its own interaction with the consumer, provided that the
747837 - h969-line687.docx
Published On: 3/9/2021 4:54:30 PM
Page 2 of 3
40
41
42
43
44
45
46
47]
48
49
50
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 4
service provider may combine personal information to perform any
business purpose.
(e) A third party that receives a consumer's personal
information is prohibited from:
1. Selling or sharing the personal information.
2. Retaining, using, or disclosing the information outside
of the direct business relationship between the person and the
business.
(f) A third party or a service provider must reguire any
subcontractor to meet the same obligations of such third party
or service provider with respect to personal information.
747837 - h969-line687.docx
Published On: 3/9/2021 4:54:30 PM
Page 3 of 3
10
11
12
13
14
15
16
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 5
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED __ (Y/N)
ADOPTED AS AMENDED __ (Y/N)
ADOPTED W/O OBJECTION __ (Y/N)
FAILED TO ADOPT __ (Y/N)
WITHDRAWN _ (Y/N)
OTHER ee
Committee/Subcommittee hearing bill: Regulatory Reform
Subcommittee
Representative McFarland offered the following:
Amendment
Remove lines 840-855 and insert:
(b) This section does not apply to:
1. A business that collects or discloses its employees',
applicants’, interns’, or volunteers’ personal information, so
long as the business is collecting or disclosing such
information within the scope of its role as an employer.
2. Health information that is collected by a covered
entity or business associate governed by the privacy, security,
and breach notification rules issued by the United States
Department of Health and Human Services in 45 C.F.R. parts 160
and 164.
764655 - h969-line840.docx
Published On: 3/9/2021 4:55:14 PM
Page 1 of 2
17
18
19
20
21
22
23
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 969 (2021)
Amendment No. 5
3. A covered entity or business associate governed by the
privacy, security, and breach notification rules issues by the
United States Department of Health and Human Services in 45
C.F.R. parts 160 and 164, to the extent the covered entity or
business associate maintains patient information in the same
manner as medical information or protected health information as
described in subparagraph 2.
764655 - h969-line840.docx
Published On: 3/9/2021 4:55:14 PM
Page 2 of 2
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 971 Pub. Rec./Consumer Data Privacy
SPONSOR(S): McFarland
TIED BILLS: HB 969 IDEN./SIM. BILLS:
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Regulatory Reform Subcommittee Wright (Ww) Anstead rn.
2) Government Operations Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
As technologies that capture and analyze data proliferate, so, too, do businesses’ abilities to contextualize
consumer data. Businesses use it for a range of purposes. The European Union, California, and a few other
states have enacted data privacy regulations to protect such data and give consumers more control over how
their information is used.
HB 969, to which this bill is linked, gives certain consumer rights related to personal information, including:
e The right to access personal information collected on them by a business,
e The right to delete or correct their personal information, and
e The right to opt-out of the sale of sharing of their personal information to third parties.
The Department of Legal Affairs (DLA), upon belief that any business, service provider, or other person or
entity is in violation of the consumer data requirement provisions, and that proceedings would be in the public
interest, may bring an action against a business, service provider, or other person or entity. DLA may seek a
civil penalty of not more than $2,500 for each unintentional violation or $7,500 for each intentional violation,
and triple the amount if the violation involves a consumer who is 16 years of age or younger.
This bill, which is linked to the passage of HB 969, provides that all information received by the department
pursuant to a notification of a security breach or a violation of certain statutory requirements, or received by the
department pursuant to an investigation by the department or a law enforcement agency, is confidential and
exempt. The bill provides that the information may be released during an active investigation:
e In the furtherance of official duties and responsibilities;
e For print, publication, or broadcast to notify the public of a data breach; or
¢ To another governmental entity in the furtherance of its official duties and responsibilities.
Once an investigation is completed, the following information will remain confidential and exempt:
e All information to which another public records exemption applies,
Personal information,
A computer forensic report,
Information that would otherwise reveal weaknesses in a business's data security, and
Information that would otherwise disclose a business's proprietary information.
o *# @ @
Per the Open Government Sunset Review Act, this exemption will be automatically repealed on October 2,
2027, unless reenacted by the Legislature.
Article |, s. 24(c) of the Florida Constitution requires a two-thirds vote of the members present and
voting for final passage of a newly created or expanded public record or public meeting exemption.
The bill creates a public record exemption; thus, it requires a two-thirds vote for final passage.
This document does not reflect the intent or official position of the bill sponsor or House of Representatives.
STORAGE NAME: h0971.RRS.DOCX
DATE: 3/6/2021
FULL ANALYSIS
|. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Public Records
Article |, s. 24(a) of the State Constitution sets forth the state’s public policy regarding access to
government records. This section guarantees every person a right to inspect or copy any public record
of the legislative, executive, and judicial branches of government. The Legislature, however, may
provide by general law for the exemption of records from the requirements of Article |, section 24(a).'
The general law must state with specificity the public necessity justifying the exemption and must be no
more broad than necessary to accomplish its purpose.”
Public policy regarding access to government records is addressed further in the Florida Statutes.
Section 119.07(1), F.S., guarantees every person a right to inspect and copy any state, county, or
municipal record. Furthermore, the Open Government Sunset Review Act? provides that a public record
or public meeting exemption may be created or maintained only if it serves an identifiable public
purpose. In addition, it may be no broader than is necessary to meet one of the following purposes:
e Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
e Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
e Protect trade or business secrets.*
The Open Government Sunset Review Act requires the automatic repeal of a newly created exemption
on October 2nd of the fifth year after creation or substantial amendment, unless the Legislature
reenacts the exemption.®
Consumer Data Privacy
As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to
contextualize consumer data. Businesses use it for a range of purposes, including better understanding
day-to-day operations, making more informed business decisions and learning about their customers.®
The European Union, several other countries, California, and a few other states have enacted data
privacy regulations to protect such data and give consumers more control over how their information is
used. Florida does not have a broad data privacy law, but there is a law which governs what actions
must be taken by certain government and business entities in the event of a data breach of personal
information.’
Department of Legal Affairs
The Office of the Attorney General, also known as the Department of Legal Affairs (DLA), provides a
wide variety of legal services, including defending the state in civil litigation cases, representing the
1 Art. |, s. 24(c), FLA. CONST.
2 Art. |, s. 24(c), FLA. CONST.
3 Section 119.15, F.S.
4 Section 119.15(6)(b), F.S.
5 Section 119.15(3), F.S.
§ Max Freedman, How Businesses Are Collecting Data (And What They’re Doing With It), Business News Daily (Jun. 17, 2020)
https://www.businessnewsdaily.com/10625-businesses-collecting-data.html.
7S. 501.171, F.S.
STORAGE NAME: h0971.RRS.DOCX PAGE: 2
DATE: 3/6/2021
people of Florida in criminal appeals in state and federal courts, protecting rights of children,
consumers, and victims through its various protection programs, and investigating and litigating against
businesses that seek to limit competition and defraud taxpayers.®
HB 969 (2021)
HB 969, to which this bill is linked, gives certain consumer rights related to personal information,
including:
e The right to access personal information collected on them by a business,
e The right to delete or correct their personal information, and
e The right to opt-out of the sale of sharing of their personal information to third parties.
A “business” is a for profit entity that does business in Florida, collects and controls personal
information, and satisfies one or more of the following thresholds:
e Has global annual gross revenues in excess of $25 million, as adjusted in January of every odd-
numbered year to reflect any increase in the Consumer Price Index.
e Annually buys, receives for the business's commercial purposes, sells, or shares for commercial
purposes, the personal information of 50,000 or more consumers, households, or devices.
e¢ Derives 50 percent or more of its global annual revenues from selling or sharing personal
information about consumers.
Under the bill, personal information is information that identifies, relates to, or describes a particular
consumer or household, or is reasonably capable of being directly or indirectly associated or linked
with, a particular consumer or household. The term does not include public information from
government records; or deidentified or aggregate consumer information.
The bill proscribes certain operational requirements on businesses with respect to collecting, selling, or
sharing personal information with service providers or third parties.
DLA, upon belief that any business, service provider, or other person or entity is in violation and that
proceedings would be in the public interest, may bring an action against a business, service provider,
or other person or entity. DLA may seek a civil penalty of not more than $2,500 for each unintentional
violation or $7,500 for each intentional violation, and triple the amount if the violation involves a
consumer who is 16 years of age or younger.
Effect of the Bill
The bill provides that all information received by the department pursuant to a notification of a security
breach or a violation of certain statutory requirements, or received by the department pursuant to an
investigation by the department or a law enforcement agency, is confidential and exempt. °
During an active investigation, information made confidential and exempt may be disclosed by DLA:
e Inthe furtherance of official duties and responsibilities;
e For print, publication, or broadcast if the department determines that such release would assist
in notifying the public or locating or identifying a person that the department believes to be a
victim of a data breach or improper use or disposal of customer records, except that information
made confidential and exempt after an investigation may not be released in this manner; or
8 OPPAGA, Office of the Attorney General (Department of Legal Affairs,
https://oppaga.fl.gov/ProgramSummary/ProgramDetail?programNumber=1026 (last visited Mar. 7, 2021).
° There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
deems confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain circumstances.
See WFTY, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied 892 So.2d 1015 (Fla. 2004); City of
Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA 1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5'" DCA 1991). If
the Legislature designates a record as confidential and exempt from public disclosure, such record may not be released by the
custodian of public records, to anyone other than the persons or entities specifically designated in statute. See Op. Att'y Gen. Fla.
1985).
Sronege NAME: h0971.RRS.DOCX PAGE: 3
DATE: 3/6/2021
To another governmental entity in the furtherance of its official duties and responsibilities.
Once an investigation is completed or once an investigation ceases to be active, the following
information received by DLA will remain confidential and exempt:
All information to which another public records exemption applies,
Personal information,
A computer forensic report,
Information that would otherwise reveal weaknesses in a business's data security, and
Information that would otherwise disclose a business's proprietary information.
The term "proprietary information" means information that:
Is owned or controlled by the business,
Is intended to be private and is treated by the business as private because disclosure would
harm the business or its business operations,
Has not been disclosed except as required by law or a private agreement that provides that the
information will not be released to the public,
Is not publicly available or otherwise readily ascertainable through proper means from another
source in the same configuration as received by DLA, and
Includes trade secrets and competitive interests.
The provision is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and
will stand repealed on October 2, 2027, unless reviewed and saved from repeal through reenactment
by the Legislature.
The bill will become effective on the same date that HB 969 (2021) or similar legislation takes effect, if
such legislation is adopted in the same legislative session or an extension thereof and becomes a law.
B. SECTION DIRECTORY:
Section 1: Creates a public records exemption for investigations related to s. 501.173, F.S.
Section 2: Provides a public necessity statement as required by the Florida Constitution.
Section 3: Provides an effective date of the same date that HB 969 (2021) or similar legislation
takes effect, if such legislation is adopted in the same legislative session or an extension
thereof and becomes law.
ll. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
See Fiscal Comments.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
STORAGE NAME: h0971.RRS.DOCX PAGE: 4
DATE: 3/6/2021
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
The bill may have a minimal fiscal impact on DLA because agency staff responsible for complying with
public records requests may require training related to the creation of the public records exemptions.
DLA could incur costs associated with redacting the exempt information prior to releasing a record. The
costs, however, would be absorbed by existing resources, as they are part of the day-to-day
responsibilities of agencies
lil. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. The bill does not appear to require counties or municipalities to take an action
requiring the expenditure of funds, reduce the authority that counties or municipalities have to raise
revenue in the aggregate, nor reduce the percentage of state tax shared with counties or
municipalities.
2. Other:
Vote Requirement
Article |, section 24(c) of the Florida Constitution requires a two-thirds vote of the members present
and voting for final passage of a newly created or expanded public record or public meeting
exemption. The bill expands a public record exemption; thus, it requires a two-thirds vote for final
passage.
Public Necessity Statement
Article |, section 24(c) of the Florida Constitution requires a public necessity statement for a newly
created or expanded public record or public meeting exemption. The bill expands a public record
exemption; thus, it includes a public necessity statement.
Breadth of Exemption
Article 1, section 24(c) of the Florida Constitution requires a newly created or expanded public record
or public meeting exemption to be no broader than necessary to accomplish the stated purpose of
the law. The bill creates a public records exemption for sensitive investigative materials and personal
information, which does not appear to be broader than necessary to accomplish its purpose.
B. RULE-MAKING AUTHORITY:
None.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/ COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: h0971.RRS.DOCX PAGE: 5
DATE: 3/6/2021
FLORIODA H O US E O F REP RES EN TA TIVE S
HB 971 2021
1 A bill to be entitled
2 An act relating to public records; amending s.
3 501.173, F.S.; providing an exemption from public
4 records requirements for information relating to
i] investigations by the Department of Legal Affairs and
6 law enforcement agencies of certain data privacy
7 violations; providing for future legislative review
8 and repeal of the exemption; providing a statement of
9 public necessity; providing a contingent effective
10 date.
11
12} Be It Enacted by the Legislature of the State of Florida:
13
14 Section 1. Subsection (14) is added to section 501.173,
15 Florida Statutes, as created by HB 969, 2021 Regular Session, to
16} read:
17 501.173 Consumer data privacy.—
18 (14) PUBLIC RECORDS EXEMPTION.—
19 (a) All information received by the department pursuant to
20] a notification of a security breach or a violation under this
21) section, or received by the department pursuant to an
22 investigation by the department or a law enforcement agency, is
23] confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
24 of the State Constitution, until such time as the investigation
25] is completed or ceases to be active. This exemption shall be
Page 1 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb097 1-00
FLORIODA HO US E O F R EP RES EN TAT IVE S$
HB 971 2021
26 construed in conformity with s. 119.071(2)(c).
27 (bo) During an active investigation, information made
28) confidential and exempt pursuant to paragraph (a) may be
29| disclosed by the department:
30 1. In the furtherance of official duties and
31] responsibilities;
32 2. For print, publication, or broadcast if the department
33] determines that such release would assist in notifying the
34] public or locating or identifying a person that the department
35] believes to be a victim of a data breach or improper use or
36] disposal of customer records, except that information made
37] confidential and exempt by paragraph (c) may not be released
38] pursuant to this subparagraph; or
39 3. To another governmental entity in the furtherance of
40} its official duties and responsibilities.
4} (c) Upon completion of an investigation or once an
42| investigation ceases to be active, the following information
43) received by the department shall remain confidential and exempt
44 from s. 119,0/7(1) ands. 24(a), Art. I of the State
45 Constitution:
46 1. All information to which another public records
47) exemption applies.
48 2. Personal information.
49 3. A computer forensic report.
50 4. Information that would otherwise reveal weaknesses in a
Page 2 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb097 1-00
FLO RIODA HO US E O F R EP RES EN TATHEIV ES
HB 971 2021
51] business's data security.
52 5. Information that would disclose a business's
53} proprietary information.
54 (d) For purposes of this subsection, the term "proprietary
55 information" means information that:
56 1. Is owned or controlled by the business.
57 2. Is intended to be private and is treated by the
58} business as private because disclosure would harm the business
59} or its business operations.
60 3. Has not been disclosed except as required by law or a
61] private agreement that provides that the information will not be
62] released to the public.
63 4. Is not publicly available or otherwise readily
64} ascertainable through proper means from another source in the
65) same configuration as received by the department.
66 5. Includes:
67 a. Trade secrets as defined in s. 688.002.
68 b. Competitive interests, the disclosure of which would
69 impair the competitive business of the business who is the
70| subject of the information.
71 (e) This subsection is subject to the Open Government
72 Sunset Review Act in accordance with s. 119.15 and shall stand
73) repealed on October 2, 2027, unless reviewed and saved from
74) repeal through reenactment by the Legislature.
aS Section 2. The Legislature finds that it is a public
Page 3 of 5
CODING: Words stricken are deletions; words underlined are additions.
FLORtIODA H OU S E O F REP RES EN TAT IV ES
HB 971 2021
76| necessity that all information received by the Department of
77| Legal Affairs pursuant to a notification of a violation of s.
78] 501.173, Florida Statutes, or received by the department
79) pursuant to an investigation by the department or a law
80] enforcement agency, be made confidential and exempt from s.
81 119.07(1), Florida Statutes, ands. 24(a), Article I of the
82] State Constitution for the following reasons:
83 (1) A notification of a violation of s. 501.173, Florida
84) Statutes, may result in an investigation of such violation. The
85} premature release of such information could frustrate or thwart
86] the investigation and impair the ability of the department to
87| setifectively and efficiently administer sw 501.173, Florida
88 Statutes. In addition, release of such information before
89] completion of an active investigation could jeopardize the
90} ongoing investigation.
91 (2) The Legislature finds that it is a public necessity to
92) continue to protect from public disclosure all information to
93) which another public record exemption applies once an
94] investigation is completed or ceases to be active. Release of
95] such information by the department would undo the specific
96] statutory exemption protecting that information.
97 (3) An investigation of a data privacy violation is likely
98} to result in the gathering of sensitive personal information,
99) including social security numbers, identification numbers, and
100] personal financial information. Such information could be used
Page 4 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb0971-00
FtLORIODA H OU S E O F REP RES EN TAT IVE S
HB 971 2021
101] for the purpose of identity theft. In addition, release of such
102| information could subject possible victims of data privacy
103 violations to further harm.
104 (4) Notices received by the department and information
105] received during an investigation of a data breach are likely to
106} contain proprietary information, including trade secrets, about
107} the security of the breached system. The release of the
108] proprietary information could result in the identification of
109 vulnerabilities. In addition, a trade secret derives
110] independent, economic value, actual, or potential, from being
111} generally unknown to, and not readily ascertainable by, other
112] persons who might obtain economic value from its disclosure or
113} use. Allowing public access to proprietary information,
114] including a trade secret, through a public records request could
115] destroy the value of the proprietary information and cause a
116} financial loss to the business submitting the information.
117] Release of such information could give business competitors an
118] unfair advantage and weaken the position of the entity supplying
119] the proprietary information in the marketplace.
120 Section 3. This act shall take effect on the same date
121) that HB 969 or similar legislation takes effect, if such
122) legislation is adopted in the same legislative session or an
123 extension thereof and becomes a law.
Page 5 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb0971-00
File and source
- File
- 2021-03-10_3101_regulatory-reform-subcommittee_meeting-packets_fn-rrs-3-10-21.pdf
- Size
- 40,087,446 bytes
- SHA-256
- 1989bdd50ecba81244b52a2fa61f6b65c9741d712863e17c23f59ecf5bc97dc7
- Original
- No public link identified.