Meeting Packet — Commerce Committee (February 10, 2022)

Summary

Meeting packet for the Commerce Committee, Thursday, February 10, 2022, 9:00 AM in Webster Hall (212 Knott). The agenda lists HB 9 Consumer Data Privacy by McFarland, HB 631 Airport Funding by Grall, HB 695 Property Insurer Reimbursements by Stevenson, and HB 1565 by McFarland. The staff analysis of HB 9 states that the bill requires certain businesses to publish a privacy policy for personal information, gives consumers rights to access, delete or correct, and opt out of the sale or sharing of personal information, and allows the Department of Legal Affairs (DLA) to enforce these rights. The packet ends with the text of HB 1565, whose Section 3 ties its effective date to the date HB 9 or similar legislation takes effect.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Meeting Packet — Commerce Committee (February 10, 2022).” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2022-02-10-3098-commerce-committee-meeting-packets-fn-com-2-10-22-1cdbaa1034/, SHA-256 83d55035f5c65cf6e7291d8f3e7aa59dfbf4a83365fdbd0c3c96000563f5927e.

Full text

Commerce Committee
Thursday, February 10, 2022
9:00 AM - 11:00 AM
Webster Hall (212 Knott)

Meeting Packet

Chris Sprowls Blaise Ingoglia
Speaker Chair
The Florida House of Representatives
Commerce Committee

Chris Sprowls Blaise Ingoglia
Speaker Chair

Meeting Agenda

Thursday, February 10, 2022
9:00 AM – 11:00 AM
Webster Hall (212 Knott)

I. Call to Order

II. Roll Call

III. Welcome and Opening Remarks

IV. Consideration of the following bill(s):

• HB 9 Consumer Data Privacy by McFarland

• HB 631 Airport Funding by Grall

• HB 695 Property Insurer Reimbursements by Stevenson

• HB 1565 Pub. Rec./Consumer Data Privacy by McFarland

V. Closing Remarks

VI. Adjournment

303 House Office Building, 402 South Monroe Street, Tallahassee, FL 32399-1300
(850) 717-4870
HB 9
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 9 Consumer Data Privacy
SPONSOR(S): McFarland
TIED BILLS: HB 1565 IDEN./SIM. BILLS:

REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF

1) Commerce Committee Wright Hamon

2) Judiciary Committee

SUMMARY ANALYSIS
Due to the growth in businesses that collect personal information for the purpose of selling targeted advertising
on the Internet, many countries and states have adopted or updated laws relating to the collection and use of
personal information. Specifically, the European Union, and states like California, Virginia, Colorado, and
Illinois, have enacted data privacy laws to protect consumers’ personal information.

The bill requires certain businesses to publish a privacy policy for personal information, and defines “personal
information” as information that is linked or reasonably linkable to an identified or identifiable consumer or
household, including biometric information and unique identifiers to the consumer. The term does not include
certain public information, certain employee information, or deidentified or aggregate information.

The bill gives consumers rights related to personal information collected by certain businesses, including:
 The right to access personal information collected,
 The right to delete or correct personal information, and
 The right to opt-out of the sale or sharing of personal information.

The bill allows the Department of Legal Affairs (DLA) to enforce these rights by bringing an action against, and
collecting civil penalties from, violators. Consumers whose personal information has been sold or shared after
opting-out, or has been retained after a request to delete or correct may also bring a cause of action.

The bill also adds “biometric data” to the definition of “personal information” in the Florida Information
Protection Act. Thus, entities in possession of fingerprints, DNA, and other biological or physiological
identifying information must take reasonable measures to protect the biometric data and report data breaches.

The bill has no fiscal impact on local governments, and an indeterminate fiscal impact on state government.

The bill has an effective date of July 1, 2023.

This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h0009.COM
DATE: 2/9/2022
FULL ANALYSIS

I. SUBSTANTIVE ANALYSIS

A. EFFECT OF PROPOSED CHANGES:
Consumer Data Privacy – Current Situation

Florida Deceptive and Unfair Trade Practices Act (FDUTPA)

FDUTPA is a consumer and business protection measure that prohibits unfair methods of competition,
unconscionable acts or practices, and unfair or deceptive acts or practices in trade or commerce. 1
FDUTPA is based on federal law.2

DLA or the Office of the State Attorney (SAO) may bring actions when it is in the public interest on
behalf of consumers or governmental entities.3 SAO may enforce violations of the FDUTPA if the
violations take place in its jurisdiction. DLA has enforcement authority if the violation is multi-
jurisdictional, the state attorney defers in writing, or the state attorney fails to act within 90 days after a
written complaint is filed.4 In certain circumstances, consumers may also file suit through private
actions.5

DLA and the SAO have powers to investigate FDUTPA claims, which include:6
 Administering oaths and affirmations,
 Subpoenaing witnesses or matter, and
 Collecting evidence.

DLA and the State Attorney, as enforcing authorities, may seek the following remedies:
 Declaratory judgments,
 Injunctive relief,
 Actual damages on behalf of consumers and businesses,
 Cease and desist orders, and
 Civil penalties of up to $10,000 per willful violation.7

FDUTPA may not be applied to certain entities in certain circumstances, including: 8
• Any person or activity regulated under laws administered by the Office of Insurance Regulation
or the Department of Financial Services; or
• Banks, credit unions, and savings and loan associations regulated by the Office of Financial
Regulation or federal agencies.

Consumer Data

1 Ch. 73-124, L.O.F., and s. 501.202, F.S.
2 D. Matthew Allen, et. al., The Federal Character of Florida’s Deceptive and Unfair Trade Practices Act, 65 U. MIAMI L. R EV. 1083

(Summer 2011).
3 S. 501.207(1)(c) and (2), F.S.; see s. 501.203(2), F.S. (defining “enforcing authority” and referring to the office of the state attorney if a

violation occurs in or affects the judicial circuit under the office’s jurisdictio n; or the Department of Legal Affairs if the violation occurs in
more than one circuit; or if the office of the state attorney defers to the department in writing; or fails to act within a s pecified period.);
see also David J. Federbush, FDUTPA for Civil Antitrust: Additional Conduct, Party, and Geographic Coverage; State Actions for
Consumer Restitution, 76 FLORIDA BAR JOURNAL 52, Dec. 2002 (analyzing the merits of FDUPTA and the potential for deterrence of
anticompetitive conduct in Florida), availab le at
http://www.floridabar.org/divcom/jn/jnjournal01.nsf/c0d731e03de9828d852574580042ae7a/99aa165b7d8ac8a485256c8300791ec1!Op
enDocument&Highlight=0,business,Division* (last visited on Jan. 28, 2022).
4 S. 501.203(2), F.S.
5 S. 501.211, F.S.
6 S. 501.206(1), F.S.
7 Ss. 501.207(1), 501.208, and 501.2075, F.S. Civil Penalties are deposited into general revenue. Enforcing authorities may also

request attorney fees and costs of investigation or litigation. S. 501.2105, F.S.
8 S. 501.212(4), F.S.

STORAGE NAME: h0009.COM PAGE: 2
DATE: 2/9/2022
As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to
contextualize consumer data. Businesses use it for a range of purposes, including better understanding
of day-to-day operations, making more informed business decisions and learning about their
customers.9

From consumer behavior to predictive analytics, companies regularly capture, store, and analyze large
amounts of quantitative and qualitative data on their consumer base. Some companies have built an
entire business model around consumer data, whether the companies are selling personal information
to a third party or creating targeted ads.10

Generally, the types of consumer data that businesses collect are:11
• Personal data, which includes personally identifiable information, such as Social Security
numbers and gender, as well as identifiable information, including IP address, web browser
cookies, and device IDs;
• Engagement data, which details how consumers interact with a business's website, mobile
apps, social media pages, emails, paid ads and customer service routes;
• Behavioral data, which includes transactional details such as purchase histories, product usage
information, and qualitative data; and
• Attitudinal data. This data type encompasses metrics on consumer satisfaction, purchase
criteria, product desirability and more.

9 Max Freedman, How Businesses Are Collecting Data (And What They’re Doing With It), Business News Daily (Jun. 17, 2020)

https://www.businessnewsdaily.com/10625-businesses-collecting-data.html (last visited Jan. 28, 2022).
10 Id.
11 Id.

STORAGE NAME: h0009.COM PAGE: 3
DATE: 2/9/2022
Comparison of Consumer Data Privacy Laws 12

Comparison of Consumer Data Privacy Laws
Element Colorado Virginia California European Union
Opt-out or Opt-in of Sale of Opt-Out Opt-Out Opt-Out Opt-In
Personal Information
Opt-in or Opt-out of Opt-In Opt-In Opt-Out Opt-In
Sensitive Information
Processing
Statutory Cure Period
🗸 🗸 🗸 X
Right to Appeal Denials or
Requests 🗸 🗸 X X
Express Obligations for
Deidentified Data 🗸 🗸 X X
Requirement to Perform
Data Impact Assessments 🗸 🗸 🗸 🗸
Private Right of Action
X X 🗸 🗸
Government Enforcement Attorney General Attorney General CPPA, Attorney DPAs
Agency General
Penalties Up to $20,000 per Up to $7,500 per Up to $2,500 per Up to €20 million, or
violation violation unintentional 4% of worldwide
violation, and up to annual revenue for
$7,500 per violations,
intentional violation depending on
severity of the
violation
Operative Date 07/01/23 01/01/23 01/01/23 05/25/18
Business/Controller Either: Either: Meets any of the •Any E.U. business
Applicability Thresholds •Controls/Processes •Controls/Processes following: which processes
data of at least data of at least •Gross annual consumer data; or
100,000 consumers 100,000 consumers revenue of over $25 •Any worldwide
per year; or per year; or million; business that offers
•Derives revenue •Derives over 50% •Processes data of goods/services
from sale of data of revenue from sale 100,000 or more (paid or for free) or
from at least 25,000 of data from at least consumers; or is monitoring the
consumers per year 25,000 consumers •Derives at least behavior of
per year 50% or more of individuals in the
revenue from data E.U.
sales

General Data Protection Regulation (European Union)

In 2016, The European Union passed a broad data privacy law that addressed several areas of
consumer rights and data protection called the General Data Protection Regulation (GDPR). 13 The law
became effective in 2018 and unified the regulatory approach to data privacy across the European
Union. The GDPR has since become a model for other data privacy laws in other countries, including
Chile, Japan, Brazil, South Korea, Argentina, and Kenya.14

Under the GDPR, personal data is anything that allows a person to be identified. Under GDPR,
individuals, organizations, and companies that are either 'controllers' or 'processors' of personal data

12 JDSupra, Virginia Is For Lovers…Of Data Privacy, https://www.jdsupra.com/legalnews/virginia-is-for-lovers-of-data-privacy-3879845/

(last visited Jan. 28, 2022).
13 European Data Protection Supervisor, The History of the General Data Protection Regulation, https://edps.europa.eu/data-

protection/data-protection/legislation/history-general-data-protection-regulation_en (last visited Jan. 28, 2022).
14 Id.

STORAGE NAME: h0009.COM PAGE: 4
DATE: 2/9/2022
are covered by the law. Controllers exercise overall control over the purposes and means of processing
personal data. Processors act on behalf of, and only on the instructions of, the relevant controller.15

Before processing or collecting any personal data, any business must ask for explicit permission from
the subject or person. The request must use clear language. This is known as an “opt-in.”

The provisions of the GDPR specifically ban the use of long documents filled with legalese - hiding
permissions within Terms and Conditions or a Privacy Policy will not meet the requirements. Consent
must be given for a specific purpose and must be requested separately from other documents and
policy statements. 16

The GDPR requires companies to provide, at the data subject's request, confirmation as to whether
personal data pertaining to them is being processed, where it is being processed, and for what
purpose. Companies must also be able to provide, free of charge, a copy of the personal data being
processed in an electronic format.17

Under the GDPR, companies must erase all personal data when asked to do so by the data subject. At
that point, the company must cease further dissemination of the data, and halt all processing. Valid
conditions for erasure include situations where the data is no longer relevant, or the original purpose
has been satisfied, or merely a data subject's subsequent withdrawal of consent. 18

The GDPR requires companies to provide mechanisms for a data subject to receive any previously
provided personal data in a commonly used and machine-readable format.19

The GDPR allows private rights of action for violations of privacy rights, but the consumer must prove
any damages in order to receive compensation.20

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

The California Consumer Privacy Act of 2018 (CCPA) was passed to give consumers more control over
the personal information that businesses collect. This landmark law in the United States granted new
privacy rights for California consumers, including:21
• The right to know about the personal information a business collects, specifically about the
consumer, and how it is used and shared;
• The right to delete personal information collected with some exceptions;
• The right to opt-out of the sale of personal information; and
• The right to non-discrimination for exercising the CCPA rights.

The CCPA applies to for-profit businesses that do business in California that also meet any of the
following:22
• Have a gross annual revenue of over $25 million;
• Buy, receive, or sell the personal information of 50,000 or more California residents,
households, or devices; or
• Derive 50 percent or more of their annual revenue from selling California residents’ personal
information.

15 Wired, What is the GDPR? The summary guide to GDPR compliance in the UK, https://www.wired.co.uk/article/what-is-gdpr-uk-eu-

legislation-compliance-summary-fines-2018 (last visited Jan. 28, 2022).
16 TechRepublic, GDPR: A cheat sheet, https://www.techrepublic.com/article/the-eu-general-data-protection-regulation-gdpr-the-smart-

persons-guide/ (last visited Jan. 28, 2022).
17 Id.
18 Id.
19 Id.
20 Art. 82 of the GDPR.
21 State of California Department of Justice, Office of the Attorney General, California Consumer Privacy Act (CCPA),

https://oag.ca.gov/privacy/ccpa (last visited Jan. 28, 2022).
22 Cal. Civ. Code § 1798.140.

STORAGE NAME: h0009.COM PAGE: 5
DATE: 2/9/2022
Businesses are required to give consumers certain notices explaining their privacy practices and
provide certain mechanisms to allow consumers to exercise their rights.23

The law is largely enforced by the Attorney General, and businesses are subject to fines for violating
the law. Consumers may only bring a cause of action against a business if certain categories of
personal information tied to their name have been stolen in a nonencrypted and nonredacted form.24 As
of July 2020, approximately 50 suits had been filed pursuant to this provision.25

The California Privacy Rights Act (CPRA) passed in 2020 as a statewide proposition, though it is not
effective until January 1, 2023. The CPRA amends and expands the CCPA. Specifically dealing with
certain areas of concern with the CCPA and it also created a new agency to handle complaints and
enforcement. The CPRA changes the CCPA in the following ways:26
• Allowing consumers to:
o prevent businesses from sharing personal information;
o correct inaccurate personal information; and
o limit businesses’ use of “sensitive personal information”—including precise geolocation;
race; ethnicity; religion; genetic data; private communications; sexual orientation; and
specified health information;
• Establishing California Privacy Protection Agency to additionally enforce and implement
consumer privacy laws and impose fines;
• Changing criteria for which businesses must comply with laws by:
o Doubling the CCPA’s threshold number of consumers or households from 50,000 to
100,000, resulting in reduced applicability of the law to small and midsize businesses;
o Expanding applicability to businesses that generate most of their revenue from sharing
personal information, not just selling it; and
o Extending the definition to joint ventures or partnerships composed of businesses that
each have at least a 40 percent interest.
• Prohibiting businesses’ retention of personal information for longer than reasonably necessary;
• Tripling maximum penalties for violations concerning consumers under age 16; and
• Authorizing civil penalties for theft of consumer login information.

Virginia Consumer Data Protection Act

On March 2, 2021, the Virginia Consumer Data Protection Act (VCDPA) was signed into law. 27 The
VCDPA, which will not become effective until January 1, 2023, borrows from CCPA and GDPR.28
Some argue that because Virginia was able to benefit from the experience of businesses that have
spent the better part of the last five years implementing GDPR or CCPA, the Virginia law may be a
lighter implementation task for companies.29

Generally, with regard to personal data, the VCDPA grants consumers the right to:
 Access,
 Correct,
 Delete,
 Obtain a copy of, and
 Opt-out of the processing of personal data for the purposes of targeted advertising.

23
Cal. Civ. Code §§ 1798.130, 1798.135.
24 Cal. Civ. Code §§ 1798.150, 1798.155.
25 Holland & Knight LLP, Litigating the CCPA in Court, https://www.hklaw.com/en/insights/publications/2020/07/litigating-the-ccpa-in-

court (last visited Jan. 28, 2022).
26 Ballotpedia, California Proposition 24, Consumer Personal Information Law and Agency Initiative (2020) ,

https://ballotpedia.org/California_Proposition_24,_Consumer_Personal_Information_Law_and_Agency_Initiative_(2020) (last visited
Jan. 28, 2022).
27 JDSupra, Virginia’s Consumer Data Protection Act Has assed: What’s in It?, https://www.jdsupra.com/legalnews/virginia-s-consumer-

data-protection-act-1577777/ (last visited Jan. 28, 2022).
28 Sidley Austin LLP, East Coast Meet West Coast: Enter the Virginia Consumer Data Privacy Protection Act,

https://www.sidley.com/en/insights/newsupdates/2021/03/east-coast-meets-west-coast-enter-the-virginia-consumer-data-protection-act
(last visited Jan. 28, 2022).
29 Id.

STORAGE NAME: h0009.COM PAGE: 6
DATE: 2/9/2022
VCDPA contains exceptions for certain types of data and information governed by federal law. It
provides that the Attorney General has exclusive authority to enforce violations of the law, and does
not provide a private cause of action to consumers. VCDPA applies to persons conducting business in
the state that either:
• Control or process personal data of at least 100,000 consumers or
• Derive over 50 percent of gross revenue from the sale of personal data and control or process
personal data of at least 25,000 consumers.30

Colorado Privacy Act

The Colorado Privacy Act (CPA)31 was signed in to law on July 8, 2021, and is effective July 1, 2023.
The law also borrows from the GDPR, CCPA, and VDCPA.32

Generally, with regard to personal data, the CPA grants consumers the right to:33
 Access,
 Correct,
 Delete, and
 Data portability.

Like the CCPA and VCDPA, CPA contains exceptions for certain types of data and information
governed by federal law. It provides that the Attorney General has exclusive authority to enforce
violations of the law, and does not provide a private cause of action to consumers. CPA applies to
persons conducting business in the state that either:34
 Controls or processes personal data of 100,000 or more consumers during a calendar year; or
 Derive revenue or receive discounts from the sale of personal data and control or process data
of at least 25,000 consumers.

Illinois Biometric Information Privacy Act

In 2008, Illinois adopted the Biometric Information Privacy Act (BIPA), which puts in place safeguards
and procedures relating to the retention, collection, disclosure, and destruction of biometric information
and specifically protects the biometric information of those in the state. It was the first state law in the
U.S. to specifically regulate biometrics.

Under BIPA, a private entity:35
 In possession of biometric data (defined as retina or iris scan, fingerprint, voiceprint, or scan of
hand or face geometry) must have a written policy establishing a retention schedule and
guidelines for permanently destroying such data;
 May not collect, capture, purchase, receive through trade, or otherwise obtain biometric data
unless it informs the subject that the data is being stored and the manner of storage, and
receives a written release from the subject;
 May not profit from a person’s biometric data;
 May not disseminate a person’s biometric data unless the subject consents, is authorized by
the subject, or is required by law or a valid warrant or subpoena; and
 Must store, transmit, and protect biometric data with a reasonable standard of care and in a
manner as or more protective as other confidential and sensitive information.

30 Virginia’s Legislative Information System, Bill Summary for SB 1392, https://lis.virginia.gov/cgi-bin/legp604.exe?211+sum+SB1392S

(last visited Jan. 28, 2022).
31 C.R.S. 1-6-1301-1313
32 The National Law Review, And Now There are Three … The Colorado Privacy Act, July 16, 2021,

https://www.natlawreview.com/article/and-now-there-are-three-colorado-privacy-
act#:~:text=Colorado%20has%20now%20joined%20California,effect%20on%20July%201%2C%202023 . (last visited Jan. 27, 2022).
33 Id.
34 Id.
35 740 Ill. Comp. Stat. 14/10, 14/15 (2008).

STORAGE NAME: h0009.COM PAGE: 7
DATE: 2/9/2022
BIPA provides a private cause of action, with relief including:36
 Liquidated damages of $1,000 or actual damages, whichever is greater, against a private entity
that negligently violates BIPA;
 Liquidated damages of $5,000 or actual damages, whichever is greater, against a private entity
that intentionally or recklessly violates BIPA;
 Reasonable attorneys' fees and costs; and
 Other relief, including an injunction, as the court deems appropriate.

Because Illinois granted a private cause of action for violations of BIPA, there have been several
lawsuits claiming damages for privacy and use violations, and Illinois courts have upheld the law. On
January 25, 2019, the Illinois Supreme Court found that an individual does not need to allege an actual
injury or adverse effect, beyond violation of their rights under BIPA, to qualify as an aggrieved party.
Therefore, anyone whose biometric data is affected by a violation of BIPA may seek liquidated
damages or injunctive relief under the Act.37 Court documents also tend to support the notion that an
individual in Illinois has a valid cause of action if their biometric data is taken without consent by a
private entity, including out-of-state entities, but it is subject to a finding of fact.38

Federal Laws Addressing Data Privacy

While there is no broad federal law addressing data privacy, generally, there are several industry-
specific laws that address the need to keep certain data private or protected, including the following:

Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) 39 is a federal law that required
the creation of national standards to protect sensitive patient health information from being disclosed
without the patient’s consent or knowledge. The U.S. Department of Health and Human Services (HHS)
issued the HIPAA Privacy Rule40 to implement the requirements of HIPAA. The HIPAA Security Rule
protects a subset of information covered by the Privacy Rule. 41

HIPAA’s Privacy Rule protects all "individually identifiable health information" held or transmitted by a
covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The
Privacy Rule calls this information "protected health information (PHI)" from being disclosed without the
patient’s consent or knowledge.42

“Individually identifiable health information” is information, including demographic data, that relates to:43
• The individual’s past, present or future physical or mental health or condition,
• The provision of health care to the individual, or
• The past, present, or future payment for the provision of health care to the individual.

The Privacy Rule excludes from protected health information employment records that a covered entity
maintains in its capacity as an employer and education and certain other records subject to, or defined
in, the Family Educational Rights and Privacy Act.44 20 U.S.C. §1232g.

The Security Rule applies to the subset of identifiable health information a covered entity creates,
receives, maintains, or transmits in electronic form, and is called “electronic protected health

36 740 Ill. Comp. Stat. 14/20 (2008).
37 Rosenb ach v. Six Flags Entertainment Corporation, 2019 IL 123186.
38 Rivera v. Google, Inc., 238 F.Supp.3d 1088 (N.D. Ill. 2017).; In re Faceb ook Biometric Information Privacy Litigation, 185 F.Supp.3d

1155 (N.D. Cal. (2016).; Norb erg v. Shutterfly, Inc., 152 F.Supp.3d 1103 (N.D. Ill. 2015).
39 42 U.S.C. § 1320.
40 45 C.F.R. §§ 160 and 164.
41 Centers for Disease Control and Prevention, Health Insurance Portability and Accountability Act of 19 96 (HIPAA),

https://www.cdc.gov/phlp/publications/topic/hipaa.html (last visited Jan. 28, 2022).
42 Id.
43 45 C.F.R. § 160.103.
44 20 U.S.C. § 1232(g).

STORAGE NAME: h0009.COM PAGE: 8
DATE: 2/9/2022
information” (e-PHI). The Security Rule does not apply to PHI transmitted orally or in writing. To comply
with the Security Rule, all covered entities must do the following:45
• Ensure the confidentiality, integrity, and availability of all electronic protected health information,
• Detect and safeguard against anticipated threats to the security of the information,
• Protect against anticipated impermissible uses or disclosures, and
• Certify compliance by their workforce.

“Covered entities” who must abide by the Privacy Rule and the Security Rule are: 46
• Health plans,
• Healthcare providers,
• Healthcare clearinghouses, and
• Business associates.

Federal Policy for the Protection of Human Subjects

The Federal Policy for the Protection of Human Subjects, or the “Common Rule,” is a rule promulgated
by the U.S. Food and Drug Administration (FDA).47 The Common Rule governs the ethical conduct of
research involving human subjects. Fifteen federal agencies and departments are party to this rule,
which first came into effect in 1981. The Common Rule has not been substantively updated since
1991.48 Among other requirements, the Common Rule mandates that researchers protect the privacy of
subjects and maintain confidentiality of human subject data. 49

The FDA is a member of the International Council for Harmonisation of Technical Requirements for
Pharmaceuticals for Human Use, which brings together the regulatory authorities and pharmaceutical
industry to develop guidelines for pharmaceutical trials.50

The Fair Credit Reporting Act

The Fair Credit Reporting Act51 (FCRA) protects information collected by consumer reporting agencies
such as credit bureaus, medical information companies and tenant screening services. Information in a
consumer report cannot be provided to anyone who does not have a purpose specified in the FCRA.
Companies that provide information to consumer reporting agencies also have specific legal
obligations, including the duty to investigate disputed information. In addition, users of the information
for credit, insurance, or employment purposes must notify the consumer when an adverse action is
taken on the basis of such reports.52

The Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act53 requires financial institutions, such as companies that offer consumers
financial products or services like loans, financial or investment advice, mortgages, or insurance, to
explain their information-sharing practices to their customers and to safeguard sensitive data. 54

45 CDC, supra note 40.
46 45 C.F.R. §§ 160.102, 160.103.
47 21 C.F.R. §§ 50, 60.
48
Association of Public and Land-Grant Universities, The “Common Rule” Federal Policy for the Protection of Human Subjects,
https://www.aplu.org/projects-and-initiatives/research-science-and-technology/common-
rule/#:~:text=The%20Federal%20Policy%20for%20the,been%20substantively%20updated%20since%201991 . (last visited Jan. 28,
2022).
49 The University of Chicago, University Data Usage Guide, Sensitive Identifiab le Human Sub ject Research Data,

https://dataguide.uchicago.edu/sensitive-identifiable-human-subject-research-data (last visited Jan. 28, 2022).
50 International Council for Harmonis ation, Welcome to the ICH Official Website, https://www.ich.org/ (last visited Jan. 28, 2022).
51 15 U.S.C. § 1681.
52 The Federal Trade Commission, Fair Credit Reporting Act, https://www.ftc.gov/enforcement/statutes/fair-credit-reporting-act (last

visited Jan. 28, 2022).
53 15 U.S.C. § 6801.
54 The Federal Trade Commission, Gramm -Leach-Bliley Act, https://www.ftc.gov/tips -advice/business-center/privacy-and-

security/gramm-leach-bliley-act (last visited Jan. 28, 2022).
STORAGE NAME: h0009.COM PAGE: 9
DATE: 2/9/2022
The law requires that financial institutions protect information collected about individuals; it does not
apply to information collected in business or commercial activities.

In certain situations, consumers of a financial institution have opt-out rights from having their nonpublic
personal information shared with third parties.55

Driver’s Privacy Protection Act

The Driver’s Privacy Protection Act of 1994 (DPPA) 56 protects the privacy of personal information
assembled by state departments of motor vehicles (DMVs).

The DPPA prohibits the release or use by any state DMV (or any officer, employee, or contractor
thereof) of personal information about an individual obtained by the DMV in connection with a motor
vehicle record, subject to certain exceptions, such as for legitimate government needs. It sets penalties
for violations and makes violators liable on a civil action to the individual to whom the released
information pertains.57

DPPA also requires states to get permission from individuals before their personal motor vehicle record
may be sold or released to third-party marketers.58

Family Educational Rights and Privacy Act

The Family Educational Rights and Privacy Act (FERPA) 59 protects the privacy of student education
records. The law applies to all schools that receive funds under an applicable program of the U.S.
Department of Education. FERPA gives parents certain rights with respect to their children's education
records. These rights transfer to the student when they reach the age of 18 or attend a school beyond the
high school level.

Schools may disclose, without consent, "directory" information such as a student's name, address,
telephone number, date and place of birth, honors and awards, and dates of attendance. However,
schools must tell parents and eligible students about directory information and allow parents and
eligible students a reasonable amount of time to request that the school not disclose directory
information about them. Schools must notify parents and eligible students annually of their rights under
FERPA.60

Children’s Online Privacy Protection Act (COPPA)

The Children’s Online Privacy Protection Act (COPPA)61 and its related rules regulate websites’
collection and use of children’s information. The operator of a website or online service that is directed
to children, or that has actual knowledge that it collects children’s personal information (covered
entities), must comply with requirements regarding data collection and use, privacy policy notifications,
and data security.

A covered entity may not collect a child’s (individual under the age of 13) personal information without
the prior, verifiable consent of his or her parent.62

COPPA requires covered entities to:63

55 International Association of Privacy Processionals, In Brief: The Financial Privacy Requirements of the Gramm -Leach-Bliley Act,

https://iapp.org/media/pdf/knowledge_center/brief_requirements_GLBA.pdf (last Jan. 28, 2022).
56 18 U.S.C. § 2721.
57 Electronic Privacy Information Center, The Drivers Privacy Protection Act (DPPA) and the Privacy of Your State Motor Vehicle

Record, https://epic.org/privacy/drivers/ (last visited Jan. 28, 2022).
58 Id.
59 20 U.S.C. § 1232(g); 34 C.F.R. § 99.
60 United States Department Of Education, Family Educational Rights and Privacy Act (FERPA),

https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html (last visited Jan. 28, 2022).
61 16 C.F.R. pt. 312.
62 15 U.S.C. §§ 6502(a)-(b).

STORAGE NAME: h0009.COM PAGE: 10
DATE: 2/9/2022
• Give parents direct notice of their privacy policies, including a description of their data collection
and sharing practices;
• Post a clear link to their privacy policies on their home page and at each area of their website
where they collect personal information from children;
• Institute procedures to protect the personal information that they hold;
• Ensure that any third party with which they share collected personal information implements the
same protection procedures; and
• Delete children’s personal information after the purpose for its retention has been fulfilled.

Violations of COPPA are deemed an unfair or deceptive act or practice and are therefore prosecuted by
the FTC. COPPA also authorizes state attorneys general to enforce violations that affect residents of
their states. There is no criminal prosecution or private right of action provided for under COPPA. 64

Consumer Data Privacy – Effect of the Bill

Overview

The bill creates certain consumer rights related to personal information, including:
 The right to access personal information collected specific to the individual consumer,
 The right to delete or correct personal information, and
 The right to opt-out of the sale of sharing of personal information to third parties.

The bill defines “personal information” as information that identifies, relates to, or describes a particular
consumer or household, or is reasonably capable of being directly or indirectly associated or linked
with, a particular consumer or household. The term does not include public information from
government records; or deidentified or aggregate consumer information.

A controller that receives a verifiable consumer request to access, delete, correct, or opt-out must
comply with such consumer request, with certain exceptions. Exceptions include those for
 Certain small businesses;
 Businesses which only use personal information for marketing products or services it offers; and
 Businesses which only sell or share personal information under by certain federal privacy laws.

Controllers may share personal information with a processor, even if a consumer has “opted-out,” if the
processor processes information for a controller pursuant to a written contract which limits how the
processor uses such information.

DLA may bring a FDUTPA action against a controller, processor, or person who violates the provisions
of the bill, and such controller, processor, or person may be subject to certain civil penalties.

Exceptions

The bill does not apply to:
 Personal information collected and transmitted that is necessary for the sole purpose of sharing
such personal information with a financial service provider to facilitate short term, transactional
payment processing for the purchase of products or services.
 Deidentified personal information or aggregate consumer information.
 Compliance with federal, state, or local laws.
 Compliance with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by
federal, state, or local authorities.

63 See, Federal Trade Commission, General Questions Ab out the COPPA Rule: What is the Children’s Online Privacy Protection Rule? ,

https://www.ftc.gov/tips -advice/business-center/guidance/complying-coppa-frequently-asked-questions-0 (last visited Jan. 28, 2022).
64 Federal Trade Commission, General Questions Ab out the COPPA Rule: COPPA Enforcement, https://www.ftc.gov/tips -

advice/business-center/guidance/complying-coppa-frequently-asked-questions-0 (last visited Jan. 28, 2022).
STORAGE NAME: h0009.COM PAGE: 11
DATE: 2/9/2022
 Cooperation with law enforcement agencies concerning conduct or activity that the controller,
processor, or third party reasonably and in good faith believes may violate federal, state, or
local law.
 Exercising legal rights or privileges.
 Personal information used or collected by a controller or processor pursuant to a written
contract between the controller and processor. Such information cannot be sold, shared, or
disclosed to another person unless otherwise permitted.
 Personal information used by a controller or processor to advertise or market products or
services that are produced or offered directly by the controller or processor as long as personal
information is not sold, shared, or disclosed to another party outside the consumer’s direct
interaction with the controller or processor.
 Personal information collected by a controller of a natural person acting in the role of a job
applicant, employee, owner, director, officer, contractor, volunteer, or intern of the controller, to
the extent the personal information is collected and used solely within the context of the
person’s role or former role with the controller.
 Protected health information for purposes of HIPAA and related regulations, and patient
identifying information for purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. s.
290dd-2.
 A covered entity or business associate governed by the privacy, security, and breach
notification rules issued by the U.S. Department of Health and Human Services in 45 C.F.R.
parts 160 and 164, or a program or a qualified service program defined in 42 C.F.R. part 2, to
the extent the covered entity, business associate, or program maintains personal information in
the same manner as medical information or protected health information and as long as the
covered entity, business associate, or program does not use personal information for targeted
advertising in conjunction with third parties and does not sell or share personal information to a
third party unless such sale or sharing is covered by an exception.
 Identifiable private information collected for purposes of research as defined in 45 C.F.R. s.
164.501, conducted in accordance with the Federal Policy for the Protection of Human Subjects
for purposes of 45 C.F.R. part 46, the good clinical practice guidelines issued by the
International Council for Harmonisation of Technical Requirements for Pharmaceuticals for
Human Use, the Protection for Human Subjects for purposes of 21 C.F.R. Parts 50 and 56; or
personal information used or shared in research conducted in accordance with one or more of
these standards.
 Information and documents created for purposes of the federal Health Care Quality
Improvement Act of 1986 and related regulations, or patient safety work product for purposes of
42 C.F.R. part 3, established pursuant to 42 U.S.C. s. 299b-21 through 299b-26.
 Information that is deidentified in accordance with 45 C.F.R. part 164 and that is derived from
individually identifiable health information, as described in HIPAA, or identifiable personal
information, consistent with the Federal Policy for the Protection of Human Subjects or the
human subject protection requirements of the FDA.
 Information used only for public health activities and purposes as described in 45 C.F.R. s.
164.512.
 Personal information collected, processed, sold, or disclosed pursuant to the federal Fair Credit
Reporting Act, 15 U.S.C. s. 1681 and implementing regulations.
 Nonpublic personal information collected, processed, sold, or disclosed pursuant to the Gramm -
Leach-Bliley Act, 15 U.S.C. s. 6801 et seq. and implementing regulations.
 A financial institution as defined in the Gramm-Leach-Bliley Act, 15 U.S.C. s. 6801 et seq. to the
extent the financial institution maintains personal information in the same manner as nonpublic
personal information, and as long as such financial institution does not use personal information
for targeted advertising in conjunction with third parties and does not sell or share personal
information to a third party unless such sale or sharing is covered by an exception.
 Personal information collected, processed, sold, or disclosed pursuant to the federal Driver's
Privacy Protection Act of 1994, 18 U.S.C. s. 2721 et. seq.
 Education information covered by the Family Educational Rights and Privacy Act, 20 U.S.C. s.
1232(g) and 34 C.F.R. part 99.

STORAGE NAME: h0009.COM PAGE: 12
DATE: 2/9/2022
 Information collected as part of public or peer-reviewed scientific or statistical research in the
public interest.

Definitions

The bill includes the following definitions:
 “Aggregate consumer information”.
 "Biometric information".
 "Collect".
 "Consumer" means a natural person who resides in or is domiciled in this state, however
identified, including by any unique identifier.
 "Controller", which means:
o A sole proprietorship, partnership, limited liability company, corporation, association, or
legal entity that meets the following requirements:
 Is organized or operated for the profit or financial benefit of its shareholders or
owners;
 Does business in this state;
 Collects personal information about consumers, or is the entity on behalf of
which such information is collected;
 Determines the purposes and means of processing personal information about
consumers alone or jointly with others; and
 Satisfies two or more of the following thresholds:
 Has global annual gross revenues in excess of $25 million, as adjusted in
January of every odd-numbered year to reflect any increase in the
Consumer Price Index.
 Annually buys, receives, sells, or shares the personal information of
50,000 or more consumers, households, and devices for targeted
advertising in conjunction with third parties or that is not covered by an
exception.
 Derives 50 percent or more of its global annual revenues from selling or
sharing personal information about consumers.
o Any entity that controls or is controlled by controller. As used in this definition, the term
“control” means:
 Ownership of, or the power to vote, more than 50 percent of the outstanding
shares of any class of voting security of a controller;
 Control in any manner over the election of a majority of the directors, or of
individuals exercising similar functions; or
 The power to exercise a controlling influence over the management of a
company.
 “Deidentified”.
 “Department”.
 “Device”.
 “Homepage”.
 “Household”.
 "Personal information", which means information that is linked or reasonably linkable to an
identified or identifiable consumer or household, including biometric information and unique
identifiers to the consumer. The term does not include consumer information that is :
o Publicly and lawfully made available.
o Deidentified or aggregate consumer information.
o Employment information.
 “Processing”.
 "Processor", which means a sole proprietorship, partnership, limited liability company,
corporation, association, or other legal entity that is organized or operated for the profit or
financial benefit of its shareholders or other owners, that processes information on behalf of a
controller and to which the controller discloses a consumer's personal information pursuant to a
written contract, provided that the contract prohibits the entity receiving the information from
STORAGE NAME: h0009.COM PAGE: 13
DATE: 2/9/2022
retaining, using, or disclosing the personal information for any purpose other than for the
specific purpose of performing the services specified in the contract for the controller, or as
otherwise permitted.
 "Sell", which means to sell, rent, release, disclose, disseminate, make available, transfer, or
otherwise communicate orally, in writing, or by electronic or other means, a consumer's
personal information by a controller to another controller or a third party for monetary or other
valuable consideration.
 "Share", which means to share, rent, release, disclose, disseminate, make available, transfer, or
access a consumer's personal information for advertising. The term includes:
o Allowing a third party to use or advertise to a consumer based on a consumer's personal
information without disclosure of the personal information to the third party.
o Monetary transactions, nonmonetary transactions, and transactions for other valuable
consideration between a controller and a third party for advertising for the benefit of a
controller.
 “Targeted advertising”.
 "Third party".
 "Verifiable consumer request".

Consumer Data Collection Requirements and Responsibilities

The bill requires a controller that collects personal information about consumers to maintain an online
privacy policy, make such policy available from its homepage. The online privacy policy must include
the following information:
 Any Florida-specific consumer privacy rights.
 A list of the categories of personal information the controller collects or has collected about
consumers.
 The right to request deletion or correction of certain personal information.
 The right to opt-out of the sale or sharing to third parties.

The bill requires a controller that collects personal information to, at or before the point of collection,
inform consumers of the categories of personal information to be collected and the purposes for which
the categories of personal information will be used.

The bill provides that a controller may not collect additional categories of personal information or use
personal information collected for additional purposes without providing the consumer with notice
consistent with the requirements of the bill.

The bill provides that a controller that collects a consumer's personal information must implement and
maintain reasonable security procedures and practices appropriate to the nature of the personal
information to protect the personal information from unauthorized or illegal access, destruction, use,
modification, or disclosure. A controller must require any processors and third parties to implement and
maintain the same or similar security procedures and practices for personal information.

The bill requires a controller to adopt and implement a retention schedule that prohibits the use or
retention of personal information by the controller or processor: after the satisfaction of the initial
purpose for which such information was collected or obtained; after the expiration or termination of the
contract pursuant to which the information was collected or obtained; or 3 years after the consumer's
last interaction with the controller. The required retention schedule does not apply to personal
information used or retained for the following purposes:
• Detection of security threats or incidents; protection against malicious, deceptive, fraudulent,
unauthorized, or illegal activity or access; or prosecution of those responsible for such activity
or access.
• Compliance with a legal obligation, including any federal retention laws.
• As reasonably needed for the protection of the controller's interests related to existing disputes,
legal action, or governmental investigations.
• Assuring the physical security of persons or property.

STORAGE NAME: h0009.COM PAGE: 14
DATE: 2/9/2022
Consumer Right to Request a Copy of Personal Information Collected, Sold, or Shared

The bill provides that a consumer has the right to request that a controller that collects personal
information about the consumer disclose the personal information that has been collected, sold, or
shared by or on behalf of the controller.

The bill provides that a consumer has the right to request that a controller that collects, sells, or shares
personal information about the consumer to disclose the following to the consumer:
• The specific pieces of personal information that have been collected about the consumer.
• The sources from which the consumer's personal information was collected.
• The specific pieces of personal information about the consumer that were sold or shared.
• The third parties to which the personal information about the consumer was sold or shared.
• The categories of personal information about the consumer that were disclosed to a processor.

The bill requires a controller that collects, sells, or shares personal information about consumers to
disclose the requested information to the consumer upon receipt of a verifiable consumer request.

The bill does not require a controller to retain, reidentify, or otherwise link any data that, in the ordinary
course of business is not maintained in a manner that would be considered personal information.

The bill requires a controller to deliver the information required or act on a verifiable consumer request
to a consumer free of charge within 45 days after receiving a verifiable consumer request. The
response period may be extended once by 45 additional days when reasonably necessary, provided
the controller informs the consumer of any such extension within the initial 45-day response period and
the reason for the extension. The information must be delivered in a readily usable format. A controller
is not obligated to provide information to the consumer if the consumer or a person authorized to act on
the consumer's behalf does not provide verification of identity or verification of authorization to act with
the permission of the consumer.

A controller may provide personal information to a consumer at any time, but may not be required to
provide personal information to a consumer more than twice in a 12-month period.

Such requirements to disclose information do not apply to personal information relating solely to
households.

Consumer Right to Correct or Delete Personal Information

The bill provides that consumer has the right to request that a controller delete any personal
information about the consumer which the controller has collected from the consumer.

The bill requires a controller that receives a verifiable consumer request to delete the consumer's
personal information to delete the consumer's personal information from its records and direct any
processors to delete such information within 90 days of receipt of the verifiable consumer request.

A controller or a processor acting pursuant to its contract with the controller may not be required to
comply with a consumer's request to delete the consumer's personal information if it is reasonably
necessary for the controller or processor to maintain the consumer's personal information to do any of
the following:
 Complete the transaction for which the personal information was collected.
 Fulfill the terms of a written warranty or product recall conducted in accordance with federal law.
 Provide a good or service requested by the consumer, or reasonably anticipated to be
requested within the context of a controller's ongoing business relationship with the consumer,
or otherwise perform a contract between the controller and the consumer.
 Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or
prosecute those responsible for that activity.
 Debug to identify and repair errors that impair existing intended functionality.

STORAGE NAME: h0009.COM PAGE: 15
DATE: 2/9/2022
 Engage in public or peer-reviewed scientific, historical, or statistical research in the public
interest that adheres to all other applicable ethics and privacy laws when the controller's
deletion of the information is likely to render impossible or seriously impair the achievement of
such research, if the consumer has provided informed consent.
 Enable solely internal uses that are reasonably aligned with the expectations of the consumer
based on the consumer's relationship with the controller or that are compatible with the context
in which the consumer provided the information.
 Comply with a legal obligation, including any state or federal retention laws.
 Reasonably protect the controller's interests against existing disputes, legal action, or
governmental investigations.
 Internally use the consumer's personal information in a lawful manner.

The bill allows a consumer to make a request to correct inaccurate personal information to a controller
that maintains inaccurate personal information about the consumer. A controller that receives a
verifiable consumer request to correct inaccurate personal information must use commercially
reasonable efforts to correct the inaccurate personal information as directed by the consumer and
direct any processors to correct such information within 90 days after receipt of the verifiable consumer
request. If a controller maintains a self-service mechanism to allow a consumer to correct certain
personal information, the controller may require the consumer to correct their own personal information
through such mechanism.

Consumer Right to Opt-Out of the Sale or Sharing of Personal Information

The bill provides that a consumer has the right at any time to direct a controller that sells or shares
personal information about the consumer to third parties to not sell or share the consumer's personal
information. This right may be referred to as the right to opt-out.

The bill requires that a controller that sells or shares personal information to third parties to provide
notice to consumers that this information may be sold and shared and that consumers have the right to
opt-out of the sale or sharing of their personal information.

The bill provides that a controller may not sell or share the personal information of a minor consumer if
the controller has actual knowledge that the consumer is not 16 years of age or older. However, if a
consumer who is between 13 and 16 years of age, or if the parent or guardian of a consumer who is 12
years of age or younger, has affirmatively authorized the sale or sharing of such consumer's personal
information, then a controller may sell or share such information. A controller that willfully disregards
the consumer's age is deemed to have actual knowledge of the consumer's age. A controller that
complies with the verifiable parental consent requirements of COPPA is deemed compliant with any
obligation to obtain parental consent.

The bill provides that a controller that has received direction prohibiting the sale or sharing of the
consumer's personal information is prohibited from selling or sharing the consumer's personal
information beginning 48 hours after receipt of such direction, unless the consumer subsequently
provides express authorization for the sale or sharing of the consumer's personal information.

Form to Opt-Out of the Sale or Sharing of Personal Information

The bill requires a controller, in a reasonably accessible format, to provide a clear and conspicuous link
on the controller's Internet homepage, entitled "Do Not Sell or Share My Personal Information," to an
Internet webpage that enables a consumer, or a person authorized by the consumer, to opt-out of the
sale or sharing of the consumer's personal information. A controller may not require a consumer to
create an account in order to direct the controller not to sell the consumer's personal information.

A controller may accept a request to opt-out received through a user-enabled global privacy control,
such as a browser plug-in or privacy setting, device setting, or other mechanism, which communicates
or signals the consumer's choice to opt out.

STORAGE NAME: h0009.COM PAGE: 16
DATE: 2/9/2022
A controller must respect the consumer's decision to opt-out for at least 12 months before requesting
that the consumer authorize the sale or sharing of the consumer's personal information.

A controller may not use any personal information collected from the consumer in connection with the
submission of the consumer's opt-out request solely for the purposes of complying with the opt-out
request.

The bill allows a consumer to authorize another person to opt-out of the sale or sharing of the
consumer's personal information on the consumer's behalf, and a controller must comply with an opt-
out request received from a person authorized by the consumer to act on the consumer's behalf,
pursuant to rules adopted by DLA.

Actions Related to Consumers Who Exercise Their Rights

The bill allows a controller to charge a consumer who exercised any of the consumer's rights a different
price or rate, or provide a different level or quality of goods or services to the consumer, but only if that
difference is:
 Reasonably related to the value provided to the controller by the consumer's data, or
 Related to a consumer's voluntary participation in a financial incentive program, including a
bona fide loyalty, rewards, premium features, discounts, or club card program offered by the
controller.

A controller may offer financial incentives, including payments to consumers as compensation, for the
collection, sharing, sale, or deletion of personal information if the consumer gives the controller prior
consent that clearly describes the material terms of the financial incentive program. The consent may
be revoked by the consumer at any time.

The bill prohibits a controller from using financial incentive practices that are unjust, unreasonable,
coercive, or usurious in nature.

Contracts and Roles

The bill requires that any contract between a controller and a processor must:
• Prohibit the processor from selling, sharing, retaining, using, or disclosing the personal
information other than for the purposes specified in the contract or agreement with the
controller;
• Govern the processor's personal information processing procedures with respect to processing
performed on behalf of the controller, including processing instructions, the nature and purpose
of processing, the type of information subject to processing, the duration of processing, and the
rights and obligations of both the controller and processor;
• Require the processor to return or delete all personal information under the contract to the
controller as requested by the controller at the end of the provision of services, unless retention
of the information is required by law; and
• Upon request of the controller, require the processor to make available to the controller all
information in its possession under the contract or agreement.

The bill provides that determining whether a person is acting as a controller or processor with respect
to a specific processing of data is fact-based and depends upon the context in which personal
information is to be processed. The contract between a controller and processor must reflect their
respective roles and relationships related to handling personal information. A processor that continues
to adhere to a controller's instructions with respect to a specific processing of personal information
remains a processor.

The bill provides that a third party may not sell or share personal information about a consumer that
has been sold or shared to the third party by a controller unless the consumer has received explicit
notice from the third party and is provided an opportunity to opt-out by the third party.

STORAGE NAME: h0009.COM PAGE: 17
DATE: 2/9/2022
The bill requires a third party or a processor to require any subcontractor to meet the same obligations
of such third party or processor with respect to personal information.

Any provision of a contract or agreement that waives or limits in any way a consumer's rights under the
bill, including, but not limited to, any right to a remedy or means of enforcement, is deemed contrary to
public policy and is void and unenforceable.

Private Causes of Action

The bill allows a Florida consumer to bring a civil action against a controller, processor, or person for
the following:
• Failure to delete or correct a consumer’s personal information after receiving a verifiable
consumer request, unless the controller qualifies for an exception to requirements to delete or
correct;
 Continuing to sell or share a consumer’s personal information after the consumer chooses to
opt-out; or
 Selling or sharing the personal information of a consumer age 16 or younger without obtaining
required consent.

The bill allows a court to grant the following relief to a consumer:
 Damages in an amount not less than $100 and not greater than $750 per consumer per
incident, or actual damages, whichever is greater.
 Injunctive or declaratory relief.
 Upon prevailing in a civil action, the consumer may recover reasonable attorney’s fees and
costs.

Except as authorized under the private cause of action or the DLA enforcement provisions , liability for a
tort, contract claim, or consumer protection claim does not arise solely from the failure of a controller,
processor, or person to comply with the bill. Evidence of such may only be used as the basis to prove a
cause of action under the bill.

Enforcement and Implementation

The bill provides that if DLA has reason to believe that any controller, processor, or person is in
violation of the requirements of the bill, DLA may bring an action against such controller, processor, or
person for an unfair or deceptive act or practice under FDUTPA. A consumer may not bring an action
under FDUTPA under the bill. DLA is permitted to bring an action against:
• Any person or activity regulated under laws administered by the Office of Insurance Regulation
or the Department of Financial Services; and
• Banks, credit unions, and savings and loan associations regulated by the Office of Financial
Regulation or federal agencies.

Civil penalties may be tripled if the violation involves a consumer who the controller, processor or
person has actual knowledge is 16 years of age or younger, or if the basis of the complaint is one of the
instances where an individual consumer may bring a private cause of action.

After the DLA has notified a controller, processor, or person in writing of an alleged violation, the DLA
may, in its discretion, grant the controller, processor, or person a 45-day period to cure the alleged
violation. The DLA may consider the number of violations, the substantial likelihood of injury to the
public, or the safety of persons or property when determining whether to grant 45 days to cure. If the
controller, processor, or person cures the alleged violation to the satisfaction of the DLA and provides
proof to the DLA, the DLA may issue a letter of guidance. If the controller, processor, or person fails to
cure the violation to the satisfaction of the DLA within 45 days, the DLA may bring an action against the
controller, processor, or person for the alleged violation.

The bill clarifies that any action brought by DLA may only be brought by or on behalf of a Florida
consumer.
STORAGE NAME: h0009.COM PAGE: 18
DATE: 2/9/2022
DLA may adopt rules to implement the bill, including standards for verifiable consumer requests,
enforcement, data security, and authorized persons who may act on a consumer's behalf.

The bill requires DLA to submit a report by February 1 each year to the President of the Senate and the
Speaker of the House of Representatives describing any actions taken by DLA to enforce the bill. The
report must include statistics and relevant information detailing:
 The number of complaints received;
 The number and type of enforcement actions taken and the outcomes of such actions;
 The number of complaints resolved without the need for litigation; and
 The status of the development and implementation of rules to implement the bill.

Jurisdiction

For purposes of bringing an action under the bill, any controller that collects, shares, or sells the
personal information of a Florida consumer, is considered to be both engaged in substantial and not
isolated activities within this state, and is operating, conducting, engaging in, or carrying on a business,
and doing business in this state, and is therefore subject to the jurisdiction of Florida courts.

Preemption

The bill provides that consumer data privacy is a matter of statewide concern and he bill supersedes all
rules, regulations, codes, ordinances, and other laws adopted by a city, county, city and county,
municipality, or local agency regarding the collection, processing, sharing, or sale of consumer
personal information by a controller or processor. The regulation of the collection, processing, sharing,
or sale of consumer personal information by a controller or processor is preempted to the state.

Florida Information Protection Act – Current Situation

In 2014, Florida passed the Florida Information Protection Act (FIPA). 65 FIPA requires commercial
covered entities 66 and government entities which hold personal information to take reasonable
measures to protect such information and report data breaches to affected consumers.67

FIPA defines “personal information” as:
 Online account information, such as security questions and answers, email addresses and
passwords;
 An individual’s first name or first initial and last name in combination with any one or more of the
following:
o A social security number;
o A driver license or similar identity verification number issued on a government
document;
o A financial account number or credit or debit card number, in combination with any
required security code, access code, or password that is necessary to permit access to
an individual’s financial account;
o Any medical history information; or
o An individual’s health insurance identification numbers.68

Personal information does not include information:
 About an individual that has been made publicly available by a federal, state, or local
governmental entity; or

65 S. 501.171, F.S.; Fla. SB 1524 (2014) (FIPA expanded and updated Florida’s data breach disclosure laws contained in s. 817.56 81,

F.S. (2013), which was adopted in 2005 and repealed in 2014.)
66 “Covered entity” means a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other com mercial

entity that acquires, maintains, stores, or uses personal information. S. 501.171(1)(b), F.S.
67 Florida Office of the Attorney General, How to Protect Yourself: Data Security,

http://myfloridalegal.com/pages.nsf/Main/53D4216591361BCD85257F77004BE16C (last visited Jan. 28, 2022).
68 Id.; S. 501.171(1)(g)1., F.S.

STORAGE NAME: h0009.COM PAGE: 19
DATE: 2/9/2022
 That is encrypted, secured, or modified to remove elements that personally identify an individual
or that otherwise renders the information unusable.69

If a breach of personal information occurs, notice must be given to each individual in this state whose
personal information was accessed as a result of the breach. If the breach affected 500 or more
individuals in this state, the covered entity must also provide notice to the Department of Legal Affairs
(DLA). If the breach affected more than 1,000 individuals at a single time, credit reporting agencies
must be notified of such breach, with certain exceptions. 70

FIPA expressly does not provide a private cause of action, but does authorize enforcement actions by
DLA under Florida’s Unfair and Deceptive Trade Practices Act (FDUTPA) against covered entities for
any statutory violations.71

In addition to the remedies provided for under FDUTPA, a covered entity that fails to notify DLA, or an
individual whose personal information was accessed, of the data breach is liable for a civil penalty not
to exceed $500,000:
 In the amount of $1,000 for each day up to the first 30 days following any violation, thereafter,
$50,000 for each subsequent 30-day period or portion thereof for up to 180 days.
 If the violation continues for more than 180 days, in an amount not to exceed $500,000.

The civil penalties for failure to notify apply per breach and not per individual affected by the breach.

Florida Information Protection Act – Effect of the Bill

The bill defines “Biometric data” as an individual's physiological, biological, or behavioral
characteristics, including an individual's deoxyribonucleic acid (DNA), that can be used, singly or in
combination with each other or with other identifying data, to establish individual identity. The term
includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and
voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a
voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep,
health, or exercise data that contain identifying information.

The bill includes biometric data in FIPA’s definition of “personal information” so that covered entities are
required to notify the affected individual, the DLA, and credit reporting agencies of a breach of biometric
information paired with an individual’s first name or first initial and last name.

The bill allows DLA to bring a FDUTPA action against a covered entity which fails to notify DLA of or an
individual affected by a breach of biometric information.

The bill provides an effective date of July 1, 2023.

B. SECTION DIRECTORY:
Section 1: Creates s. 501.173, F.S., relating to consumer data privacy rights and requirements.
Section 2: Amends s. 501.171, F.S.; relating to FIPA and triggering requirements.
Section 3: Provides an effective date.

II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT

A. FISCAL IMPACT ON STATE GOVERNMENT:

1. Revenues:
There may be an increase in civil penalties collected by DLA.

69 S. 501.171(1)(g)2., F.S.
70 S. 501.171(3)-(6), F.S.
71 S. 501.171(9), (10), F.S.; OAG supra note 66.

STORAGE NAME: h0009.COM PAGE: 20
DATE: 2/9/2022
2. Expenditures:
There may be an increase of regulatory costs to DLA from implementing and enforcing the bill.

B. FISCAL IMPACT ON LOCAL GOVERNMENTS:

1. Revenues:
None.

2. Expenditures:
None.

C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
The bill will require certain businesses in possession of personal information to implement mechanisms
to effectuate the requirements of the bill, and such implementation will have a fiscal impact on such
businesses. However, many of the businesses subject to the bill’s requirements have already
implemented similar privacy practices based on protections required in other states and countries.

It may increase protections provided for personal information that may save consumers the expense of
dealing with stolen personal information used to commit financial crimes. Some 15 million consumers
are victims of identity theft or fraud a year. Identity theft and fraud costs consumers more than $15
billion a year.

D. FISCAL COMMENTS:
None.

III. COMMENTS

A. CONSTITUTIONAL ISSUES:

1. Applicability of Municipality/County Mandates Provision:
Not applicable. This bill does not appear to affect county or municipal governments.

2. Other:
None.

B. RULE-MAKING AUTHORITY:
DLA is given rulemaking authority in the bill to implement the bill.

C. DRAFTING ISSUES OR OTHER COMMENTS:
None.

IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES

STORAGE NAME: h0009.COM PAGE: 21
DATE: 2/9/2022
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

1 A bill to be entitled
2 An act relating to consumer data privacy; creating s.
3 501.173, F.S.; providing applicability; providing
4 definitions; requiring controllers that collect a
5 consumer's personal data to disclose certain
6 information regarding data collection and selling
7 practices to the consumer at or before the point of
8 collection; specifying that such information may be
9 provided through a general privacy policy or through a
10 notice informing the consumer that additional specific
11 information will be provided upon a certain request;
12 prohibiting controllers from collecting additional
13 categories of personal information or using personal
14 information for additional purposes without notifying
15 the consumer; requiring controllers that collect
16 personal information to implement reasonable security
17 procedures and practices to protect the information;
18 authorizing consumers to request controllers to
19 disclose the specific personal information the
20 controller has collected about the consumer; requiring
21 controllers to make available two or more methods for
22 consumers to request their personal information;
23 requiring controllers to provide such information free
24 of charge within a certain timeframe and in a certain
25 format upon receiving a verifiable consumer request;

Page 1 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

26 specifying requirements for third parties with respect
27 to consumer information acquired or used; providing
28 construction; authorizing consumers to request
29 controllers to delete or correct personal information
30 the controllers have collected about the consumers;
31 providing exceptions; specifying requirements for
32 controllers to comply with deletion or correction
33 requests; authorizing consumers to opt out of third -
34 party disclosure of personal information collected by
35 a controller; prohibiting controllers from selling or
36 disclosing the personal information of consumers
37 younger than a certain age, except under certain
38 circumstances; prohibiting controllers from selling or
39 sharing a consumer's information if the consumer has
40 opted out of such disclosure; prohibiting controllers
41 from taking certain actions to retaliate against
42 consumers who exercise certain rights; providing
43 applicability; providing that a contract or agreement
44 that waives or limits certain consumer rights is void
45 and unenforceable; providing for civil actions and a
46 private right of action for consumers under certain
47 circumstances; providing civil remedies; authorizing
48 the Department of Legal Affairs to bring an action
49 under the Florida Unfair or Deceptive Trade Practices
50 Act and to adopt rules; requiring the department to

Page 2 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

51 submit an annual report to the Legislature; providing
52 report requirements; providing that controllers must
53 have a specified timeframe to cure any violations;
54 providing jurisdiction; declaring that the act is
55 matter of statewide concern; preempting the
56 collection, processing, sharing, and sale of consumer
57 personal information to the state; amending s.
58 501.171, F.S.; revising the definition of "personal
59 information"; providing an effective date.
60
61 Be It Enacted by the Legislature of the State of Florida:
62
63 Section 1. Section 501.173, Florida Statutes, is created
64 to read:
65 501.173 Consumer data privacy.—
66 (1) APPLICABILITY.—This section does not apply to:
67 (a) Personal information collected and transmitted that is
68 necessary for the sole purpose of sharing such personal
69 information with a financial service provider to facilitate
70 short term, transactional payment processing for the purchase of
71 products or services.
72 (b) Personal information collected, used, retained, sold,
73 shared, or disclosed as deidentified personal information or
74 aggregate consumer information.
75 (c) Compliance with federal, state, or local laws.

Page 3 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

76 (d) Compliance with a civil, criminal, or regulatory
77 inquiry, investigation, subpoena, or summons by federal, state,
78 or local authorities.
79 (e) Cooperation with law enforcement agencies concerning
80 conduct or activity that the controller, processor, or third
81 party reasonably and in good faith believes may violate federal,
82 state, or local law.
83 (f) Exercising legal rights or privileges.
84 (g) Personal information used or collected by a controller
85 or processor pursuant to a written contract between the
86 controller and processor that complies with the requirements of
87 this section.
88 (h) Personal information used by a controller or processor
89 to advertise or market products or services that are produced or
90 offered directly by the controller or processor. Such
91 information may not be sold, shared, or disclosed to another
92 person unless otherwise authorized under this section.
93 (i) Personal information of a person acting in the role of
94 a job applicant, employee, owner, director, officer, contractor,
95 volunteer, or intern of a controller, that is collected by a
96 controller, to the extent the personal information is collected
97 and used solely within the context of the person's role or
98 former role with the controller.
99 (j) Protected health information for purposes of the
100 federal Health Insurance Portability and Accountability Act of

Page 4 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

101 1996 and related regulations, and patient identifying
102 information for purposes of 42 C.F.R. part 2, established
103 pursuant to 42 U.S.C. s. 290dd-2.
104 (k) A covered entity or business associate governed by the
105 privacy, security, and breach notification rules issued by the
106 United States Department of Health and Human Services in 45
107 C.F.R. parts 160 and 164, or a program or a qualified service
108 program as defined in 42 C.F.R. part 2, to the extent the
109 covered entity, business associate, or program maintains
110 personal information in the same manner as medical information
111 or protected health information as described in paragraph (j),
112 and as long as the covered entity, business associate, or
113 program does not use personal information for targeted
114 advertising with third parties and does not sell or share
115 personal information to a third party unless such sale or
116 sharing is covered by an exception under this section.
117 (l) Identifiable private information collected for
118 purposes of research as defined in 45 C.F.R. s. 164.501
119 conducted in accordance with the Federal Policy for the
120 Protection of Human Subjects for purposes of 45 C.F.R. part 46,
121 the good clinical practice guidelines issued by the
122 International Council for Harmonisation of Technical
123 Requirements for Pharmaceuticals for Human Use, or the
124 Protection for Human Subjects for purposes of 21 C.F.R. parts 50
125 and 56, or personal information that is used or shared in

Page 5 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

126 research conducted in accordance with one or more of these
127 standards.
128 (m) Information and documents created for purposes of the
129 federal Health Care Quality Improvement Act of 1986 and related
130 regulations, or patient safety work product for purposes of 42
131 C.F.R. part 3, established pursuant to 42 U.S.C. s. 299b -21
132 through 299b-26.
133 (n) Information that is deidentified in accordance with 45
134 C.F.R. part 164 and derived from individually identifiable
135 health information as described in the Health Insurance
136 Portability and Accountability Act of 1996, or identifiable
137 personal information, consistent with the Federal Policy for the
138 Protection of Human Subjects or the human subject protection
139 requirements of the United States Food and Drug Administration.
140 (o) Information used only for public health activities and
141 purposes as described in 45 C.F.R. s. 164.512.
142 (p) Personal information collected, processed, sold, or
143 disclosed pursuant to the federal Fair Credit Reporting Act, 15
144 U.S.C. s. 1681 and implementing regulations.
145 (q) Nonpublic personal information collected, processed,
146 sold, or disclosed pursuant to the Gramm-Leach-Bliley Act, 15
147 U.S.C. s. 6801 et seq., and implementing regulations.
148 (r) A financial institution as defined in the Gramm-Leach-
149 Bliley Act, 15 U.S.C. s. 6801 et seq., to the extent the
150 financial institution maintains personal information in the same

Page 6 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

151 manner as nonpublic personal information as described in
152 paragraph (q), and as long as such financial institution does
153 not use personal information for targeted advertising with third
154 parties and does not sell or share personal information to a
155 third party unless such sale or sharing is covered by an
156 exception under this section.
157 (s) Personal information collected, processed, sold, or
158 disclosed pursuant to the federal Driver's Privacy Protection
159 Act of 1994, 18 U.S.C. s. 2721 et seq.
160 (t) Education information covered by the Family
161 Educational Rights and Privacy Act, 20 U.S.C. s. 1232(g) and 34
162 C.F.R. part 99.
163 (u) Information collected as part of public or peer-
164 reviewed scientific or statistical research in the public
165 interest and that adheres to all other applicable ethics and
166 privacy laws, if the consumer has provided informed consent.
167 Research with personal information must be subjected by the
168 controller conducting the research to additional security
169 controls that limit access to the research data to only those
170 individuals necessary to carry out the research purpose and
171 subsequently deidentified.
172 (v) Personal information disclosed for the purpose of
173 responding to an alert of a present risk of harm to a person or
174 property, detecting security incidents, protecting against
175 malicious, deceptive, fraudulent, or illegal activity, or

Page 7 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

176 prosecuting those responsible for that activity.
177 (w) Personal information that is disclosed when a consumer
178 uses or directs a controller to intentionally disclose
179 information to a third party or uses the controller to
180 intentionally interact with a third party. An intentional
181 interaction occurs when the consumer intends to interact with
182 the third party, by one or more deliberate interactions.
183 Hovering over, muting, pausing, or closing a given piece of
184 content does not constitute a consumer's intent to interact with
185 a third party.
186 (x) An identifier used for a consumer who has opted out of
187 the sale or sharing of the consumer's personal information for
188 the sole purpose of alerting processors and third parties that
189 the consumer has opted out of the sale or sharing o f the
190 consumer's personal information.
191 (y) Personal information transferred by a controller to a
192 third party as an asset that is part of a merger, acquisition,
193 bankruptcy, or other transaction in which the third party
194 assumes control of all or part of the controller, provided that
195 information is used or shared consistently with this section. If
196 a third party materially alters how it uses or shares the
197 personal information of a consumer in a manner that is
198 materially inconsistent with the commitments or promises made at
199 the time of collection, it shall provide prior notice of the new
200 or changed practice to the consumer. The notice must be

Page 8 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

201 sufficiently prominent and robust to ensure that consumers can
202 easily exercise choices consistent with this section.
203 (2) DEFINITIONS.—As used in this section, the term:
204 (a) "Aggregate consumer information" means information
205 that relates to a group or category of consumers, from which the
206 identity of an individual consumer has been removed and is not
207 reasonably capable of being directly or indirectly associated or
208 linked with, any consumer, household, or device. The term does
209 not include personal information that has been deidentified.
210 (b) "Biometric information" means an individual's
211 physiological, biological, or behavioral characteristics,
212 including an individual's deoxyribonucleic acid (DNA), that can
213 be used, singly or in combination with each other or with other
214 identifying data, to establish individual identity. The term
215 includes, but is not limited to, imagery of the iris, retina,
216 fingerprint, face, hand, palm, vein patterns, and voice
217 recordings, from which an identifier template, such as a
218 faceprint, a minutiae template, or a voiceprint, can be
219 extracted, and keystroke patterns or rhythms, gait patterns or
220 rhythms, and sleep, health, or exercise data that contain
221 identifying information.
222 (c) "Collect" means to buy, rent, gather, obtain, receive,
223 or access any personal information pertaining to a consumer by
224 any means. The term includes, but is not limited to, ac tively or
225 passively receiving information from the consumer or by

Page 9 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

226 observing the consumer's behavior or actions.
227 (d) "Consumer" means a natural person who resides in or is
228 domiciled in this state, however identified, including by any
229 unique identifier, who is acting in a personal capacity or
230 household context. The term does not include a natural person
231 acting on behalf of a legal entity in a commercial or employment
232 context.
233 (e) "Controller" means:
234 1. A sole proprietorship, partnership, limited liabili ty
235 company, corporation, association, or legal entity that meets
236 the following requirements:
237 a. Is organized or operated for the profit or financial
238 benefit of its shareholders or owners;
239 b. Does business in this state;
240 c. Collects personal information about consumers, or is
241 the entity on behalf of which such information is collected;
242 d. Determines the purposes and means of processing
243 personal information about consumers alone or jointly with
244 others; and
245 e. Satisfies at least two of the following thresholds:
246 (I) Has global annual gross revenues in excess of $50
247 million, as adjusted in January of every odd-numbered year to
248 reflect any increase in the Consumer Price Index.
249 (II) Annually buys, receives, sells, or shares the
250 personal information of 50,000 or more consumers, households, or

Page 10 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

251 devices for the purpose of targeted advertising in conjunction
252 with third parties or for a purpose that is not listed under
253 subsection (1).
254 (III) Derives 50 percent or more of its global annual
255 revenues from selling or sharing personal information about
256 consumers.
257 2. Any entity that controls or is controlled by a
258 controller. As used in this subparagraph, the term "control"
259 means:
260 a. Ownership of, or the power to vote, more than 50
261 percent of the outstanding shares of any class of voting
262 security of a controller;
263 b. Control in any manner over the election of a majority
264 of the directors, or of individuals exercising similar
265 functions; or
266 c. The power to exercise a controlling influence over the
267 management of a company.
268 (f) "Deidentified" means information that cannot
269 reasonably be used to infer information about or otherwise be
270 linked to a particular consumer, provided that the controller
271 that possesses the information:
272 1. Takes reasonable measures to ensure that the
273 information cannot be associated with a specific consumer;
274 2. Maintains and uses the information in deidentified form
275 and not to attempt to reidentify the information, except that

Page 11 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

276 the controller may attempt to reidentify the information solely
277 for the purpose of determining whether its deidentification
278 processes satisfy the requirements of this paragraph; and
279 3. Contractually obligates any recipients of the
280 information to comply with all the provisions of this paragraph
281 to avoid reidentifying such information.
282 (g) "Department" means the Department of Legal Affairs.
283 (h) "Device" means a physical object associated with a
284 consumer or household capable of directly or indirectly
285 connecting to the Internet.
286 (i) "Homepage" means the introductory page of an Internet
287 website and any Internet webpage where personal information is
288 collected. In the case of a mobile application, the homepage is
289 the application's platform page or download page, a link within
290 the application, such as the "About" or "Information"
291 application configurations, or settings page, and any other
292 location that allows consumers to review the notice required by
293 subsection (7), including, but not limited to, before
294 downloading the application.
295 (j) "Household" means a natural person or a group of
296 people in this state who reside at the same address, share a
297 common device or the same service provided by a controller, and
298 are identified by a controller as sharing the same group account
299 or unique identifier.
300 (k) "Personal information" means information that is

Page 12 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

301 linked or reasonably linkable to an identified or identifiable
302 consumer or household, including biometric information and
303 unique identifiers to the consumer. The term does not include
304 consumer information that is:
305 1. Consumer employment contact information, including a
306 position name or title, employment qualifications, emergency
307 contact information, business telephone number, business
308 electronic mail address, employee benefit information, and
309 similar information used solely in an employment context.
310 2. Deidentified or aggregate consumer information.
311 3. Publicly and lawfully available information reasonably
312 believed to be made available to the public in a lawful manner
313 and without legal restrictions:
314 a. From federal, state, or local government records.
315 b. By a widely distributed media source.
316 c. By the consumer or by someone to whom the consumer
317 disclosed the information unless the consumer has p urposely and
318 effectively restricted the information to a certain audience on
319 a private account.
320 (l) "Processing" means any operation or set of operations
321 that are performed on personal information or on sets of
322 personal information, whether or not by automated means.
323 (m) "Processor" means a sole proprietorship, partnership,
324 limited liability company, corporation, association, or other
325 legal entity that is organized or operated for the profit or

Page 13 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

326 financial benefit of its shareholders or other owners, that
327 processes information on behalf of a controller and to which the
328 controller discloses a consumer's personal information pursuant
329 to a written contract, provided that the contract prohibits the
330 entity receiving the information from retaining, using, or
331 disclosing the personal information for any purpose other than
332 for the specific purpose of performing the services specified in
333 the contract for the controller, or as otherwise permitted by
334 this section.
335 (n) "Sell" means to sell, rent, release, disclose,
336 disseminate, make available, transfer, or otherwise communicate
337 orally, in writing, or by electronic or other means, a
338 consumer's personal information by a controller to another
339 controller or a third party for monetary or other valuable
340 consideration.
341 (o) "Share" means to share, rent, release, disclose,
342 disseminate, make available, transfer, or access a consumer's
343 personal information for advertising or marketing. The term
344 includes:
345 1. Allowing a third party to use or advertise or market to
346 a consumer based on a consumer's personal information without
347 disclosure of the personal information to the third party.
348 2. Monetary transactions, nonmonetary transactions, and
349 transactions for other valuable consideration between a
350 controller and a third party for advertising or marketing for

Page 14 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

351 the benefit of a controller.
352 (p) "Targeted advertising" means marketing to a consumer
353 or displaying an advertisement to a consumer when the
354 advertisement is selected based on personal information used to
355 predict such consumer's preferences or interests.
356 (q) "Third party" means a person who is not a controller
357 or processor.
358 (r) "Verifiable consumer request" means a request related
359 to personal information that is made by a consumer, by a parent
360 or guardian on behalf of a consumer who is a minor child, or by
361 a person authorized by the consumer to act on the consumer's
362 behalf in a form that is reasonably and readily accessible to
363 consumers and that the controller can reasonably verify to be
364 the consumer pursuant to rules adopted by the department.
365 (3) CONSUMER DATA COLLECTION REQUIREMENTS AND
366 RESPONSIBILITIES.—
367 (a) A controller that collects personal information about
368 consumers shall maintain an up-to-date online privacy policy and
369 make such policy available from its homepage. The online privacy
370 policy must include the following information:
371 1. Any Florida-specific consumer privacy rights.
372 2. A list of the types and categories of personal
373 information the controller collects, sells, or shares, or has
374 collected, sold, or shared, about consumers.
375 3. The consumer's right to request deletion or correction

Page 15 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

376 of certain personal information.
377 4. The consumer's right to opt-out of the sale or sharing
378 to third parties.
379 (b) A controller that collects personal information shall,
380 at or before the point of collection, inform, or direct the
381 processor to inform, consumers of the categories of personal
382 information to be collected and the purposes for which the
383 categories of personal information will be used.
384 (c) A controller may not collect additional categories of
385 personal information or use personal information collected for
386 additional purposes without providing the consumer with notice
387 consistent with this section.
388 (d) A controller that collects a consumer's personal
389 information shall implement and maintain reasonable security
390 procedures and practices appropriate to the nature of the
391 personal information to protect the personal information from
392 unauthorized or illegal access, destruction, use, modification,
393 or disclosure. A controller must require any processors and
394 third parties to implement and maintain the same or similar
395 security procedures and practices for personal information.
396 (e) A controller shall adopt and implement a retention
397 schedule that prohibits the use or retention of personal
398 information not subject to an exemption by the controller or
399 processor after the satisfaction of the initial purpose for
400 which such information was collected or obtained, after the

Page 16 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

401 expiration or termination of the contract pursuant to which the
402 information was collected or obtained, or 3 years after the
403 consumer's last interaction with the controller. This paragraph
404 does not apply to personal information used or retained for the
405 following purposes:
406 1. Detection of security threats or incidents; protection
407 against malicious, deceptive, fraudulent, unauthorized, or
408 illegal activity or access; or prosecution of those responsible
409 for such activity or access.
410 2. Compliance with a legal obligation, including any
411 federal retention laws.
412 3. As reasonably needed for the protection of the
413 controller's interests related to existing disputes, legal
414 action, or governmental investigations.
415 4. Assuring the physical security of persons or property.
416 (4) CONSUMER RIGHT TO REQUEST COPY OF PERSONAL DATA
417 COLLECTED, SOLD, OR SHARED.—
418 (a) A consumer has the right to request that a controller
419 that collects, sells, or shares personal information about the
420 consumer to disclose the following to the consumer:
421 1. The specific pieces of personal information that have
422 been collected about the consumer.
423 2. The sources from which the consumer's personal
424 information was collected.
425 3. The specific pieces of personal information about the

Page 17 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

426 consumer that were sold or shared.
427 4. The third parties to which the personal information
428 about the consumer was sold or shared.
429 5. The categories of personal information about the
430 consumer that were disclosed to a processor.
431 (b) A controller that collects, sells, or shares personal
432 information about a consumer shall disclose the information
433 specified in paragraph (a) to the consumer upon receipt of a
434 verifiable consumer request.
435 (c) This subsection does not require a controller to
436 retain, reidentify, or otherwise link any data that, in the
437 ordinary course of business is not maintained in a manner that
438 would be considered personal information.
439 (d) The controller shall deliver the information required
440 or act on the request in this subsection to a consumer free of
441 charge within 45 days after receiving a verifiable consumer
442 request. The response period may be extended once by 45
443 additional days when reasonably necessary, provided the
444 controller informs the consumer of any such extension within the
445 initial 45-day response period and the reason for the extension.
446 The information must be delivered in a readily usable format. A
447 controller is not obligated to provide information to the
448 consumer if the consumer or a person authorized to act on the
449 consumer's behalf does not provide verification of identity or
450 verification of authorization to act with the permission of the

Page 18 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

451 consumer.
452 (e) A controller may provide personal information to a
453 consumer at any time, but is not required to provide personal
454 information to a consumer more than twice in a 12-month period.
455 (f) This subsection does not apply to personal information
456 relating solely to households.
457 (5) RIGHT TO HAVE PERSONAL INFORMATION DELETED OR
458 CORRECTED.—
459 (a) A consumer has the right to request that a controller
460 delete any personal information about the consumer which the
461 controller has collected from the consumer.
462 (b) A controller that receives a verifiable consumer
463 request to delete the consumer's personal information shall
464 delete the consumer's personal information from its records and
465 direct any processors to delete such information within 90 days
466 of receipt of the verifiable consumer request.
467 (c) A controller or a processor acting pursuant to its
468 contract with the controller may not be required to comply with
469 a consumer's request to delete the consumer's personal
470 information if it is reasonably necessary for the controller or
471 processor to maintain the consumer's personal information to do
472 any of the following:
473 1. Complete the transaction for which the personal
474 information was collected.
475 2. Fulfill the terms of a written warranty or product

Page 19 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

476 recall conducted in accordance with federal law.
477 3. Provide a good or service requested by the consumer, or
478 reasonably anticipated to be requested within the context of a
479 controller's ongoing business relationship with the consumer , or
480 otherwise perform a contract between the controller and the
481 consumer.
482 4. Detect security incidents, protect against malicious,
483 deceptive, fraudulent, or illegal activity; or prosecute those
484 responsible for that activity.
485 5. Debug to identify and repair errors that impair
486 existing intended functionality.
487 6. Engage in public or peer-reviewed scientific,
488 historical, or statistical research in the public interest that
489 adheres to all other applicable ethics and privacy laws when the
490 controller's deletion of the information is likely to render
491 impossible or seriously impair the achievement of such research,
492 if the consumer has provided informed consent.
493 7. Enable solely internal uses that are reasonably aligned
494 with the expectations of the consumer based on the consumer's
495 relationship with the controller or that are compatible with the
496 context in which the consumer provided the information.
497 8. Comply with a legal obligation, including any state or
498 federal retention laws.
499 9. Reasonably protect the controller's interests against
500 existing disputes, legal action, or governmental investigations.

Page 20 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

501 10. Internally use the consumer's personal information in
502 a lawful manner.
503 (d) A consumer has the right to make a request to correct
504 inaccurate personal information to a controller that maintains
505 inaccurate personal information about the consumer. A controller
506 that receives a verifiable consumer request to correct
507 inaccurate personal information shall use commercially
508 reasonable efforts to correct the inaccurate personal
509 information as directed by the consumer and direct any
510 processors to correct such information within 90 days after
511 receipt of the verifiable consumer request. If a controller
512 maintains a self-service mechanism to allow a consumer to
513 correct certain personal information, the controller may require
514 the consumer to correct their own personal information through
515 such mechanism.
516 (6) RIGHT TO OPT-OUT OF THE SALE OR SHARING OF PERSONAL
517 INFORMATION.—
518 (a) A consumer has the right at any time to direc t a
519 controller not to sell or share the consumer's personal
520 information to a third party. This right may be referred to as
521 the right to opt-out.
522 (b) Notwithstanding paragraph (a), a controller may not
523 sell or share the personal information of a minor con sumer if
524 the controller has actual knowledge that the consumer is not 16
525 years of age or older. However, if a consumer who is between 13

Page 21 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

526 and 16 years of age, or if the parent or guardian of a consumer
527 who is 12 years of age or younger, has affirmatively au thorized
528 the sale or sharing of such consumer's personal information,
529 then a controller may sell or share such information in
530 accordance with this section. A controller that willfully
531 disregards the consumer's age is deemed to have actual knowledge
532 of the consumer's age. A controller that complies with the
533 verifiable parental consent requirements of the Children's
534 Online Privacy Protection Act, 15 U.S.C. s. 6501 et seq., shall
535 be deemed compliant with any obligation to obtain parental
536 consent.
537 (c) A controller that has received direction prohibiting
538 the sale or sharing of the consumer's personal information is
539 prohibited from selling or sharing the consumer's personal
540 information beginning 48 hours after receipt of such direction,
541 unless the consumer subsequently provides express authorization
542 for the sale or sharing of the consumer's personal information.
543 (7) FORM TO OPT-OUT OF SALE OR SHARING OF PERSONAL
544 INFORMATION.—
545 (a) A controller shall:
546 1. In a form that is reasonably accessible to consumers,
547 provide a clear and conspicuous link on the controller's
548 Internet homepage, entitled "Do Not Sell or Share My Personal
549 Information," to an Internet webpage that enables a consumer, or
550 a person authorized by the consumer, to opt-out of the sale or

Page 22 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

551 sharing of the consumer's personal information. A controller may
552 not require a consumer to create an account in order to direct
553 the controller not to sell the consumer's personal information.
554 A controller may accept a request to opt-out received through a
555 user-enabled global privacy control, such as a browser plug-in
556 or privacy setting, device setting, or other mechanism, which
557 communicates or signals the consumer's choice to opt out.
558 2. For consumers who opted-out of the sale or sharing of
559 their personal information, respect the consumer's decision to
560 opt-out for at least 12 months before requesting that the
561 consumer authorize the sale or sharing of the consumer's
562 personal information.
563 3. Use any personal information collected from the
564 consumer in connection with the submission of the consumer's
565 opt-out request solely for the purposes of complying with the
566 opt-out request.
567 (b) A consumer may authorize another person to opt -out of
568 the sale or sharing of the consumer's personal information on
569 the consumer's behalf pursuant to rules adopted by the
570 department.
571 (8) ACTIONS RELATED TO CONSUMERS WHO EXERCISE PRIVACY
572 RIGHTS.—
573 (a) A controller may charge a consumer who exercised any
574 of the consumer's rights under this section a different price or
575 rate, or provide a different level or quality of goods or

Page 23 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

576 services to the consumer, only if that difference is reasonably
577 related to the value provided to the controller by the
578 consumer's data or is related to a consumer's voluntary
579 participation in a financial incentive program, including a bona
580 fide loyalty, rewards, premium features, discounts, or club card
581 program offered by the controller.
582 (b) A controller may offer financial incentives, including
583 payments to consumers as compensation, for the collection,
584 sharing, sale, or deletion of personal information if the
585 consumer gives the controller prior consent that clearly
586 describes the material terms of the financial incentive program.
587 The consent may be revoked by the consumer at any time.
588 (c) A controller may not use financial incentive practices
589 that are unjust, unreasonable, coercive, or usurious in nature.
590 (9) CONTRACTS AND ROLES.—
591 (a) Any contract or agreement between a controller and a
592 processor must:
593 1. Prohibit the processor from selling, sharing,
594 retaining, using, or disclosing the personal information other
595 than for the purposes specified in the contract or agreement
596 with the controller;
597 2. Govern the processor's personal information processing
598 procedures with respect to processing performed on behalf of the
599 controller, including processing instructions, the nature and
600 purpose of processing, the type of information subject to

Page 24 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

601 processing, the duration of processing, and the rights and
602 obligations of both the controller and processor;
603 3. Require the processor to return or delete all personal
604 information under the contract to the controller as requested by
605 the controller at the end of the provision of services, unless
606 retention of the information is required by law; and
607 4. Upon request of the controller, require the processor
608 to make available to the controller all information in its
609 possession under the contract or agreement.
610 (b) Determining whether a person is acting as a controller
611 or processor with respect to a specific processing of data is a
612 fact-based determination that depends upon the context in which
613 personal information is to be processed. The contract between a
614 controller and processor must reflect their respective roles and
615 relationships related to handling personal information. A
616 processor that continues to adhere to a controller's
617 instructions with respect to a specific processing of personal
618 information remains a processor.
619 (c) A third party may not sell or share personal
620 information about a consumer that has been sold or shared to the
621 third party by a controller unless the consumer has received
622 explicit notice from the third party and is provided an
623 opportunity to opt-out by the third party.
624 (d) A processor or third party must require any
625 subcontractor to meet the same obligations of such processor or

Page 25 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

626 third party with respect to personal information.
627 (e) A processor or third party or any subcontractor
628 thereof who violates any of the restrictions imposed upon it
629 under this section is liable or responsible for any failure to
630 comply with this section.
631 (f) Any provision of a contract or agreement of any kind
632 that waives or limits in any way a consumer's rights under this
633 section, including, but not limited to, any right to a remedy or
634 means of enforcement, is deemed contrary to public policy and is
635 void and unenforceable. This section does not prevent a consumer
636 from declining to request information from a controller,
637 declining to opt-out of a controller's sale or sharing of the
638 consumer's personal information, or authorizing a controller to
639 sell or share the consumer's personal information after
640 previously opting out.
641 (10) CIVIL ACTIONS; PRIVATE RIGHT OF ACTION.—
642 (a) A Florida consumer may only bring a civil action
643 against a controller, processor, or person pursuant to this
644 section for the following:
645 1. Failure to delete or correct a consumer's personal
646 information pursuant to this section after receiving a
647 verifiable consumer request or directions to delete or correct
648 from a controller unless the controller, processor, or person
649 qualifies for an exception to the requirements to delete or
650 correct under this section.

Page 26 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

651 2. Continuing to sell or share a consumer's personal
652 information after the consumer chooses to opt-out pursuant to
653 this section.
654 3. Selling or sharing the personal information of a
655 consumer age 16 or younger without obtaining consent as required
656 by this section.
657 (b) A court may grant the following relief to a consumer:
658 1. Damages in an amount not less than $100 and not greater
659 than $750 per consumer per incident or actual damages, whichever
660 is greater.
661 2. Injunctive or declaratory relief.
662 (c) Upon prevailing, the consumer shall recover reasonable
663 attorney fees and costs.
664 (d) Any action under this subsection may only be brought
665 by or on behalf of a Florida consumer.
666 (e) Liability for a tort, contract claim, or consumer
667 protection claim which is unrelated to an action brought under
668 subsection (10) or subsection (11) does not arise solely from
669 the failure of a controller, processor, or person to comply with
670 this section and evidence of such may only be used as the basis
671 to prove a cause of action under this subsection.
672 (11) ENFORCEMENT AND IMPLEMENTATION BY THE DEPARTMENT. —
673 (a) Any violation of this section is an unfair and
674 deceptive trade practice actionable under part II of chapter 501
675 solely by the department against a controller, processor, or

Page 27 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

676 person. If the department has reason to believe that any
677 controller, processor, or person is in violation of this
678 section, the department, as the enforcement authority, may bring
679 an action against such controller, processor, or person for an
680 unfair or deceptive act or practice. For the purpose of bringing
681 an action pursuant to this section, ss. 501.211 and 501.212 do
682 not apply. Civil penalties may be tripled if the violation:
683 1. Involves a consumer who the controller, processor, or
684 person has actual knowledge is 16 years of age or younger; or
685 2. Is based on paragraph (10)(a).
686 (b) After the department has notified a controller,
687 processor, or person in writing of an alleged violation, the
688 department may in its discretion grant a 45-day period to cure
689 the alleged violation. The 45-day cure period does not apply to
690 a violation of subparagraph (10)(a)1. The department may
691 consider the number and frequency of violations, the substantial
692 likelihood of injury to the public, and the safety of persons or
693 property when determining whether to grant 45 days to cure and
694 the issuance of a letter of guidance. If the violation is cured
695 to the satisfaction of the department and proof of such cure is
696 provided to the department, the department in its discretion may
697 issue a letter of guidance. If the controller, processor, or
698 person fails to cure the violation within 45 days, the
699 department may bring an action against the controller,
700 processor, or person for the alleged violation.

Page 28 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

701 (c) Any action brought by the department may only be
702 brought by or on behalf of a Florida consumer.
703 (d) By February 1 of each year, the department shall
704 submit a report to the President of the Senate and the Speaker
705 of the House of Representatives describing any actions taken by
706 the department to enforce this section. The report shall include
707 statistics and relevant information detailing:
708 1. The number of complaints received;
709 2. The number and type of enforcement actions taken and
710 the outcomes of such actions;
711 3. The number of complaints resolved without the need for
712 litigation; and
713 4. The status of the development and implementation of
714 rules to implement this section.
715 (e) The department may adopt rules to implement this
716 section, including standards for verifiable consumer requests,
717 enforcement, data security, and authorized persons who may act
718 on a consumer's behalf.
719 (12) JURISDICTION.—For purposes of bringing an action in
720 accordance with subsections (10) and (11), any person who meets
721 the definition of controller as defined in this section that
722 collects, shares, or sells the personal information of Florida
723 consumers, is considered to be both engaged in substantial and
724 not isolated activities within this state and operating,
725 conducting, engaging in, or carrying on a business, and doing

Page 29 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

726 business in this state, and is therefore subject to the
727 jurisdiction of the courts of this state.
728 (13) PREEMPTION.—This section is a matter of statewide
729 concern and supersedes all rules, regulations, codes,
730 ordinances, and other laws adopted by a city, county, city and
731 county, municipality, or local agency regarding the collection,
732 processing, sharing, or sale of consumer personal information by
733 a controller or processor. The regulation of the collection,
734 processing, sharing, or sale of consumer personal information by
735 a controller or processor is preempted to the state.
736 Section 2. Paragraph (g) of subsection (1) of section
737 501.171, Florida Statutes, is amended to read:
738 501.171 Security of confidential personal information. —
739 (1) DEFINITIONS.—As used in this section, the term:
740 (g)1. "Personal information" means either of the
741 following:
742 a. An individual's first name or first initial and last
743 name in combination with any one or more of the following data
744 elements for that individual:
745 (I) A social security number;
746 (II) A driver license or identification card number,
747 passport number, military identification number, or other
748 similar number issued on a government document used to verify
749 identity;
750 (III) A financial account number or credit or debit card

Page 30 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 9 2022

751 number, in combination with any required security code, access
752 code, or password that is necessary to permit access to an
753 individual's financial account;
754 (IV) Any information regarding an individual's medical
755 history, mental or physical condition, or medical treatment or
756 diagnosis by a health care professional; or
757 (V) An individual's health insurance policy number or
758 subscriber identification number and any unique identifier used
759 by a health insurer to identify the individual.
760 (VI) An individual's biometric information as defined in
761 s. 501.173(2).
762 b. A user name or e-mail address, in combination with a
763 password or security question and answer that would permit
764 access to an online account.
765 2. The term does not include information about an
766 individual that has been made publicly available by a federal,
767 state, or local governmental entity. The term also does not
768 include information that is encrypted, secured, or modified by
769 any other method or technology that removes elements that
770 personally identify an individual or that otherwise renders the
771 information unusable.
772 Section 3. This act shall take effect July 1, 2023.

Page 31 of 31

CODING: Words stricken are deletions; words underlined are additions.
hb0009-00
COMMERCE COMMITTEE

HB 9 by Rep. McFarland
Consumer Data Privacy

AMENDMENT SUMMARY
February 10, 2022

Amendment 1 by Rep. McFarland (strike):
• Allows a controller to provide the categories of personal information collected, rather
than the specific details of the information, in certain circumstances.
• Makes exceptions uniform for “right to delete,” “right to correct,” and “controller
retention.”
• Adds guidance and a list of factors for courts to consider when determining the amount
of damages due in a private cause of action.
• Clarifies that a processor must only turn over personal information to a controller, not all
of the processor’s information.
• Clarifies throughout the bill that a length of time in days refers to calendar days.
• Increases the age that requires an opt-in for minors, to 18 years of age, from 16.
• Clarifies and makes conforming changes throughout the bill.
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER

1 Committee/Subcommittee hearing bill: Commerce Committee
2 Representative McFarland offered the following:
3
4 Amendment (with title amendment)
5 Remove everything after the enacting clause and insert:
6 Section 1. Section 501.173, Florida Statutes, is created
7 to read:
8 501.173 Consumer data privacy.—
9 (1) APPLICABILITY.—This section does not apply to:
10 (a) Personal information collected and transmitted that is
11 necessary for the sole purpose of sharing such personal
12 information with a financial service provider solely to
13 facilitate short term, transactional payment processing for the
14 purchase of products or services.
15 (b) Personal information collected, used, retained, sold,
16 shared, or disclosed as deidentified personal information or
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 1 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

17 aggregate consumer information.
18 (c) Compliance with federal, state, or local laws.
19 (d) Compliance with a civil, criminal, or regulatory
20 inquiry, investigation, subpoena, or summons by federal, state,
21 or local authorities.
22 (e) Cooperation with law enforcement agencies concerning
23 conduct or activity that the controller, processor, or third
24 party reasonably and in good faith believes may violate federal,
25 state, or local law.
26 (f) Exercising or defending legal claims.
27 (g) Personal information obtained through the controller's
28 direct interactions with the consumer, if collected in
29 accordance with the provisions of this section, that is used by
30 the controller or the processor that the controller direct ly
31 contracts with for advertising or marketing services to
32 advertise or market products or services that are produced or
33 offered directly by the controller. Such information may not be
34 sold, shared, or disclosed unless otherwise authorized under
35 this section.
36 (h) Personal information of a person acting in the role of
37 a job applicant, employee, owner, director, officer, contractor,
38 volunteer, or intern of a controller, that is collected by a
39 controller, to the extent the personal information is collected
40 and used solely within the context of the person's role or
41 former role with the controller.
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 2 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

42 (i) Protected health information for purposes of the
43 federal Health Insurance Portability and Accountability Act of
44 1996 and related regulations, and patient identifying
45 information for purposes of 42 C.F.R. part 2, established
46 pursuant to 42 U.S.C. s. 290dd-2.
47 (j) A covered entity or business associate governed by the
48 privacy, security, and breach notification rules issued by the
49 United States Department of Health and Human Services in 45
50 C.F.R. parts 160 and 164, or a program or a qualified service
51 program as defined in 42 C.F.R. part 2, to the extent the
52 covered entity, business associate, or program maintains
53 personal information in the same manner as medical information
54 or protected health information as described in paragraph (i),
55 and as long as the covered entity, business associate, or
56 program does not use personal information for targeted
57 advertising with third parties and does not sell or share
58 personal information to a third party unless such sale or
59 sharing is covered by an exception under this section.
60 (k) Identifiable private information collected for
61 purposes of research as defined in 45 C.F.R. s. 164.501
62 conducted in accordance with the Federal Policy for the
63 Protection of Human Subjects for purposes of 45 C.F.R. part 46,
64 the good clinical practice guidelines issued by the
65 International Council for Harmonisation of Technical
66 Requirements for Pharmaceuticals for Human Use, or the
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 3 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

67 Protection for Human Subjects for purposes of 21 C.F.R. parts 50
68 and 56, or personal information that is used or shared in
69 research conducted in accordance with one or more of these
70 standards.
71 (l) Information and documents created for purposes of the
72 federal Health Care Quality Improvement Act of 1986 and related
73 regulations, or patient safety work product for purposes of 42
74 C.F.R. part 3, established pursuant to 42 U.S.C. s. 299b -21
75 through 299b-26.
76 (m) Information that is deidentified in accordance with 45
77 C.F.R. part 164 and derived from individually identifiable
78 health information as described in the Health Insurance
79 Portability and Accountability Act of 1996, or identifiable
80 personal information, consistent with the Federal Policy for the
81 Protection of Human Subjects or the human subject protection
82 requirements of the United States Food and Drug Administration.
83 (n) Information used only for public health activities and
84 purposes as described in 45 C.F.R. s. 164.512.
85 (o) Personal information collected, processed, sold, or
86 disclosed pursuant to the federal Fair Credit Reporting Act, 15
87 U.S.C. s. 1681 and implementing regulations.
88 (p) Nonpublic personal information collected, processed,
89 sold, or disclosed pursuant to the Gramm-Leach-Bliley Act, 15
90 U.S.C. s. 6801 et seq., and implementing regulations.
91 (q) A financial institution as defined in the Gramm-Leach-
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 4 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

92 Bliley Act, 15 U.S.C. s. 6801 et seq., to the extent the
93 financial institution maintains personal information in the same
94 manner as nonpublic personal information as described in
95 paragraph (p), and as long as such financial institution does
96 not use personal information for targeted advertising with third
97 parties and does not sell or share personal information to a
98 third party unless such sale or sharing is covered by an
99 exception under this section.
100 (r) Personal information collected, processed, sold, or
101 disclosed pursuant to the federal Driver's Privacy Protection
102 Act of 1994, 18 U.S.C. s. 2721 et seq.
103 (s) Education information covered by the Family
104 Educational Rights and Privacy Act, 20 U.S.C. s. 1232(g) and 34
105 C.F.R. part 99.
106 (t) Information collected as part of public or peer-
107 reviewed scientific or statistical research in the public
108 interest and that adheres to all other applicable ethics and
109 privacy laws, if the consumer has provided informed consent.
110 Research with personal information must be subjected by the
111 controller conducting the research to additional security
112 controls that limit access to the research data to only those
113 individuals necessary to carry out the research purpose and
114 subsequently deidentified.
115 (u) Personal information disclosed for the purpose of
116 responding to an alert of a present risk of harm to a person or
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 5 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

117 property or prosecuting those responsible for that activity.
118 (v) Personal information that is disclosed when a consumer
119 uses or directs a controller to intentionally disclose
120 information to a third party or uses the controller to
121 intentionally interact with a third party. An intentional
122 interaction occurs when the consumer intends to interact with
123 the third party, by one or more deliberate interactions.
124 Hovering over, muting, pausing, or closing a given piece of
125 content does not constitute a consumer's intent to interact with
126 a third party.
127 (w) An identifier used for a consumer who has opted out of
128 the sale or sharing of the consumer's personal information for
129 the sole purpose of alerting processors and third parties that
130 the consumer has opted out of the sale or sharing of the
131 consumer's personal information.
132 (x) Personal information transferred by a controller to a
133 third party as an asset that is part of a merger, acquisition,
134 bankruptcy, or other transaction in which the third party
135 assumes control of all or part of the controller, provided that
136 information is used or shared consistently with this section. If
137 a third party materially alters how it uses or shares the
138 personal information of a consumer in a manner that is
139 materially inconsistent with the commitments or promises made at
140 the time of collection, it shall provide prior notice of the new
141 or changed practice to the consumer. The notice must be
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 6 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

142 sufficiently prominent and robust to ensure that consumers can
143 easily exercise choices consistent with this section.
144 (2) DEFINITIONS.—As used in this section, the term:
145 (a) "Aggregate consumer information" means information
146 that relates to a group or category of consumers, from which the
147 identity of an individual consumer has been removed and is not
148 reasonably capable of being directly or indirectly associated or
149 linked with, any consumer, household, or device. The term does
150 not include personal information that has been deidentified.
151 (b) "Biometric information" means an individual's
152 physiological, biological, or behavioral characteristics,
153 including an individual's deoxyribonucleic acid (DNA), that can
154 be used, singly or in combination with each other or with other
155 identifying data, to establish individual identity. The term
156 includes, but is not limited to, imagery of the iris, retina,
157 fingerprint, face, hand, palm, vein patterns, and voice
158 recordings, from which an identifier template, such as a
159 faceprint, a minutiae template, or a voiceprint, can be
160 extracted, and keystroke patterns or rhythms, gait patterns or
161 rhythms, and sleep, health, or exercise data that contain
162 identifying information.
163 (c) "Collect" means to buy, rent, gather, obtain, receive,
164 or access any personal information pertaining to a consumer by
165 any means. The term includes, but is not limited to, actively or
166 passively receiving information from the consumer or by
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 7 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

167 observing the consumer's behavior or actions.
168 (d) "Consumer" means a natural person who resides in or is
169 domiciled in this state, however identified, including by any
170 unique identifier, who is acting in a personal capacity or
171 household context. The term does not include a natural person
172 acting on behalf of a legal entity in a commercial or employment
173 context.
174 (e) "Controller" means:
175 1. A sole proprietorship, partnership, limited liability
176 company, corporation, association, or legal entity that meets
177 the following requirements:
178 a. Is organized or operated for the profit or financial
179 benefit of its shareholders or owners;
180 b. Does business in this state;
181 c. Collects personal information about consumers, or is
182 the entity on behalf of which such information is collected;
183 d. Determines the purposes and means of processing
184 personal information about consumers alone or jointly with
185 others; and
186 e. Satisfies at least two of the following thresholds:
187 (I) Has global annual gross revenues in excess of $50
188 million, as adjusted in January of every odd-numbered year to
189 reflect any increase in the Consumer Price Index.
190 (II) Annually buys, receives, sells, or shares the
191 personal information of 50,000 or more consumers, households,
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 8 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

192 and devices for the purpose of targeted advertising in
193 conjunction with third parties or for a purpose that is not
194 listed under subsection (1).
195 (III) Derives 50 percent or more of its global annual
196 revenues from selling or sharing personal information about
197 consumers.
198 2. Any entity that controls or is controlled by a
199 controller. As used in this subparagraph, the term "control"
200 means:
201 a. Ownership of, or the power to vote, more than 50
202 percent of the outstanding shares of any class of voting
203 security of a controller;
204 b. Control in any manner over the election of a majority
205 of the directors, or of individuals exercising similar
206 functions; or
207 c. The power to exercise a controlling influence over the
208 management of a company.
209 (f) "Deidentified" means information that cannot
210 reasonably be used to infer information about or otherwise be
211 linked to a particular consumer, provided that the controller
212 that possesses the information:
213 1. Takes reasonable measures to ensure that the
214 information cannot be associated with a specific consumer;
215 2. Maintains and uses the information in deidentified form
216 and not to attempt to reidentify the information, except that
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 9 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

217 the controller may attempt to reidentify the information solely
218 for the purpose of determining whether its deidentification
219 processes satisfy the requirements of this paragraph; and
220 3. Contractually obligates any recipients of the
221 information to comply with all the provisions of this paragraph
222 to avoid reidentifying such information.
223 (g) "Department" means the Department of Legal Affairs.
224 (h) "Device" means a physical object associated with a
225 consumer or household capable of directly or indirectly
226 connecting to the Internet.
227 (i) "Homepage" means the introductory page of an Internet
228 website and any Internet webpage where personal information is
229 collected. In the case of a mobile application, the homepage is
230 the application's platform page or download page, a link within
231 the application, such as the "About" or "Information"
232 application configurations, or settings page, and any other
233 location that allows consumers to review the notice required by
234 subsection (7), including, but not limited to, before
235 downloading the application.
236 (j) "Household" means a natural person or a group of
237 people in this state who reside at the same address, share a
238 common device or the same service provided by a controller, and
239 are identified by a controller as sharing the same group account
240 or unique identifier.
241 (k) "Personal information" means information that is
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 10 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

242 linked or reasonably linkable to an identified or identifiable
243 consumer or household, including biometric information and
244 unique identifiers to the consumer. The term does not include
245 consumer information that is:
246 1. Consumer employment contact information, including a
247 position name or title, employment qualifications, emergency
248 contact information, business telephone number, business
249 electronic mail address, employee benefit information, and
250 similar information used solely in an employment context.
251 2. Deidentified or aggregate consumer information.
252 3. Publicly and lawfully available information reasonably
253 believed to be made available to the public in a lawful manner
254 and without legal restrictions:
255 a. From federal, state, or local government records.
256 b. By a widely distributed media source.
257 c. By the consumer or by someone to whom the consumer
258 disclosed the information unless the consumer has purposely and
259 effectively restricted the information to a certain audience on
260 a private account.
261 (l) "Processing" means any operation or set of operati ons
262 that are performed on personal information or on sets of
263 personal information, whether or not by automated means.
264 (m) "Processor" means a sole proprietorship, partnership,
265 limited liability company, corporation, association, or other
266 legal entity that is organized or operated for the profit or
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 11 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

267 financial benefit of its shareholders or other owners, that
268 processes information on behalf of a controller and to which the
269 controller discloses a consumer's personal information pursuant
270 to a written contract, provided that the contract prohibits the
271 entity receiving the information from retaining, using, or
272 disclosing the personal information for any purpose other than
273 for the specific purpose of performing the services specified in
274 the contract for the controller, as permitted by this section.
275 (n) "Sell" means to sell, rent, release, disclose,
276 disseminate, make available, transfer, or otherwise communicate
277 orally, in writing, or by electronic or other means, a
278 consumer's personal information by a controller to another
279 controller or a third party for monetary or other valuable
280 consideration.
281 (o) "Share" means to share, rent, release, disclose,
282 disseminate, make available, transfer, or access a consumer's
283 personal information for advertising or marketing. The term
284 includes:
285 1. Allowing a third party to use or advertise or market to
286 a consumer based on a consumer's personal information without
287 disclosure of the personal information to the third party.
288 2. Monetary transactions, nonmonetary transactions, and
289 transactions for other valuable consideration between a
290 controller and a third party for advertising or marketing for
291 the benefit of a controller.
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 12 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

292 (p) "Targeted advertising" means marketing to a consumer
293 or displaying an advertisement to a consumer when the
294 advertisement is selected based on personal information used to
295 predict such consumer's preferences or interests.
296 (q) "Third party" means a person who is not a controller
297 or processor.
298 (r) "Verifiable consumer request" means a request related
299 to personal information that is made by a consumer, by a parent
300 or guardian on behalf of a consumer who is a minor child, or by
301 a person authorized by the consumer to act on the consumer's
302 behalf, in a form that is reasonably and readily accessible to
303 consumers and that the controller can reasonably verify to be
304 the consumer, pursuant to rules adopted by the department.
305 (3) CONSUMER DATA COLLECTION REQUIREMENTS AND
306 RESPONSIBILITIES.—
307 (a) A controller that collects personal information about
308 consumers shall maintain an up-to-date online privacy policy and
309 make such policy available from its homepage. The online privacy
310 policy must include the following information:
311 1. Any Florida-specific consumer privacy rights.
312 2. A list of the types and categories of personal
313 information the controller collects, sells, or shares, or has
314 collected, sold, or shared, about consumers.
315 3. The consumer's right to request deletion or correction
316 of certain personal information.
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 13 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

317 4. The consumer's right to opt-out of the sale or sharing
318 to third parties.
319 (b) A controller that collects personal information shall,
320 at or before the point of collection, inform, or direct the
321 processor to inform, consumers of the categories of personal
322 information to be collected and the purposes for which the
323 categories of personal information will be used.
324 (c) A controller may not collect additional categories of
325 personal information or use personal information collected for
326 additional purposes without providing the consumer with notice
327 consistent with this section.
328 (d) A controller that collects a consumer's personal
329 information shall implement and maintain reasonable security
330 procedures and practices appropriate to the nature of the
331 personal information to protect the personal information from
332 unauthorized or illegal access, destruction, use, modification,
333 or disclosure.
334 (e) A controller shall adopt and implement a retention
335 schedule that prohibits the use or retention of personal
336 information not subject to an exemption by the contro ller or
337 processor after the satisfaction of the initial purpose for
338 which such information was collected or obtained, after the
339 expiration or termination of the contract pursuant to which the
340 information was collected or obtained, or 3 years after the
341 consumer's last interaction with the controller. This paragraph
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 14 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

342 does not apply to personal information reasonably used or
343 retained to do any of the following:
344 1. Fulfill the terms of a written warranty or product
345 recall conducted in accordance with federal law.
346 2. Provide a good or service requested by the consumer, or
347 reasonably anticipate the request of such good or service within
348 the context of a controller's ongoing business relationship with
349 the consumer.
350 3. Detect security threats or incidents; protect against
351 malicious, deceptive, fraudulent, unauthorized, or illegal
352 activity or access; or prosecute those responsible for such
353 activity or access.
354 4. Debug to identify and repair errors that impair
355 existing intended functionality.
356 5. Engage in public or peer-reviewed scientific,
357 historical, or statistical research in the public interest that
358 adheres to all other applicable ethics and privacy laws when the
359 controller's deletion of the information is likely to render
360 impossible or seriously impair the achievement of such research,
361 if the consumer has provided informed consent.
362 6. Enable solely internal uses that are reasonably aligned
363 with the expectations of the consumer based on the consumer's
364 relationship with the controller or that are compatible with the
365 context in which the consumer provided the information.
366 7. Comply with a legal obligation, including any state or
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 15 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

367 federal retention laws.
368 8. As reasonably needed to protect the controller's
369 interests against existing disputes, legal action, or
370 governmental investigations.
371 9. Assure the physical security of persons or property.
372 (4) CONSUMER RIGHT TO REQUEST COPY OF PERSONAL DATA
373 COLLECTED, SOLD, OR SHARED.—
374 (a) A consumer has the right to request that a controller
375 that collects, sells, or shares personal information about the
376 consumer to disclose the following to the consumer:
377 1. The specific pieces of personal information that have
378 been collected about the consumer.
379 2. The categories of sources from which the consumer's
380 personal information was collected.
381 3. The specific pieces of personal information about the
382 consumer that were sold or shared.
383 4. The third parties to which the personal information
384 about the consumer was sold or shared.
385 5. The categories of personal information about the
386 consumer that were disclosed to a processor.
387 (b) A controller that collects, sells, or shares personal
388 information about a consumer shall disclose the information
389 specified in paragraph (a) to the consumer upon receipt of a
390 verifiable consumer request.
391 (c) This subsection does not require a controller to
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 16 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

392 retain, reidentify, or otherwise link any data that, in the
393 ordinary course of business is not maintained in a manner that
394 would be considered personal information.
395 (d) The controller shall deliver the information required
396 or act on the request in this subsection to a consumer free of
397 charge within 45 calendar days after receiving a verifiable
398 consumer request. The response period may be extended once by 45
399 additional calendar days when reasonably necessary, provided the
400 controller informs the consumer of any such extension within the
401 initial 45-day response period and the reason for the extension.
402 The information must be delivered in a readily usable format. A
403 controller is not obligated to provide information to the
404 consumer if the consumer or a person authorized to act on the
405 consumer's behalf does not provide verification of identity or
406 verification of authorization to act with the permission of the
407 consumer.
408 (e) A controller may provide personal information to a
409 consumer at any time, but is not required to provide personal
410 information to a consumer more than twice in a 12-month period.
411 (f) This subsection does not apply to personal information
412 relating solely to households.
413 (5) RIGHT TO HAVE PERSONAL INFORMATION DELETED OR
414 CORRECTED.—
415 (a) A consumer has the right to request that a controller
416 delete any personal information about the consumer which the
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 17 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

417 controller has collected from the consumer.
418 1. A controller that receives a verifiable consumer
419 request to delete the consumer's personal information shall
420 delete the consumer's personal information from its records and
421 direct any processors to delete such information within 90
422 calendar days of receipt of the verifiable consumer reques t.
423 2. A controller or a processor acting pursuant to its
424 contract with the controller may not be required to comply with
425 a consumer's request to delete the consumer's personal
426 information if it is reasonably necessary for the controller or
427 processor to maintain the consumer's personal information to do
428 any of the following:
429 a. Complete the transaction for which the personal
430 information was collected.
431 b. Fulfill the terms of a written warranty or product
432 recall conducted in accordance with federal law.
433 c. Provide a good or service requested by the consumer, or
434 reasonably anticipate the request of such good or service within
435 the context of a controller's ongoing business relationship with
436 the consumer, or otherwise perform a contract between the
437 controller and the consumer.
438 d. Detect security threats or incidents; protect against
439 malicious, deceptive, fraudulent, unauthorized, or illegal
440 activity or access; or prosecute those responsible for such
441 activity or access.
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 18 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

442 e. Debug to identify and repair errors that impair
443 existing intended functionality.
444 f. Engage in public or peer-reviewed scientific,
445 historical, or statistical research in the public interest that
446 adheres to all other applicable ethics and privacy laws when the
447 controller's deletion of the information is likely to render
448 impossible or seriously impair the achievement of such research,
449 if the consumer has provided informed consent.
450 g. Enable solely internal uses that are reasonably aligned
451 with the expectations of the consumer based on the consumer's
452 relationship with the controller or that are compatible with the
453 context in which the consumer provided the information.
454 h. Comply with a legal obligation, including any state or
455 federal retention laws.
456 i. As reasonably needed to protect the controller's
457 interests against existing disputes, legal action, or
458 governmental investigations.
459 j. Assure the physical security of persons or property.
460 (b) A consumer has the right to make a request to correct
461 inaccurate personal information to a controller that maintains
462 inaccurate personal information about the consumer. A controller
463 that receives a verifiable consumer request to correct
464 inaccurate personal information shall use commercially
465 reasonable efforts to correct the inaccurate personal
466 information as directed by the consumer and direct any
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 19 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

467 processors to correct such information within 90 calendar days
468 after receipt of the verifiable consumer request. If a
469 controller maintains a self-service mechanism to allow a
470 consumer to correct certain personal information, the controller
471 may require the consumer to correct their own personal
472 information through such mechanism. A controller or a processor
473 acting pursuant to its contract with the controller may not be
474 required to comply with a consumer's request to correct the
475 consumer's personal information if it is reasonably necessary
476 for the controller or processor to maintain the consumer's
477 personal information to do any of the following:
478 1. Complete the transaction for which the personal
479 information was collected.
480 2. Fulfill the terms of a written warranty or product
481 recall conducted in accordance with federal law.
482 3. Detect security threats or incidents; protect against
483 malicious, deceptive, fraudulent, unauthorized, or illegal
484 activity or access; or prosecute those responsible for such
485 activity or access.
486 4. Debug to identify and repair errors that impair
487 existing intended functionality.
488 5. Enable solely internal uses that are reasonably aligned
489 with the expectations of the consumer based on the consumer's
490 relationship with the controller or that are compatible with the
491 context in which the consumer provided the information.
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 20 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

492 6. Comply with a legal obligation, including any state or
493 federal retention laws.
494 7. As reasonably needed to protect the controller's
495 interests against existing disputes, legal action, or
496 governmental investigations.
497 8. Assure the physical security of persons or property.
498 (6) RIGHT TO OPT-OUT OF THE SALE OR SHARING OF PERSONAL
499 INFORMATION.—
500 (a) A consumer has the right at any time to direct a
501 controller not to sell or share the consumer's personal
502 information to a third party. This right may be referred to as
503 the right to opt-out.
504 (b) Notwithstanding paragraph (a), a controller may not
505 sell or share the personal information of a minor consumer if
506 the controller has actual knowledge that the consumer is not 18
507 years of age or older. However, if a consumer who is between 13
508 and 18 years of age, or if the parent or guardian of a consumer
509 who is 12 years of age or younger, has affirmatively authorized
510 the sale or sharing of such consumer's personal information,
511 then a controller may sell or share such information in
512 accordance with this section. A controller that willfully
513 disregards the consumer's age is deemed to have actual knowledge
514 of the consumer's age. A controller that complies with the
515 verifiable parental consent requirements of the Children's
516 Online Privacy Protection Act, 15 U.S.C. s. 6501 et seq., shall
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 21 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

517 be deemed compliant with any obligation to obtain parental
518 consent.
519 (c) A controller that has received direction prohibiting
520 the sale or sharing of the consumer's personal information is
521 prohibited from selling or sharing the consumer's personal
522 information beginning 48 hours after receipt of such di rection,
523 unless the consumer subsequently provides express authorization
524 for the sale or sharing of the consumer's personal information.
525 (7) FORM TO OPT-OUT OF SALE OR SHARING OF PERSONAL
526 INFORMATION.—
527 (a) A controller shall:
528 1. In a form that is reasonably accessible to consumers,
529 provide a clear and conspicuous link on the controller's
530 Internet homepage, entitled "Do Not Sell or Share My Personal
531 Information," to an Internet webpage that enables a consumer, or
532 a person authorized by the consumer, to opt-out of the sale or
533 sharing of the consumer's personal information. A controller may
534 not require a consumer to create an account in order to direct
535 the controller not to sell the consumer's personal information.
536 A controller may accept a request to opt-out received through a
537 user-enabled global privacy control, such as a browser plug-in
538 or privacy setting, device setting, or other mechanism, which
539 communicates or signals the consumer's choice to opt out.
540 2. For consumers who opted-out of the sale or sharing of
541 their personal information, respect the consumer's decision to
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 22 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

542 opt-out for at least 12 months before requesting that the
543 consumer authorize the sale or sharing of the consumer's
544 personal information.
545 3. Use any personal information collected from the
546 consumer in connection with the submission of the consumer's
547 opt-out request solely for the purposes of complying with the
548 opt-out request.
549 (b) A consumer may authorize another person to opt -out of
550 the sale or sharing of the consumer's personal information on
551 the consumer's behalf pursuant to rules adopted by the
552 department.
553 (8) ACTIONS RELATED TO CONSUMERS WHO EXERCISE PRIVACY
554 RIGHTS.—
555 (a) A controller may charge a consumer who exercised any
556 of the consumer's rights under this section a different price or
557 rate, or provide a different level or quality of goods or
558 services to the consumer, only if that difference is reasonably
559 related to the value provided to the controller by the
560 consumer's data or is related to a consumer's voluntary
561 participation in a financial incentive program, including a bona
562 fide loyalty, rewards, premium features, discounts, or club card
563 program offered by the controller.
564 (b) A controller may offer financial incentives, including
565 payments to consumers as compensation, for the collection,
566 sharing, sale, or deletion of personal information if the
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 23 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

567 consumer gives the controller prior consent that clearly
568 describes the material terms of the financial incentive program.
569 The consent may be revoked by the consumer at any time.
570 (c) A controller may not use financial incentive practices
571 that are unjust, unreasonable, coercive, or usurious in nature.
572 (9) CONTRACTS AND ROLES.—
573 (a) Any contract or agreement between a controller and a
574 processor must:
575 1. Prohibit the processor from selling, sharing,
576 retaining, using, or disclosing the personal information for any
577 purpose that violates this section;
578 2. Govern the processor's personal information processing
579 procedures with respect to processing performed on behalf of the
580 controller, including processing instructions, the nature and
581 purpose of processing, the type of information subject to
582 processing, the duration of processing, and the rights and
583 obligations of both the controller and processor;
584 3. Require the processor to return or delete all personal
585 information under the contract to the controller as requested by
586 the controller at the end of the provision of services, unless
587 retention of the information is required by law; and
588 4. Upon request of the controller, require the processor
589 to make available to the controller all personal information in
590 its possession under the contract or agreement.
591 (b) Determining whether a person is acting as a controller
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 24 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

592 or processor with respect to a specific processing of data is a
593 fact-based determination that depends upon the context in which
594 personal information is to be processed. The contract between a
595 controller and processor must reflect their respective roles and
596 relationships related to handling personal information. A
597 processor that continues to adhere to a controller's
598 instructions with respect to a specific processing of personal
599 information remains a processor.
600 (c) A third party may not sell or share personal
601 information about a consumer that has been sold or shared to the
602 third party by a controller unless the consumer has received
603 explicit notice from the third party and is provided an
604 opportunity to opt-out by the third party.
605 (d) A processor or third party must require any
606 subcontractor to meet the same obligations of such processor or
607 third party with respect to personal information.
608 (e) A processor or third party or any subcontractor
609 thereof who violates any of the restrictions imposed upon it
610 under this section is liable or responsible for any failure to
611 comply with this section.
612 (f) Any provision of a contract or agreement of any kind
613 that waives or limits in any way a consumer's rights under this
614 section, including, but not limited to, any right to a remedy or
615 means of enforcement, is deemed contrary to public policy and is
616 void and unenforceable. This section does not prevent a consumer
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 25 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

617 from declining to request information from a controller,
618 declining to opt-out of a controller's sale or sharing of the
619 consumer's personal information, or authorizing a controller to
620 sell or share the consumer's personal information after
621 previously opting out.
622 (10) CIVIL ACTIONS; PRIVATE RIGHT OF ACTION.—
623 (a) A Florida consumer may only bring a civil action
624 against a controller, processor, or third party pursuant to this
625 section for the following:
626 1. Failure to delete or correct the consumer's personal
627 information pursuant to this section after receiving a
628 verifiable consumer request or directions to delete or correct
629 from a controller unless the controller, processor, or third
630 party qualifies for an exception to the requirements to delete
631 or correct under this section.
632 2. Continuing to sell or share the consumer's personal
633 information after the consumer chooses to opt-out pursuant to
634 this section.
635 3. Selling or sharing the personal information of the
636 consumer age 18 or younger without obtaining consent as required
637 by this section.
638 (b) A court may grant the following relief to a Florida
639 consumer:
640 1. Statutory damages in an amount not less than $100 and
641 not greater than $750 per consumer per incident or actual
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 26 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

642 damages, whichever is greater.
643 2. Injunctive or declaratory relief.
644 (c) Upon prevailing, the Florida consumer shall recover
645 reasonable attorney fees and costs.
646 (d) Any action under this subsection may only be brought
647 by or on behalf of a Florida consumer.
648 (e) Liability for a tort, contract claim, or consumer
649 protection claim which is unrelated to an action brought under
650 subsection (10) or subsection (11) does not arise solely from
651 the failure of a controller, processor, or third party to comply
652 with this section and evidence of such may only be used as the
653 basis to prove a cause of action under this subsection.
654 (f) In assessing the amount of statutory damages, the
655 court shall consider any one or more of the relevant
656 circumstances presented by any of the parties to the case,
657 including, but not limited to, the nature and seriousness of the
658 misconduct, the number of violations, the length of time over
659 which the misconduct occurred, and the defendant's assets,
660 liability, and net worth.
661 (11) ENFORCEMENT AND IMPLEMENTATION BY THE DEPARTMENT. —
662 (a) Any violation of this section is an unfair and
663 deceptive trade practice actionable under part II of chapter 501
664 solely by the department against a controller, processor, or
665 person. If the department has reason to believe that any
666 controller, processor, or third party is in violation of this
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 27 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

667 section, the department, as the enforcement authority, may bring
668 an action against such controller, processor, or third party for
669 an unfair or deceptive act or practice. For the purpose of
670 bringing an action pursuant to this section, ss. 501.211 and
671 501.212 do not apply. Civil penalties may be tripled if the
672 violation:
673 1. Involves a Florida consumer who the controller,
674 processor, or third party has actual knowledge is 18 years of
675 age or younger; or
676 2. Is based on paragraph (10)(a).
677 (b) After the department has notified a controller,
678 processor, or third party in writing of an alleged violation,
679 the department may in its discretion grant a 45-day period to
680 cure the alleged violation. The 45-day cure period does not
681 apply to a violation of subparagraph (10)(a)1. The department
682 may consider the number and frequency of violations, the
683 substantial likelihood of injury to the public, and the safety
684 of persons or property when determining whether to grant 45
685 calendar days to cure and the issuance of a letter of guidance.
686 If the violation is cured to the satisfaction of the department
687 and proof of such cure is provided to the department, the
688 department in its discretion may issue a letter of guidance. If
689 the controller, processor, or third party fails to cure the
690 violation within 45 calendar days, the department may bring an
691 action against the controller, processor, or third party for the
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 28 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

692 alleged violation.
693 (c) Any action brought by the department may only be
694 brought on behalf of a Florida consumer.
695 (d) By February 1 of each year, the department shall
696 submit a report to the President of the Senate and the Speaker
697 of the House of Representatives describing any actions taken by
698 the department to enforce this section. The report shall include
699 statistics and relevant information detailing:
700 1. The number of complaints received;
701 2. The number and type of enforcement actions taken and
702 the outcomes of such actions;
703 3. The number of complaints resolved without the need for
704 litigation; and
705 4. The status of the development and implementation of
706 rules to implement this section.
707 (e) The department may adopt rules to implement this
708 section, including standards for verifiable consumer requests,
709 enforcement, data security, and authorized persons who may act
710 on a consumer's behalf.
711 (12) JURISDICTION.—For purposes of bringing an action in
712 accordance with subsections (10) and (11), any person who meets
713 the definition of controller as defined in this section that
714 collects, shares, or sells the personal information of Florida
715 consumers, is considered to be both engaged in substantial and
716 not isolated activities within this state and operating,
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 29 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

717 conducting, engaging in, or carrying on a business, and doing
718 business in this state, and is therefore subject to the
719 jurisdiction of the courts of this state.
720 (13) PREEMPTION.—This section is a matter of statewide
721 concern and supersedes all rules, regulations, codes,
722 ordinances, and other laws adopted by a city, county, city and
723 county, municipality, or local agency regarding the collection,
724 processing, sharing, or sale of consumer personal information by
725 a controller or processor. The regulation of the collection,
726 processing, sharing, or sale of consumer personal information by
727 a controller or processor is preempted to the state.
728 Section 2. Paragraph (g) of subsection (1) of section
729 501.171, Florida Statutes, is amended to read:
730 501.171 Security of confidential personal information.—
731 (1) DEFINITIONS.—As used in this section, the term:
732 (g)1. "Personal information" means either of the
733 following:
734 a. An individual's first name or first initial and last
735 name in combination with any one or more of the following data
736 elements for that individual:
737 (I) A social security number;
738 (II) A driver license or identification card number,
739 passport number, military identification number, or other
740 similar number issued on a government document used to verify
741 identity;
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 30 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

742 (III) A financial account number or credit or debit card
743 number, in combination with any required security code, access
744 code, or password that is necessary to permit access to an
745 individual's financial account;
746 (IV) Any information regarding an individual's medical
747 history, mental or physical condition, or medical treatment or
748 diagnosis by a health care professional; or
749 (V) An individual's health insurance policy number or
750 subscriber identification number and any unique identifier used
751 by a health insurer to identify the individual.
752 (VI) An individual's biometric information as defined in
753 s. 501.173(2).
754 b. A user name or e-mail address, in combination with a
755 password or security question and answer that would permit
756 access to an online account.
757 2. The term does not include information about an
758 individual that has been made publicly available by a federal,
759 state, or local governmental entity. The term also does not
760 include information that is encrypted, secured, or modified by
761 any other method or technology that removes elements that
762 personally identify an individual or that otherwise renders the
763 information unusable.
764 Section 3. This act shall take effect July 1, 2023.
765
766 -----------------------------------------------------
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 31 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

767 T I T L E A M E N D M E N T
768 Remove everything before the enacting clause and insert:
769 A bill to be entitled
770 An act relating to consumer data privacy; creating s.
771 501.173, F.S.; providing applicability; providing
772 definitions; requiring controllers that collect a
773 consumer's personal data to disclose certain
774 information regarding data collection and selling
775 practices to the consumer at or before the point of
776 collection; specifying that such information may be
777 provided through a general privacy policy or through a
778 notice informing the consumer that additional specific
779 information will be provided upon a certain request;
780 prohibiting controllers from collecting additional
781 categories of personal information or using personal
782 information for additional purposes without notifying
783 the consumer; requiring controllers that collect
784 personal information to implement reasonable security
785 procedures and practices to protect the information;
786 authorizing consumers to request controllers to
787 disclose the specific personal information the
788 controller has collected about the consumer; requiring
789 controllers to make available two or more methods for
790 consumers to request their personal information;
791 requiring controllers to provide such information free
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 32 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

792 of charge within a certain timeframe and in a certain
793 format upon receiving a verifiable consumer request;
794 specifying requirements for third parties with respect
795 to consumer information acquired or used; providing
796 construction; authorizing consumers to request
797 controllers to delete or correct personal information
798 the controllers have collected about the consumers;
799 providing exceptions; specifying requirements for
800 controllers to comply with deletion or correction
801 requests; authorizing consumers to opt out of third -
802 party disclosure of personal information collected by
803 a controller; prohibiting controllers from selling or
804 disclosing the personal information of consumers
805 younger than a certain age, except under certain
806 circumstances; prohibiting controllers from selling or
807 sharing a consumer's information if the consumer has
808 opted out of such disclosure; prohibiting controllers
809 from taking certain actions to retaliate against
810 consumers who exercise certain rights; providing
811 applicability; providing that a contract or agreement
812 that waives or limits certain consumer rights is void
813 and unenforceable; providing for civil actions and a
814 private right of action for consumers under certain
815 circumstances; providing civil remedies; authorizing
816 the Department of Legal Affairs to bring an action
918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 33 of 34
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 9 (2022)
Amendment No. 1

817 under the Florida Unfair or Deceptive Trade Practices
818 Act and to adopt rules; requiring the department to
819 submit an annual report to the Legislature; providing
820 report requirements; providing that controllers must
821 have a specified timeframe to cure any violations;
822 providing jurisdiction; declaring that the act is
823 matter of statewide concern; preempting the
824 collection, processing, sharing, and sale of consumer
825 personal information to the state; amending s.
826 501.171, F.S.; revising the definition of "personal
827 information"; providing an effective date.

918639 - h0009-strike.docx
Published On: 2/9/2022 5:28:43 PM
Page 34 of 34
HB 631
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 631 Airport Funding
SPONSOR(S): Grall
TIED BILLS: IDEN./SIM. BILLS: SB 780

REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF

1) Tourism, Infrastructure & Energy Subcommittee 17 Y, 0 N Neuffer Keating

2) Commerce Committee Neuffer Hamon

SUMMARY ANALYSIS
The Federal Aviation Administration (FAA) oversees the planning and development of airports across the
nation with a focus on safety and security. In order to further its goal, the FAA provides grants through the
Airport Improvement Program (AIP) for the funding of airport infrastructure projects. The FAA classifies all
airports using data related to the number of passengers that board an aircraft (passenger boardings).

To qualify for AIP funding, an airport must be included in the National Plan of Integrated Airport Systems
(NPIAS), a database which is published every two years. The NPIAS classifies airports by category and hub.
The amount of funding through the AIP is dependent upon the classification of the airport.

The Florida Department of Transportation (DOT) provides financial assistance to airports in the areas of safety,
security, preservation, capacity improvement, land acquisition, planning, and economic development through
its Aviation Grant Program. The Aviation Grant Program is funded from the State Transportation Trust Fund.
Unless otherwise provided in the General Appropriations Act or a substantive bill implementing it, DOT may
participate, if funds are available, in the capital cost of eligible public airport and aviation development projects.

DOT may provide, when such funding is available, up to 50 percent of eligible project costs to commercial
service airports. General aviation airports may receive up to 80 percent funding from DOT for eligible costs so
long as the airport has no scheduled commercial service.

The bill permits DOT funding for up to 80 percent of eligible project costs for airports classified as commercial
service or general aviation with fewer than 100,000 annual passenger boardings. DOT funding will continue to
come from the Aviation Grant fund. Annual passenger boardings will be determined by the FAA.

The bill does not impact state or local government revenues. The bill appears to have an indeterminate impact
on state and local government expenditures.

The bill has an effective date of July 1, 2022.

This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h0631c.COM
DATE: 2/8/2022
FULL ANALYSIS

I. SUBSTANTIVE ANALYSIS

A. EFFECT OF PROPOSED CHANGES:
Present Situation

Federal Classification and Funding of Airports

The Federal Aviation Administration (FAA) oversees the planning and development of airports across
the nation with a focus on safety and security. In order to further its goal, the FAA provides grants
through the Airport Improvement Program (AIP) for the funding of airport infrastructure projects. 1
Grants are available to publicly owned airports – and, in some cases, to privately owned airports – for
planning and development,2 airport noise compatibility planning,3 and the implementation of those
plans.4

The FAA classifies all airports using data related to the number of passengers that board an aircraft
(passenger boardings).5 The agency also considers the types of activities conducted at the airport,
such as cargo service.

To qualify for AIP funding, an airport must be included in the National Plan of Integrated Airport
Systems (NPIAS), a database which is published every two years.6 The NPIAS identifies existing and
proposed public-use airports that are deemed important to the national transportation system. 7
Additionally, the NPIAS classifies airports by category8 and hub.9 The amount of grants funded through
the AIP are dependent upon the classification of the airport. Large and medium primary hubs can
receive up to 75 percent of eligible costs while small primary, reliever, and general aviation airports are
eligible for 90 to 95 percent of qualifying costs.10 The table below shows the federal airport
classification system.

1 49 U.S.C. § 48103(a).
2 49 U.S.C. § 47104.
3 49 U.S.C. § 47505(a)(2).
4 49 U.S.C. § 47504(c).
5 49 U.S.C. § 47102(15) (defining “passenger boardings” as revenue passenger boardings in the United States in the prior
calendar year on an aircraft in service in air commerce).
6 FAA Order 5090.5 s. 2.3.5, September 3, 2019.
7 Id.
8 See FAA, National Plan of Integration Airport Systems (2021-2025), September 2020 (explaining a category describes

the type of service the airport currently provides to the community and is anticipated to provide at the end of the 5 -year
planning period).
9 Id. (explaining a “hub” is defined in statute to delineate commercial service airports based on the percentage of total

passenger enplanements).
10 See FAA, Overview: What is AIP?, United States Department of Transportation,

https://www.faa.gov/airports/aip/overview/ #:~:text=For%20large% 20and% 20medium%20primary,costs%2C%20based%2
0on%20statutory%20requirements (last visited January 28, 2022).
STORAGE NAME: h0631c.COM PAGE: 2
DATE: 2/8/2022
Airport Classifications11 Hub Type: Percentage of Common Name
Annual Passenger
Boardings
Commercial Service: Primary: Large: Large Hub
Publicly owned airports Have more than 1% or more
that have at least 2,500 10,000 passenger Medium: Medium Hub
passenger boardings boardings each year At least 0.25% but less than
each calendar year and 1%
receive scheduled Small: Small Hub
passenger service At least 0.05% but less than
0.25%
Nonhub: Nonhub Primary
More than 10,000 but less
than 0.05%
Nonprimary Nonhub: At least 2,500 Nonprimary Commercial
and no more than 10,000 Service
Nonprimary (other than commercial service) N/A Reliever

Florida Airport Funding

The Florida Department of Transportation (DOT) is tasked with the duty, function, and responsibility of
planning airport systems in the state.12 DOT is also responsible for the creation and periodic update of
the statewide aviation system plan.13 Any proposed airport14 must receive DOT approval for any and all
site acquisitions, construction, or establishment of airport facilities. A public airport 15 is required to
obtain a license from DOT prior to receiving or sending any aircraft from its location, subject to
inspection upon initial application for the license and renewal. While DOT operates on a statewide
level, local governments are charged with adopting, administering, and enforcing airport land use
compatibility zoning regulations.16

DOT is charged with coordinating and assisting in the development of a viable aviation system within
the state.17 It statewide aviation system plan must be developed and periodically updated with 5-year,
10-year, and 20-year summaries for the state’s needs.18 The plans set forth by DOT must be consistent
with the goals of the Florida Transportation Plan and with approved local airport master plans .19 DOT
provides financial assistance to airports in the areas of safety, security, preservation, capacity
improvement, land acquisition, planning, and economic development through its Aviation Grant
Program.20 The Aviation Grant Program is funded from the State Transportation Trust Fund, which
Florida’s aviation industry contributes to through the state aviation tax of 4.27 cents per gallon of fuel.21
Unless otherwise provided in the General Appropriations Act or a substantive bill implementing it, DOT
may participate, if funds are available, in the capital cost of eligible public airport and aviation
development projects.22 Operational expenses are often not considered eligible for aviation grants. 23

11 See 42 U.S.C. § 47102.
12 S. 332.001, F.S.
13 S. 332.006, F.S.
14 See s. 330.27(2), F.S.
15 See s. 330.27(6), F.S. (defining “public airport” as an airport, publicly or privately owned, which is open for use by the

public).
16 S. 333.03, F.S.
17 S. 332.006(1), F.S.
18 Id.
19 Id.
20 See Florida Department of Transportation, Grant Program, available at https://www.fdot.gov/aviation/fundinginfo.shtm

(last visited on December 14, 2021).
21 S. 206.9825, F.S.
22 S. 332.007(6), F.S. (emphasis added).
23 The Florida Department of Transportation – Aviation Office, Florida Aviation Project Handbook 2021-2022, pg. 7 (2021),

https://fdotwww.blob.core.windows.net/sitefinity/docs/default -source/aviation/florida-aviation-project-handbook-(2020-
2021)v7b5cc93c31f25452db01244377cc65215.pdf?sfvrsn= 2ee80049_12 (last visited January 28, 2022).
STORAGE NAME: h0631c.COM PAGE: 3
DATE: 2/8/2022
When federal funding is available through an AIP grant, DOT may fund up to 50 percent of the
nonfederal share of eligible project costs for commercial service airports.24The FAA determines the
types of persons or entities eligible for AIP grant funding, as well as the types of projects that may be
included in a grant.25 General aviation airports may receive up to 80 percent of master planning and
eligible aviation development project costs from DOT if federal funds are not available.26 If federal funds
are available, DOT may fund up to 80 percent of the nonfederal share of such projects. 27 DOT funding
of up to 80 percent is limited to those airports having no scheduled commercial service. 28 Certain
strategic airport investment projects are eligible for up to 100 percent funding from DOT, whether
classified as commercial service or general aviation.29
30

Vero Beach Regional Airport

Vero Beach Regional airport was classified as a nonprimary commercial service, nonhub31 airport in
2017 by the FAA.32 In 2018, annual passenger boardings surpassed the 10,000 threshold, reclassifying
the airport as a commercial service primary, nonhub airport. 33 Annual passenger boardings decreased
in 2019 to slightly under 10,000, reclassifying Vero Beach Regional as a nonprimary commercial
service, nonhub airport. In 2020, annual passenger boardings decreased drastically resulting in a
reclassification by the FAA to a general aviation airport. 34

24 S. 332.007(6)(a), F.S.; AIP funding is available to sponsors, which can include airports, public agencies not owning or
leasing a public-use airport, metropolitan and state planning agencies.
25 See United States Department of Transportation, Order 5100.38D, Change 1, February 26, 2019 (explaining a recipient

of an AIP grant is normally called a sponsor).
26 S. 332.007(6)(c), F.S.
27 Id.
28 Florida Department of Transportation, supra note 22.
29 See s. 332.007(9), F.S. (providing for project criteria qualifying for 100 percent DOT funding).
30 The Florida Department of Transportation – Aviation Office, Florida Aviation Project Handbook 2021-2022, pg. 7 (2021),

https://fdotwww.blob.core.windows.net/sitefinity/docs/default -source/aviation/florida-aviation-project-handbook-(2020-
2021)v7b5cc93c31f25452db01244377cc65215.pdf?sfvrsn= 2ee80049_12 (last visited January 28, 2022).
31 This classification was assigned as the airport had scheduled passenger service and 9,110 enplanements.
32 See FAA, Calendar Year 2019 Final Revenue Enplanements at All Airports, September 25, 2020.
33 This classification was assigned as the airport had scheduled passenger service and more 10,314 enplanements during

the year, but less than 0.05 percent of the annual U.S. commercial enplanements.; see FAA, Calendar Year 2018 Final
Revenue Enplanements at All Airports, December 20, 2019.
34 See FAA, Calendar Year 2020 Enplanements at U.S. Airports, by State, November 8, 2021 (showing a 69.64%

decrease in enplanements from 2019 to 2020).
STORAGE NAME: h0631c.COM PAGE: 4
DATE: 2/8/2022
In December of 2015, Elite Airways began direct, non-stop service from Vero Beach to Newark and
other destinations. City officials did not expect the commercial service to grow at the rate it did,
surpassing the 10,000 annual enplanement cap set by the FAA for non-primary, nonhub airports.35 As a
result of the reclassification, Vero Beach Regional stood to lose funding from DOT. Instead of receiving
up to 80 percent for eligible projects when classified as a general aviation airport, it would only be
eligible for up to 50 percent as a commercial service airport.36

Effect of the Bill

The bill permits DOT funding for up to 80 percent of eligible project costs for airports classified as
commercial service or general aviation with fewer than 100,000 annual passenger boardings. DOT
funding will continue to come from the Aviation Grant fund. Annual passenger boardings will be
determined by the FAA.

B. SECTION DIRECTORY:
Section 1 Amends s. 332.007, F.S.; related to FDOT funding eligibility.

Section 2 Provides an effective date.

II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT

A. FISCAL IMPACT ON STATE GOVERNMENT:

1. Revenues:
None.

2. Expenditures:
Indeterminate.37 See Fiscal Comments.

B. FISCAL IMPACT ON LOCAL GOVERNMENTS:

1. Revenues:
None.

2. Expenditures:
Indeterminate.38 See Fiscal Comments.

C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.

D. FISCAL COMMENTS:

35 Nicole Rodriguez, Vero City Council ‘Blindsided’ by Airport Funding Problem, VeroNews.com (January 23, 2020),
http://veronews.com/2020/01/23/ vero-city-council-blindsided-by-airport-funding-problem/ (last visited January 27, 2022).
36 See FAA, Passenger Boarding (Enplanement) and All-Cargo Data for U.S. Airports – Previous Years Airports,

https://www.faa.gov/airports/planning_capacity/passenger_allcargo_stats/passenger/previous_years/ (last visited January
31, 2022) (providing data that Fort Lauderdale Executive airport also appears to be trending upward in annual passenger
boardings. In 2018, annual boardings increased 141 percent from the previous year. In 2019, annual passenger boardings
increased 523 percent to reach 7,386).
37 See Florida Department of Transportation, Agency Analysis of 2021 House Bill 631, p. 5-6 (November 05, 2021).
38 Id.
STORAGE NAME: h0631c.COM PAGE: 5
DATE: 2/8/2022
The bill expands the number of airports qualifying for a larger percentage of DOT funding for eligible
projects. This change could impact the opportunity of these airports to engage in eligible types of
projects as the local match requirement is decreased. The cost is shifted to the state, and while the
match required is indeterminate, all costs are still limited to available aviation project funding within
DOT’s adopted Work Program.

III. COMMENTS

A. CONSTITUTIONAL ISSUES:

1. Applicability of Municipality/County Mandates Provision:
Not applicable. The bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditure of funds; reduce the authority that counties or municipalities have to
raise revenue in the aggregate; or reduce the percentage of sales tax shared with counties or
municipalities

2. Other:
None.

B. RULE-MAKING AUTHORITY:
The bill requires neither rulemaking nor does it provide a grant of rulemaking authority.

C. DRAFTING ISSUES OR OTHER COMMENTS:
None.

IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
Not applicable.

STORAGE NAME: h0631c.COM PAGE: 6
DATE: 2/8/2022
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 631 2022

1 A bill to be entitled
2 An act relating to airport funding; amending s.
3 332.007, F.S.; revising the types of airports eligible
4 for specified funding of master planning and eligible
5 aviation development projects by the Department of
6 Transportation; providing an effective date.
7
8 Be It Enacted by the Legislature of the State of Florida:
9
10 Section 1. Paragraph (c) of subsection (6) of section
11 332.007, Florida Statutes, is amended to read:
12 332.007 Administration and financing of aviation and
13 airport programs and projects; state plan.—
14 (6) Subject to the availability of appropriated funds, the
15 department may participate in the capital cost of eligible
16 public airport and aviation development projects in accordance
17 with the following rates, unless otherwise provided in the
18 General Appropriations Act or the substantive bill implementing
19 the General Appropriations Act:
20 (c) When federal funds are not available, the department
21 may fund up to 80 percent of master planning and eligible
22 aviation development projects at publicly owned, publicly
23 operated airports. If federal funds are available, the
24 department may fund up to 80 percent of the nonfederal share of
25 such projects. Such funding is limited to general aviation

Page 1 of 2

CODING: Words stricken are deletions; words underlined are additions.
hb0631-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 631 2022

26 airports, or commercial service airports that have fewer than
27 100,000 passenger boardings per year as determined by the
28 Federal Aviation Administration airports that have no scheduled
29 commercial service.
30 Section 2. This act shall take effect July 1, 2022.

Page 2 of 2

CODING: Words stricken are deletions; words underlined are additions.
hb0631-00
HB 695
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 695 Property Insurer Reimbursements
SPONSOR(S): Stevenson
TIED BILLS: IDEN./SIM. BILLS: SB 1058

REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF

1) Insurance & Banking Subcommittee 15 Y, 0 N Fortenberry Luczynski

2) Appropriations Committee 24 Y, 0 N Lee Pridgeon

3) Commerce Committee Fortenberry Luczynski

SUMMARY ANALYSIS

The Florida Hurricane Catastrophe Fund (FHCF) is a tax-exempt trust fund created by the Legislature in 1993
as a form of reinsurance for residential property catastrophic hurricane losses. As a condition of transacting
insurance business in the state, residential property insurers are required to enter contracts with the State
Board of Administration (SBA) to purchase reimbursement coverage (reinsurance) on their residential property
exposure.

As part of its regulation, the Office of Insurance Regulation (OIR) monitors the solvency of insurers to protect
policyholders against the risk that insurers will not be able to meet their financial responsibilities. If an insurer is
in an unsound financial condition, OIR may refer that insurer to the Department of Financial Services for the
filing of a delinquency proceeding in circuit court, which may result in the liquidation of the insurer. If Citizens
Property Insurance Corporation (Citizens) assumes policies from such liquidated insurer, Citizens may obtain
coverage from the FHCF for these policies under its reimbursement contract with the SBA or by accepting an
assignment of the liquidated insurer’s reimbursement contract with the SBA. However, current law does not
address the transfer of FHCF coverage to Citizens if it assumes policies from an authorized insurer that is in an
unsound financial condition, but is not the subject of a delinquency proceeding, or the transfer of FHCF
coverage if an authorized private insurer assumes policies from an unsound insurer.

The bill defines “unsound insurer” as an insurer that OIR has determined to be in unsound condition as defined
in s. 624.80(2), F.S., or an insurer that has been placed into receivership under ch. 631, F.S. The bill allows
any authorized insurer to receive the transfer of FHCF coverage along with policies that it assumes from an
unsound insurer, subject to an agreement with the SBA. The bill extends to authorized insurers the
requirements that exist when Citizens assumes policies from unsound insurers and wishes to obtain coverage
from the FHCF for those policies and establishes additional requirements for both authorized insurers and
Citizens. The bill replaces the statutory phrase “placed in liquidation” with the defined term “unsound insurer”
so that FHCF coverage can be transferred to Citizens or an authorized insurer with policies that Citizens or
such authorized insurer assumes from an unsound insurer or a liquidated insurer.

The bill establishes that if a covered event has occurred before the effective date of the transfer of the policies
to the authorized insurer or Citizens, the authorized insurer or Citizens may only obtain coverage from the
FHCF subject to an assignment of the remaining term of the unsound insurer’s FHCF contract.

The bill has no impact on state or local government revenues or expenditures and no direct economic impact
on the private sector.

The bill has an effective date of July 1, 2022.

This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h0695d.COM
DATE: 2/8/2022
FULL ANALYSIS

I. SUBSTANTIVE ANALYSIS

A. EFFECT OF PROPOSED CHANGES:
Background

Florida Hurricane Catastrophe Fund

The Florida Hurricane Catastrophe Fund (FHCF) is a tax-exempt trust fund created by the Legislature
in 1993 as a form of reinsurance for residential property catastrophic hurricane losses. 1 The purpose of
the FHCF is to protect and advance the state’s interest in maintaining insurance capacity in Florida by
providing reimbursements to insurers for a portion of their catastrophic losses. 2 The FHCF provides
insurers a source of reinsurance that is stable and generally less expensive than private reinsurance.

The FHCF is administered by the State Board of Administration (SBA) and reimburses property
insurers for a selected percentage of hurricane losses to residential property when those losses exceed
the insurer’s retention (deductible).3 The FHCF reimburses participating insurers for losses under
covered policies, subject to limitations.4 A covered policy is defined as “any insurance policy covering
residential property” in Florida, including, but not limited to the following types of policies:
 homeowner
 mobile home owner
 farm owner
 condominium association
 condominium unit owner
 tenant
 apartment building policy
 any other policy covering a residential structure or its contents. 5

Covered policies may be issued by any authorized insurer,6 a commercial self-insurance fund holding a
certificate of authority issued by the Office of Insurance Regulation (OIR), the Citizens Property
Insurance Corporation (Citizens), and any joint underwriting association or similar legal entity.7

As a condition of transacting insurance business in the state, residential property insurers are required
to enter contracts with the SBA to purchase reimbursement coverage (reinsurance) on their residential
property exposure.8 Pursuant its contract with the SBA, each insurer must pay an actuarially-indicated
annual premium for the reimbursement.9 The actuarial basis for the premium includes an analysis of
hurricane loss projection models found acceptable by the Florida Commission on Hurricane Loss
Projection Methodology, which is also part of the SBA.

Insurer Financial Condition

1 See s. 215.555, F.S.
2 See id.
3 Id. Retention is defined as the amount of losses below which an insurer is not entitled to reimbursement from the FHCF.
It is calculated for each insurer based upon that insurer’s proportionate share of overall premiums charged by the FHCF.
See s. 215.555(2)(e), F.S.
4 S. 215.555(2)(d), F.S.
5 S. 215.555(2)(c), F.S.
6 Authorized insurers are those insurers that have obtained a certificate of authority from OIR to transact insurance

business in Florida. S. 624.09(1), F.S.
7 S. 215.555(2)(c), F.S.
8 S. 215.555(4), F.S.
9 S. 215.555(5)(a), F.S.
STORAGE NAME: h0695d.COM PAGE: 2
DATE: 2/8/2022
As part of its regulation, OIR monitors the solvency of insurers to protect policyholders against the risk
that insurers will not be able to meet their financial responsibilities. OIR considers an insurer to be in an
unsound financial condition if:
 the insurer’s required surplus, capital, or capital stock is impaired to an extent prohibited by law;
 the insurer continues to write new business when it has not maintained the required surplus or
capital;
 the insurer attempted to dissolve or liquidate without making provisions for liabilities arising from
insurance policies that it issued; or
 the insurer meets one or more of the grounds in s. 631.051, F.S., for appointment of the
Department of Financial Services (DFS) as receiver. 10

Federal law specifies that insurers cannot file for bankruptcy. 11 Instead, insolvent insurers are either
rehabilitated or liquidated by the state. In Florida, the Division of Rehabilitation and Liquidation of DFS
is responsible for rehabilitating or liquidating insurance companies. 12

Chapter 631, F.S., relating to insurers insolvency and guaranty payments, governs the receivership
process. This process involves the initiation of a delinquency proceeding in circuit court and the
placement of in insurer under the control of DFS as the receiver. 13 Depending on the insurer’s
circumstances, the delinquency proceeding may result in an order of rehabilitation or liquidation. 14

Assumption of Residential Property Insurance Policies by Citizens

Citizens is a state-created, not-for-profit, tax-exempt government entity that is an integral part of the
state, whose public purpose is to provide property insurance to those unable to find affordable
coverage in the private market from an authorized insurer.15 Unlike private insurers, Citizens is not
required to hold a certificate of authority from OIR.16

A significant portion of Citizens’ total policy count consists of residential property insurance policies.
These policies include homeowners, mobile homeowners, dwelling fire, tenants, condominium unit
owners, and some other similar policies. Pursuant to its enabling statute, s. 627.351(6), F.S., Citizens
must enter into a reimbursement contract with the SBA for coverage from the FHCF for its residential
property insurance policies.17 While private carriers may select from various coverage levels available
from the FHCF, Citizens is statutorily required to purchase the highest available level of coverage from
the FHCF.18

Currently, if an insurer is placed in liquidation under ch. 631, F.S., and Citizens assumes policies from
such liquidated insurer, Citizens may obtain coverage from the FHCF for these policies under its
reimbursement contract with the SBA or by accepting an assignment of the liquidated insurer’s
reimbursement contract with the SBA.19 The assignment of the contract must be provided for in the
liquidation order or otherwise determined by the court as part of the delinquency proceedings involving

10 S. 624.80(2), F.S.
11 The Bankruptcy Code expressly provides that “a domestic insurance company” may not be the subject of federal
bankruptcy proceeding. 11 U.S.C. 109(b)(2). The exclusion of insurers from the federal bankruptcy process is consistent
with federal policy generally allowing states to regulate insurance. See 15 U.S.C. ss. 1011-1012.
12 Typically, insurers are put into liquidation when the company is insolvent, but put into rehabilitation for various other

reasons, including an unsound financial condition. The goal of rehabilitation is to return the insurer to a sound financial
condition. The goal of liquidation, however, is to dissolve the insurer. See s. 631.051, F.S., for the grounds for
rehabilitation and s. 631.061, F.S., for the grounds for liquidation.
13 S. 631.031, F.S.
14 See ss. 631.101 and 631.111, F.S.
15 S. 627.351(6)(a)1., F.S.
16 Citizens, Management Discussion and Analysis for 2017,

https://www.citizensfla.com/documents/20702/6867558/20180411+04E+MDA+2017.pdf/4584208b -1d87-4add-9a11-
55e818fe0046?t=1523029712990 (last visited Jan. 10, 2021).
17 Id.
18 Id.
19 State Board of Administration, Agency Analysis of 2022 Senate Bill 1058, p. 1 (Jan. 6, 2022). 2022 Senate Bill 1058 is

identical to this bill. See also s. 215.555(5)(e), F.S.
STORAGE NAME: h0695d.COM PAGE: 3
DATE: 2/8/2022
the liquidated insurer.20 The law does not address the transfer of FHCF coverage to Citizens if it
assumes policies from an authorized insurer that is in an unsound financial condition (unsound insurer),
but is not the subject of a delinquency proceeding.

Assumption of Residential Property Insurance Policies by Authorized Insurers

Under certain circumstances, OIR may approve the assumption of policies by an authorized insurer
(assuming insurer) from an unsound insurer or an insurer placed in receivership. However, current law
does not provide for the assignment to the assuming insurer of the FHCF coverage that the unsound
insurer or the insurer placed in receivership has on its policies.

Effect of the Bill

The bill allows any authorized insurer to receive the transfer of FHCF coverage along with policies that
it assumes from an unsound insurer, subject to an agreement with the SBA. The bill extends to
authorized insurers the requirements that exist when Citizens assumes policies from unsound insurers
and wishes to obtain coverage from the FHCF for those policies, and also establishes additional
requirements for both authorized insurers and Citizens.

The bill replaces the statutory phrase “placed in liquidation” with the defined term “unsound insurer” so
that FHCF coverage can be transferred to Citizens or an authorized insurer with policies that Citizens
or such authorized insurer assumes from an unsound insurer or a liquidated insurer.

The bill establishes that if a covered event has occurred before the effective date of the transfer of the
policies to the authorized insurer or Citizens, the authorized insurer or Citizens may only obtain
coverage from the FHCF subject to an assignment of the remaining term of the unsound insurer’s
FHCF contract.

The bill removes language regarding assignments that becomes obsolete if assignment is no longer
limited to policies from insurers that have been placed in liquidation under ch. 631, F.S. Finally, the bill
provides that the new language regarding assignment of policies from an unsound insurer does not
limit the FHCF’s right to receive premium due under the contract between an unsound insurer and the
FHCF.

B. SECTION DIRECTORY:
Section 1. Amends s. 215.555, F.S., relating to Florida Hurricane Catastrophe Fund.

Section 2. Provides an effective date of July 1, 2022.

II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT

A. FISCAL IMPACT ON STATE GOVERNMENT:

1. Revenues:

None.

2. Expenditures:

None.

B. FISCAL IMPACT ON LOCAL GOVERNMENTS:

20 S. 215.555(5)(e), F.S.
STORAGE NAME: h0695d.COM PAGE: 4
DATE: 2/8/2022
1. Revenues:

None.

2. Expenditures:

None.

C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:

None.

D. FISCAL COMMENTS:

None.

III. COMMENTS

A. CONSTITUTIONAL ISSUES:

1. Applicability of Municipality/County Mandates Provision:

Not applicable. The bill does not appear to affect county or municipal governments.

2. Other:

None.

B. RULE-MAKING AUTHORITY:

The bill neither authorizes nor requires administrative rulemaking.

C. DRAFTING ISSUES OR OTHER COMMENTS:

None.

IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES

STORAGE NAME: h0695d.COM PAGE: 5
DATE: 2/8/2022
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 695 2022

1 A bill to be entitled
2 An act relating to property insurer reimbursements;
3 amending s. 215.555, F.S.; defining the term "unsound
4 insurer"; revising requirements for coverage under the
5 Florida Hurricane Catastrophe Fund of certain policies
6 assumed by authorized insurers or the Citizens
7 Property Insurance Corporation; providing
8 construction; providing an effective date.
9
10 Be It Enacted by the Legislature of the State of Florida:
11
12 Section 1. Paragraph (e) of subsection (5) of section
13 215.555, Florida Statutes, is amended, and paragraph (p) is
14 added to subsection (2) of that section, to read:
15 215.555 Florida Hurricane Catastrophe Fund.—
16 (2) DEFINITIONS.—As used in this section:
17 (p) "Unsound insurer" means an insurer determined by the
18 Office of Insurance Regulation to be in unsound condition as
19 defined in s. 624.80(2) or an insurer placed in receivership
20 under chapter 631.
21 (5) REIMBURSEMENT PREMIUMS.—
22 (e)1. If an authorized insurer or the Citizens Property
23 Insurance Corporation assumes or otherwise provides coverage for
24 policies of an unsound insurer placed in liquidation under
25 chapter 631 pursuant to s. 627.351(6), the authorized insurer or

Page 1 of 3

CODING: Words stricken are deletions; words underlined are additions.
hb0695-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 695 2022

26 the Citizens Property Insurance Corporation may, pursuant to
27 conditions mutually agreed to between the authorized insurer or
28 the Citizens Property Insurance Corporation and the State Board
29 of Administration, seek to obtain coverage for such policies
30 under its contract with the fund or accept an assignment of the
31 unsound liquidated insurer's contract with the fund. However, if
32 a covered event has occurred before the effective date of the
33 transfer of the policies, the authorized insurer or the Citizens
34 Property Insurance Corporation may obtain coverage for such
35 policies only through an assignment as provided in subparagraph
36 3.
37 2. If an authorized insurer or the Citizens Property
38 Insurance Corporation assumes policies from an unsound insurer
39 and elects to cover these policies under its the corporation's
40 contract with the fund, it shall notify the board of its insured
41 values with respect to such policies within a specified time
42 mutually agreed to between the authorized insurer or the
43 Citizens Property Insurance Corporation and the board, after
44 such assumption or other coverage transaction, and the fund
45 shall treat such policies as having been in effect as of June 30
46 of that year.
47 3. If an authorized insurer or the Citizens Property
48 Insurance Corporation accepts In the event of an assignment of
49 an unsound insurer's contract, the fund shall apply the unsound
50 insurer's that contract to such policies and treat the

Page 2 of 3

CODING: Words stricken are deletions; words underlined are additions.
hb0695-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 695 2022

51 authorized insurer or the Citizens Property Insurance
52 Corporation as if it the corporation were the unsound liquidated
53 insurer for the remaining term of the contract, with and the
54 corporation shall have all rights and duties of the unsound
55 liquidated insurer beginning on the date it provides coverage
56 for such policies. This subparagraph may not be construed to
57 limit the fund's right to receive the premium due under the
58 unsound insurer's contract, but the corporation is not subject
59 to any preexisting rights, liabilities, or duties of the
60 liquidated insurer. The assignment, including any unresolved
61 issues between the liquidated insurer and Citizens Property
62 Insurance Corporation under the contract, shall be provided for
63 in the liquidation order or otherwise determined by the court.
64 However, if a covered event occurs before the effective date of
65 the assignment, the corporation may not obtain coverage for such
66 policies under its contract with the fund and shall accept an
67 assignment of the liquidated insurer's contract as provided in
68 this paragraph.
69 Section 2. This act shall take effect July 1, 2022.

Page 3 of 3

CODING: Words stricken are deletions; words underlined are additions.
hb0695-00
HB 1565
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 1565 Pub. Rec./Consumer Data Privacy
SPONSOR(S): McFarland
TIED BILLS: HB 9 IDEN./SIM. BILLS:

REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF

1) Commerce Committee Wright Hamon

2) Judiciary Committee

SUMMARY ANALYSIS
As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to contextualize
consumer data. Businesses use it for a range of purposes. The European Union, California, and a few other
states have enacted data privacy regulations to protect consumers’ personal information and give consumers
more control over how their information is used.

HB 9, to which this bill is linked, gives certain consumer rights related to personal information, including:
 The right to access personal information collected about them;
 The right to delete or correct their personal information; and
 The right to opt-out of the sale or sharing of their personal information to third parties.

The Department of Legal Affairs (DLA), upon belief that any controller, processor, or other person is in violation
of HB 9’s provisions, may bring an action under the Florida Unfair or Deceptive Trade Practices Act against a
controller, processor, or other person.

This bill, which is linked to the passage of HB 9, provides that all information received by DLA pursuant to a
notification or investigation by DLA or a law enforcement agency of a violation is confidential and exempt from
public record requirements. The bill provides that the information may be released during an active
investigation:
• In the furtherance of official duties and responsibilities;
• For print, publication, or broadcast to notify the public of a data breach; or
• To another governmental entity in the furtherance of its official duties and responsibilities.

Once an investigation is completed, the following information will remain confidential and exempt:
• All information to which another public records exemption applies;
• Personal information;
• A computer forensic report;
• Information that would otherwise reveal weaknesses in data security; and
• Information that would otherwise disclose proprietary information.

The bill provides that the public record exemption is subject to the Open Government Sunset Review Act and
will repeal on October 2, 2027, unless the Legislature reviews and reenacts the exemption by that date.

Article I, s. 24(c) of the Florida Constitution requires a two-thirds vote of the members present and
voting for final passage of a newly created or expanded public record or public meeting exemption.
The bill creates a public record exemption; thus, it requires a two-thirds vote for final passage.

This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h1565.COM
DATE: 2/8/2022
FULL ANALYSIS

I. SUBSTANTIVE ANALYSIS

A. EFFECT OF PROPOSED CHANGES:
Public Records

Article I, s. 24(a) of the State Constitution sets forth the state’s public policy regarding access to
government records. This section guarantees every person a right to inspect or copy any public record
of the legislative, executive, and judicial branches of government. The Legislature, however, may
provide by general law for the exemption of records from the requirements of Article I, section 24(a). 1
The general law must state with specificity the public necessity justifying the exemption 2 and must be
no more broad than necessary to accomplish its purpose.3

Public policy regarding access to government records is addressed further in the Florida Statutes.
Section 119.07(1), F.S., guarantees every person a right to inspect and copy any state, county, or
municipal record, unless the record is exempt. Furthermore, the Open Government Sunset Review Act 4
provides that a public record or public meeting exemption may be created or maintained only if it serves
an identifiable public purpose. In addition, it may be no broader than is necessary to meet one of the
following purposes:
 Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
 Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
 Protect trade or business secrets.5

The Open Government Sunset Review Act requires the automatic repeal of a newly created exemption
on October 2nd of the fifth year after creation or substantial amendment, unless the Legislature
reenacts the exemption.6

Consumer Data Privacy

As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to
contextualize consumer data. Businesses use it for a range of purposes, including better understanding
day-to-day operations, making more informed business decisions and learning about their customers. 7

The European Union, several other countries, California, and a few other states have enacted data
privacy regulations to protect such data and give consumers more control over how their information is
used. Florida does not have a broad data privacy law, but there is a law which governs what actions
must be taken by certain government and business entities in the event of a data breach of personal
information.8

Department of Legal Affairs

The Office of the Attorney General, also known as the Department of Legal Affairs (DLA), provides a
wide variety of legal services, including defending the state in civil litigation cases, representing the

1 Art. I, s. 24(c), FLA. C ONST.
2 This portion of a public record exemption is commonly referred to as a “public necessity statement.”
3 Art. I, s. 24(c), FLA. C ONST.
4 Section 119.15, F.S.
5 Section 119.15(6)(b), F.S.
6 Section 119.15(3), F.S.
7 Max Freedman, How Businesses Are Collecting Data (And What They’re Doing With It), Business News Daily (Jun. 17, 2020)

https://www.businessnewsdaily.com/10625-businesses-collecting-data.html.
8 S. 501.171, F.S.

STORAGE NAME: h1565.COM PAGE: 2
DATE: 2/8/2022
people of Florida in criminal appeals in state and federal courts, protecting rights of children,
consumers, and victims through its various protection programs, and investigating and litigating against
businesses that seek to limit competition and defraud taxpayers. 9

HB 9

HB 9, to which this bill is linked, gives certain consumer rights related to personal information,
including:
• The right to access personal information collected on them by a controller;
• The right to delete or correct their personal information; and
• The right to opt-out of the sale or sharing of their personal information to third parties.

A “controller” is a for profit entity that does business in Florida, collects and controls personal
information, and satisfies two or more of the following thresholds:
• Has global annual gross revenues in excess of $50 million, as adjusted in January of every odd-
numbered year to reflect any increase in the Consumer Price Index.
• Annually buys, receives, sells, or shares the personal information of 50,000 or more consumers,
households, or devices for targeted advertising in conjunction with third parties or that is not
covered by an exception.
• Derives 50 percent or more of its global annual revenues from selling or sharing personal
information about consumers.

Under the bill, personal information is information that identifies, relates to, or describes a particular
consumer or household, or is reasonably capable of being directly or indirectly associated or linked
with, a particular consumer or household. The term does not include public information from
government records, certain employment information, or deidentified or aggregate consumer
information.

The bill proscribes certain operational requirements on controllers with respect to collecting, selling, or
sharing personal information with processors or third parties.

DLA, upon belief that any controller, processor, or other person or entity is in violation of the consumer
data requirement provisions, may bring an action under the Florida Unfair or Deceptive Trade Practices
Act against a controller, processor, or other person.

Effect of the Bill

The bill creates a public record exemption for all information received by DLA pursuant to a notification
or investigation by DLA or a law enforcement agency of a violation of certain statutory requirements.
Such information is made confidential and exempt10 from public record requirements.

During an active investigation, information made confidential and exempt may be disclosed by DLA:
• In the furtherance of its official duties and responsibilities;
• For print, publication, or broadcast if DLA determines that such release would assist in notifying
the public or locating or identifying a person that DLA believes to be a victim of a data breach or
improper use or disposal of customer records, except that information made confidential and
exempt after an investigation may not be released in this manner; or
• To another governmental entity in the furtherance of its official duties and responsibilities.

9 OPPAGA, Office of the Attorney General (Department of Legal Affairs ),
https://oppaga.fl.gov/ProgramSummary/ProgramDetail?programNumber=1026 (last visited Feb. 6, 2022).
10 There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature

deems confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain circum stances.
See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied 892 So.2d 1015 (Fla. 2004); City of
Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA 1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5 th DCA 1991). If
the Legislature designates a record as confidential and exempt from public disclosure, such record may not be released by the
custodian of public records, to anyone other than the persons or entities specifically designated in statute. See Op. Att’y Gen. Fla.
(1985).
STORAGE NAME: h1565.COM PAGE: 3
DATE: 2/8/2022
Once an investigation is completed or once an investigation ceases to be active, the following
information received by DLA will remain confidential and exempt:
 All information to which another public records exemption applies;
 Personal information;
 A computer forensic report;
 Information that would otherwise reveal weaknesses in a controller’s, processor’s, or other
person’s data security; and
 Information that would otherwise disclose a controller’s, processor’s, or other person’s
proprietary information.

The term "proprietary information" means information that:
 Is owned or controlled by the controller, processor, or other person;
 Is intended to be private and is treated by the controller, processor, or other person as private
because disclosure would harm the controller, processor, or other person or its business
operations;
 Has not been disclosed except as required by law or a private agreement that provides that the
information will not be released to the public;
 Is not publicly available or otherwise readily ascertainable through proper means from another
source in the same configuration as received by DLA; and
 Includes trade secrets and competitive interests.

The bill provides a public necessity statement as required by article I, section 24(c) of the Florida
Constitution. The public necessity statement provides that, if released, information received by DLA
pursuant to an investigation by DLA or a law enforcement agency could:
 Frustrate or thwart the investigation and impair the ability of DLA to perform assigned functions;
 Undo a specific statutory exemption protecting the information;
 Be used for the purpose of identity theft;
 Result in the identification of vulnerabilities; and
 Result in economic harm.

The bill provides that the public record exemption is subject to the Open Government Sunset Review
Act and will repeal on October 2, 2027, unless the Legislature reviews and reenacts the exemption by
that date.

The bill will become effective on the same date that HB 9 or similar legislation takes effect, if such
legislation is adopted in the same legislative session or an extension thereof and becomes a law.

B. SECTION DIRECTORY:
Section 1: Creates a public records exemption for investigations related to s. 501.173, F.S.
Section 2: Provides a public necessity statement as required by the Florida Constitution.
Section 3: Provides an effective date of the same date that HB 9 or similar legislation takes effect, if
such legislation is adopted in the same legislative session or an extension thereof and
becomes law.

II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT

A. FISCAL IMPACT ON STATE GOVERNMENT:

1. Revenues:
None.

2. Expenditures:
See Fiscal Comments.
STORAGE NAME: h1565.COM PAGE: 4
DATE: 2/8/2022
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:

1. Revenues:
None.

2. Expenditures:
None.

C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.

D. FISCAL COMMENTS:
The bill may have a minimal fiscal impact on DLA because agency staff responsible for complying with
public records requests may require training related to the creation of the public records exemption.
DLA could incur costs associated with redacting the exempt information prior to releasing a record. The
costs, however, would be absorbed by existing resources, as they are part of the day-to-day
responsibilities of agencies.

III. COMMENTS

A. CONSTITUTIONAL ISSUES:

1. Applicability of Municipality/County Mandates Provision:
Not applicable. The bill does not appear to require counties or municipalities to take an action
requiring the expenditure of funds, reduce the authority that counties or municipalities have to raise
revenue in the aggregate, nor reduce the percentage of state tax shared with counties or
municipalities.

2. Other:
Vote Requirement

Article I, section 24(c) of the Florida Constitution requires a two-thirds vote of the members present
and voting for final passage of a newly created or expanded public record or public meeting
exemption. The bill creates a public record exemption; thus, it requires a two-thirds vote for final
passage.

Public Necessity Statement

Article I, section 24(c) of the Florida Constitution requires a public necessity statement for a newly
created or expanded public record or public meeting exemption. The bill creates a public record
exemption; thus, it includes a public necessity statement.

Breadth of Exemption

Article 1, section 24(c) of the Florida Constitution requires a newly created or expanded public record
or public meeting exemption to be no broader than necessary to accomplish the stated purpose of
the law. The bill creates a public records exemption for sensitive investigative materials and personal
information, which does not appear to be broader than necessary to accomplish its purpose.

B. RULE-MAKING AUTHORITY:
None.

STORAGE NAME: h1565.COM PAGE: 5
DATE: 2/8/2022
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.

IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES

STORAGE NAME: h1565.COM PAGE: 6
DATE: 2/8/2022
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

1 A bill to be entitled
2 An act relating to public records; amending s.
3 501.173, F.S.; providing an exemption from public
4 records requirements for information relating to
5 investigations by the Department of Legal Affairs and
6 law enforcement agencies of certain data privacy
7 violations; providing for future legislative review
8 and repeal of the exemption; providing a statement of
9 public necessity; providing a contingent effective
10 date.
11
12 Be It Enacted by the Legislature of the State of Florida:
13
14 Section 1. Subsection (14) is added to section 501.173,
15 Florida Statutes, as created by HB 9, 2022 Regular Session, to
16 read:
17 501.173 Consumer data privacy.—
18 (14) PUBLIC RECORDS EXEMPTION.—
19 (a) All information received by the department pursuant to
20 a notification of a violation under this section, or received by
21 the department pursuant to an investigation by the department or
22 a law enforcement agency of a violation of this section, is
23 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
24 of the State Constitution, until such time as the investigation
25 is completed or ceases to be active. This exemption shall be

Page 1 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

26 construed in conformity with s. 119.071(2)(c).
27 (b) During an active investigation, information made
28 confidential and exempt pursuant to paragraph (a) may be
29 disclosed by the department:
30 1. In the furtherance of its official duties and
31 responsibilities;
32 2. For print, publication, or broadcast if the department
33 determines that such release would assist in notifying the
34 public or locating or identifying a person that the department
35 believes to be a victim of a data breach or improper use or
36 disposal of customer records, except that information made
37 confidential and exempt by paragraph (c) may not be released
38 pursuant to this subparagraph; or
39 3. To another governmental entity in the furtherance of
40 its official duties and responsibilities.
41 (c) Upon completion of an investigation or once an
42 investigation ceases to be active, the following information
43 received by the department shall remain confidential and exempt
44 from s. 119.07(1) and s. 24(a), Art. I of the State
45 Constitution:
46 1. All information to which another public records
47 exemption applies.
48 2. Personal information.
49 3. A computer forensic report.
50 4. Information that would otherwise reveal weaknesses in

Page 2 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

51 the data security of a controller, processor, or person.
52 5. Information that would disclose the proprietary
53 information of a controller, processor, or person.
54 (d) For purposes of this subsection, the term "proprietary
55 information" means information that:
56 1. Is owned or controlled by the controller, processor, or
57 person.
58 2. Is intended to be private and is treated by the
59 controller, processor, or person as private because disclosure
60 would harm the controller, processor, or person or its business
61 operations.
62 3. Has not been disclosed except as required by law or a
63 private agreement that provides that the information will not be
64 released to the public.
65 4. Is not publicly available or otherwise readily
66 ascertainable through proper means from another source in the
67 same configuration as received by the department.
68 5. Includes:
69 a. Trade secrets as defined in s. 688.002.
70 b. Competitive interests, the disclosure of which would
71 impair the competitive advantage of the controller, processor,
72 or person who is the subject of the information.
73 (e) This subsection is subject to the Open Government
74 Sunset Review Act in accordance with s. 119.15 and shall stand
75 repealed on October 2, 2027, unless reviewed and saved from

Page 3 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

76 repeal through reenactment by the Legislature.
77 Section 2. The Legislature finds that it is a public
78 necessity that all information received by the Department of
79 Legal Affairs pursuant to a notification of a violation of s.
80 501.173, Florida Statutes, or received by the department
81 pursuant to an investigation by the department or a law
82 enforcement agency of a violation of s. 501.173, Florida
83 Statutes, be made confidential and exempt from s. 119.07(1),
84 Florida Statutes, and s. 24(a), Article I of the State
85 Constitution for the following reasons:
86 (1) A notification of a violation of s. 501.173, Florida
87 Statutes, may result in an investigation of such violation. The
88 premature release of such information could frustrate or thwart
89 the investigation and impair the ability of the department to
90 effectively and efficiently administer s. 501.173, Florida
91 Statutes. In addition, release of such information before
92 completion of an active investigation could jeopardiz e the
93 ongoing investigation.
94 (2) Release of information to which another public record
95 exemption applies once an investigation is completed or ceases
96 to be active would undo the specific statutory exemption
97 protecting that information.
98 (3) An investigation of a violation of s. 501.173, Florida
99 Statutes, is likely to result in the gathering of sensitive
100 personal information, including identification numbers, unique

Page 4 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

101 identifiers, professional or employment-related information, and
102 personal financial information. Such information could be used
103 for the purpose of identity theft. The release of such
104 information could subject possible victims of data privacy
105 violations to further harm.
106 (4) Notices received by the department and information
107 received during an investigation of a violation of s. 501.173,
108 Florida Statutes, are likely to contain proprietary information.
109 Such information, including trade secrets, derives independent,
110 economic value, actual, or potential, from being generally
111 unknown to, and not readily ascertainable by, other persons who
112 might obtain economic value from its disclosure or use. Allowing
113 public access to proprietary information, including a trade
114 secret, through a public records request could destroy the value
115 of the proprietary information and cause a financial loss to the
116 controller, processor, or person submitting the information.
117 Release of such information could give business competitors an
118 unfair advantage and weaken the position of the entity supplying
119 the proprietary information in the marketplace.
120 (5) Information received by the department may contain a
121 computer forensic report or information that could reveal
122 weaknesses in the data security of a controller, processor, or
123 person. The release of this information could result in the
124 identification of vulnerabilities in the cybersecurity system of
125 the controller, processor, or person and be used to harm the

Page 5 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

HB 1565 2022

126 controller, processor, or person and clients.
127 (6) The harm that may result from the release of
128 information received by the department pursuant to a
129 notification or investigation by the department or a law
130 enforcement agency of a violation of s. 501.173, Florida
131 Statutes, could impair the effective and efficient
132 administration of the investigation and thus, outweighs the
133 public benefit that may be derived from the disclosure of the
134 information.
135 Section 3. This act shall take effect on the same date
136 that HB 9 or similar legislation takes effect, if such
137 legislation is adopted in the same legislative session or an
138 extension thereof and becomes a law.

Page 6 of 6

CODING: Words stricken are deletions; words underlined are additions.
hb1565-00

File and source

File: 2022-02-10_3098_commerce-committee_meeting-packets_fn-com-2-10-22.pdf
Size: 2,364,561 bytes
SHA-256: 83d55035f5c65cf6e7291d8f3e7aa59dfbf4a83365fdbd0c3c96000563f5927e
Our copy: 2022-02-10_3098_commerce-committee_meeting-packets_fn-com-2-10-22.pdf
Original: No public link identified.