Despite concerns expressed by House Democrat Ben Diamond about the private right of action, HB 969 passed second reading in the Florida House of Representatives today. The bill now moves to a 3rd reading, which is the last step to passage by the House.

HB 969 would be the most aggressive privacy law in the country, allowing for a private right of action for: (1) data breaches of personal information (broadly defined); (2) a company’s failure to comply with a consumer’s request to delete personal information; (3) a company’s failure to comply with a consumer’s request to correct personal information; and (4) a company’s failure to comply with a consumer’s request to opt out of the sale of their personal information.  Unlike the CCPA, which limits the data breach private right of action to breaches of sensitive information and provides a right to cure, HB 969’s private right of action would apply to a data breach of the broad definition of personal information and the bill contains no opportunity to cure.  It is possible an amendment to HB 969 could be introduced between now and the 3rd reading.

Meanwhile, the Senate version of its privacy law (SB 1734) awaits second reading. That bill would create a more moderate version of a privacy law that would not include a private right of action, would be limited to the sale of personal information, and would be limited in scope to companies that buy or sell a significant amount of personal information.  The Senate version has its own problems, like the fact it adds requirements for “sensitive data” but doesn’t define what that means, and the fact that it requires companies to comply with opt-out requests within two days.

Assuming both versions of the law pass their respective chamber, the Florida Legislature would then have until April 30th to pass a unified version.

In short, we have entered the “fourth quarter” and the score is tied.