The Impacts of Consumer Data Privacy on Florida’s Economy
A Detailed Look at HB 9 and SB 1864
The 2022 Florida Legislature is considering two pieces of consumer data privacy legislation that would represent significant changes to how certain businesses collect, sell, and share consumer personal information, subject to certain exemptions and threshold requirements. Florida TaxWatch undertakes this independent review to provide an updated analysis of the potential impacts of enacting consumer data privacy in light of recent changes during the 2022 Florida legislative session. The analysis also incorporates newer empirical findings from a study examining consumer data privacy across different states.
HB 9 --- Creates obligations for certain for-profit businesses (referred to as “controllers” and “processors”), such as publishing a privacy policy and limiting the collection/use of personal information for only disclosed purposes. The bill also creates consumer rights, including the right to access personal information, the right to delete/correct personal information, and the right to opt out of the sale/sharing of personal information. A private right of action is provided when a controller, processor, or third-party fails to respond to a delete/correction request or continues to sell/share information after an opt-out has been received.
SB 1864 --- Creates the “Florida Privacy Protection Act” (FPPA) that would prescribe certain business obligations for controllers and processors meeting certain threshold requirements. Consumers are provided with certain rights to access, delete, correct, or opt out of the processing of personal information for targeted advertising or profiling. The bill does not allow for a private right of action but provides the Department of Legal Affairs with enforcement powers.
HB 9 would lead to 10 new privacy restrictions, reducing Florida’s GOS by 3.9 percent or roughly $17.2 billion annually. In comparison, SB 1864 would create nine new privacy restrictions, reducing Florida’s GOS by 3.5 percent or roughly $15.5 billion annually. Both estimates are within the Florida TaxWatch range offered previously. There are also secondary effects worth noting, such as the potential for small businesses to still incur a compliance cost due to market expectations and the potential for frivolous lawsuits through a private right of action.
Florida TaxWatch believes that affording consumers greater rights over their personal information and privacy is a good idea; however, policymakers should ensure they know the true cost of implementing consumer data privacy before enacting a comprehensive, wide-reaching law. Duplicative compliance and enforcement across a patchwork of state laws will generate direct compliance costs and unintentional consequences that will only grow as more states consider their own legislation. Absent any unifying federal framework, these costs appear unavoidable but can be minimized to a degree.
Florida TaxWatch commends the Florida Legislature for its endeavor to address consumer data privacy and recommends the following measures to mitigate adverse costs and unintentional consequences:
1. Enforcement is seen as a central part of consumer data privacy legislation, enabling accountability when actors are non-compliant however, a private right of action creates legal risk for frivolous litigation. The Florida Legislature should consider enforcement mechanisms through the Department of Legal Affairs, as is the case in Colorado, Virginia, and California’s consumer data privacy laws.
2. Assuming a private right of action is still included in any bill, language should be included that establishes a cure period by which a business can respond to an intent to sue, potentially remedying the purported non-compliance before going to court. Furthermore, legislative language should be included that creates a “two-way” attorney fee provision in which the prevailing party would be awarded attorney fees and costs.
3. Consideration should be given to pushing back the effective date to 2024. Ensuring covered companies have adequate time to build out systems and processes to comply would help prevent unintentional noncompliance and resulting enforcement problems.
4. The Florida Legislature should provide an official estimate of the economic cost of implementing consumer data privacy in Florida. Consideration should be given to making a formal assessment of both direct and indirect costs to large and small firms in Florida over time. Any estimate should also examine how the costs would fluctuate in response to a growing patchwork of other state consumer data privacy laws.