Florida Lawmakers Introduce Online Privacy Legislation

Excluded from the definition of operators are third-parties that host a website on behalf of an operator, GLBA and HIPAA-regulated entities, and motor vehicle manufacturers/repairers under certain circumstances.

What Information Is Covered?

Covered information, which is defined as the following types of information if collected through a website or online service: first and last name; home or other physical address that includes the name of a street and the name of a city or town; email address; telephone number; Social Security number; identifier that allows a consumer to be contacted either physically or online; and any other information concerning a consumer that is collected from the consumer through the website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.

What Rights Are Created?

Consumers would have the right to submit a verified request to an operator directing the operator not to sell any covered information the operator has or will collect about the consumer.

The act defines "sale" narrowly to mean "the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons." There are also five exceptions to the definition of sale, including the disclosure of information to processors, the disclosure of information to other persons for purposes of providing a product or service requested by the consumer and the disclosure of information to affiliates.

Are There Any Exemptions?

In addition to the above noted exemptions, the proposed law would not apply to an operator: who is located in Florida, whose revenue is derived primarily from a source other than the sale or lease of goods, services or credit on websites or online services, and whose website or online service has fewer than 20,000 unique visitors per year.

Would Companies Need to Update Their Online Privacy Policies?

Maybe. Similar to CalOPPA and comparable laws in Nevada and Delaware, the law would require operators to provide a notice that:

• Identifies the categories of covered information that the operator collects through its website or online service about consumers who use or visit the website or online service and the categories of third parties with whom the operator may share such covered information.
• Provides a description of the process, if applicable, for a consumer who uses or visits the website or online service to review and request changes to any of his covered information that is collected through the website or online service.
• Describes the process by which the operator notifies consumers who use or visit the website or online service of material changes to the notice.
• Discloses whether a third party may collect covered information about a consumer's online activities over time and across different websites or online services when the consumer uses the operator's website or online service.
• States the effective date of the notice.

Operators that already comply with the laws in California, Nevada and Delaware presumably would not need to update their disclosures (unless there was some unique aspect of the data being collected about Florida residents).

Notably, as is the case with Nevada's law, the act does not appear to require operators to disclose the right to opt-out in their online privacy notice. However, operators that have chosen to provide such a notice to Nevada residents could, in theory, just add a comparable Florida notice.

How Would It be Enforced?

The law would be enforced by the Florida Attorney General's office. Prior to bringing an enforcement action, operators would need to be notified of the violation and provide 30 days to cure. It is not clear that the notice would need to come from the AG's office (as opposed to a consumer complaint). The AG's office could seek a civil penalty of up to $5,000 per violation.

Would It Create a Private Right of Action?

No.

When Would It be Effective?

It goes into effect July 1.

Conclusion

The act would prohibit the use of personal data contained in public records for certain marketing, soliciting and contact without the person's consent.

*****

David M. Stauss is a partner at Husch Blackwell and co-leader of the firm's privacy and data security practice group. He regularly assists clients in preparing for and responding to data security incidents, including managing multi-state breach notifications. Malia Rogers is an attorney in the firm's Denver office and assists clients on emerging data privacy issues.