Private Right Splits Fla., Wash. Chambers Amid Deadlines

Disagreement on enforcement through private lawsuits threatens to derail two state privacy bills. The Washington state legislature ends regular session Sunday, and the Florida legislature closes April 30. Each state’s House supported including a private right of action, while their Senates seek only attorney general enforcement. Either state could become the third to pass a comprehensive law, after California and Virginia.

The Florida House voted 118-1 for HB-969 with a private right of action Wednesday (see 2104210037). Senators removed that provision from its SB-1734. The Senate is expected to vote Monday or Tuesday, an aide for HB-969 sponsor Rep. Fiona McFarland (R) told us Thursday. House and Senate leaders are talking to Gov. Ron DeSantis (R) about what he wants in the final law, said the aide. DeSantis, House Speaker Chris Sprowls (R), Senate President Wilton Simpson (R) and SB-1734 sponsor Sen. Jennifer Bradley (R) didn’t comment.

There's “nothing scheduled yet” on Washington lawmakers voting on SB-5062, but talks continue, emailed a House Democrats spokesperson Thursday. There was confusion after sponsor Sen. Reuven Carlyle (D) and House Judiciary Committee Chairman Drew Hansen (D) said the measure lived despite missing an April 11 deadline for bills to pass their opposite chamber (see 2104120042). Carlyle didn’t comment now.

Florida’s law could have big global impact, because the House bill would include the most expansive private right of any privacy law in the world, said Carlton Fields’ Steven Blickensderfer in an interview. Although some members raised concerns about including the private cause, the provision is still about as expansive as ever and passed by a nearly unanimous vote, said the Miami privacy attorney. If a bill with such large teeth is enacted, it "could be the greatest argument for [federal] preemption.”

Florida might be first in the U.S. to limit how long companies can retain customer data in a comprehensive privacy bill -- two years in the House bill, Blickensderfer said. Businesses probably will apply the strictest parts of each state’s law across the country, he said. It might make the most sense to start with the toughest law, California, then add pieces from other states, like Virginia’s impact assessment requirement and possibly Florida’s data retention requirement, if enacted, he said. “There’s such a need for a standard across the board to make compliance realistic.”

The nearly unanimous Florida House vote removed any doubt that Sprowls “is fully aligned with the plaintiffs’ bar,” Shook Hardy’s Al Saikali, a Miami privacy lawyer, blogged Wednesday: The Senate bill “still needs to go through a second and third reading, which is not expected to be completed until early next week (if at all).”

“The proper method of enforcement is the same stumbling block that doomed the Washington Privacy Act in 2019, 2020, and (apparently) 2021,” blogged Husch Blackwell’s David Stauss. “Whether Florida lawmakers can reconcile their differences remains to be seen.”

Though told that the Washington Senate bill is in play until the end of session, the American Civil Liberties Union has “reason to believe that there is not enough Democratic support to pass the bill in its current form,” said Jennifer Lee, ACLU-Washington technology and liberty project manager. “We are not sure if and when it may come up for a House vote ... We have shared with lawmakers that this bill should be considered done for this session.”

Maryland’s legislature closed April 12 without passing its comprehensive privacy bill. The Nevada Senate voted 21-0 Tuesday to pass a data broker privacy bill, which would expand on an earlier privacy law (see 2103310061). It awaits House consideration. The Alaska House Commerce Committee plans to hear testimony on HB-159 Friday at noon EDT.