Republican State Privacy Bills Advance

The Wisconsin Assembly voted 59-37 Wednesday to send a comprehensive privacy bill (AB-957) to the Senate. In Florida, the House Judiciary Committee voted 13-4 to send HB-9 to the House floor despite Democrats voting no due to business concerns. The panel supported an amendment by sponsor Rep. Fiona McFarland (R) that would take a tiered approach to the bill’s private right of action (PRA). An industry-backed Utah privacy bill also advanced Wednesday.

“With great power also comes great responsibility,” and Wisconsin’s bill is a “first step” to protect consumers’ private information, said sponsor Rep. Shannon Zimmerman (R) at the livestreamed floor session. “This is a huge issue facing America,” said Rep. Shae Sortwell (R). “The idea that you somehow don’t control [your personal] information is mind-boggling.” The Assembly adopted an amendment including language to expand the right to delete to include personal data obtained from a source other than the consumer.

Florida’s HB-9 cleared a previous committee with unanimous support (see 2202100040), but in Judiciary, four of seven Democrats voted no. No Republicans opposed. The committee defeated six amendments by Rep. Andrew Learned (D), who said the bill “is going to hurt Florida businesses.” Rep. Ramon Alexander (D) complained the bill is just politics against Big Tech.

One of Learned’s failed amendments would have added a 45-day right to cure to the PRA, and two other Democrats said they wished the bill contained such a right. Rep. Dianne Hart (D) said she had planned to support the bill but testimony and messages to her phone during the hearing convinced her she shouldn’t support the bill without giving businesses power to cure. Rep. Ben Diamond (D) said he might support the bill later with such a right. HB-9 currently has a right to cure only for attorney general enforcement.

"Let's talk about tech and how they trade people like baseball cards,” said Rep. Mike Beltran (R): Concerns about how attorney fees will apply can be worked out. Florida can’t wait for Congress to act, said Vice Chair Cord Byrd (R), also supporting HB-9. “I like federalism.”

McFarland feels like up is down and down is up when she hears Democrats “protecting companies’ profits” and Republicans “advocating for consumer rights,” she said.

Under the amended bill’s tiered PRA, no private suits would be allowed against businesses with less than $50 million in annual revenue. They could be brought against companies making $50 million to $500 million, but those companies wouldn’t have to pay attorney fees. Companies making more than $500 million could face private suits and pay attorney fees. Other McFarland changes included moving up the proposed law’s effective date to Jan. 1.

The committee voted 12-5 against Learned’s right-to-cure amendment, while defeating by voice his other proposed changes including limiting the bill’s scope and increasing to 45 days from 48 hours how long a company would have to honor a consumer’s request to opt out of sale or sharing of data.

Earlier that day in Utah, the Senate Revenue and Taxation Committee unanimously by voice cleared a privacy bill that was generally supported by industry and opposed by Consumer Reports. SB-227 must clear both legislative chambers before the session ends March 4. "I will continue to work on this, understanding we have just over a week left,” said sponsor Sen. Kirk Cullimore (R) at the livestreamed hearing.

Cullimore pitched his bill as a less burdensome model for state privacy legislation. He said he developed it with State Privacy and Security Coalition counsel Anton van Seventer of DLA Piper. Van Seventer said it’s different from California and Virginia bills and could be a good model for other states because it avoids unnecessary red tape and confusing requirements. Later in the hearing, TechNet Executive Director Dylan Hoffman said he agrees with van Seventer’s testimony.

Sen. Wayne Harper (R) raised concerns about exemptions. Cullimore agreed the bill contains “pretty significant carve-outs” but said the point is to focus on the biggest companies that primarily sell consumer data. The bill does little to protect personal information or restrict big tech companies like Google or Facebook, said CR Senior Policy Analyst Maureen Mahoney. Modify sale and targeted advertising definitions and add a global opt-out that would at least honor browser privacy signals, she said.

Microsoft thinks Utah's bill is a “good start” but suggests aligning it more with Colorado’s privacy law, said Senior Director-Public Policy Ryan Harkins. He suggested edits to definitions of sale and consent and expanding the right to delete to include consumer data that a company received from a third party.

In Washington state, the House’s privacy bill HB-1850 remains alive, even though Feb. 15 was the last day to pass bills in the house of origin, because bills with a fiscal impact aren’t subject to normal cutoffs. HB-1850 cleared a House committee earlier this month (see 2202030022). A separate House bill (HB-1433) died. Last year’s Washington Privacy Act (SB-5062) by Sen. Reuven Carlyle (D) was added Feb. 17 to the X-File, a list of bills that won’t go to the floor. Carlyle’s alternative privacy bill SB-5813 didn’t get a committee vote before the Feb. 3 deadline for most bills or Feb. 7 deadline for fiscal bills.

It's too soon to declare Washington privacy legislation dead, but it “doesn't seem like there's a lot of momentum,” said privacy attorney David Stauss on a Husch Blackwell webinar Wednesday.