CS/CS/CS/HB 969 - Consumer Data Privacy

• Creates comprehensive consumer data privacy protections requiring controllers (entities collecting personal data) to disclose data collection practices, implement reasonable security measures, and maintain updated privacy policies

• Grants consumers rights to request access to their personal information, request deletion or correction of inaccurate data, and opt-out of the sale or sharing of their personal information to third parties

• Prohibits controllers from selling or sharing personal information of minors under age 16 without consent (ages 13-16) or parental consent (ages 12 and under)

• Establishes private right of action allowing consumers to sue for violations, with damages ranging from $100-$750 per incident or actual damages, plus attorney fees; Department of Legal Affairs may enforce as unfair/deceptive trade practice with civil penalties that can be tripled for violations involving minors

• Applies to for-profit entities doing business in Florida that meet threshold requirements (over $50 million in annual revenue, sell 50,000+ consumers' data for targeted advertising, or derive 50%+ revenue from selling personal information); effective July 1, 2022