Proposed Legislation in Florida Includes Electing Insurance Commissioner and Consumer Data Privacy

Florida is considering legislation to establish an elected rather than appointed insurance commissioner and to enact consumer data privacy laws, a gaining trend in the United States.

Insurance Commissioner – If enacted, Senate Joint Resolution (SJR) 1460 would make Florida the twelfth state to elect its insurance commissioner. The great majority of states, currently 39, have appointed insurance commissioners. In 37 of those states, appointments are made by the governor, and in the remaining two, of which Florida is one, they are appointed by a commission. SJR 1460 would add the insurance commissioner role to the governor's cabinet. The first elected commissioner of insurance of Florida would assume office in January of 2023.

Privacy Legislation – Identical Consumer Data Privacy bills introduced in both the Florida House (HB 963) and Senate (SB 1670) continues the momentum from 2019 across several states to grant consumers greater control over their personal data. Twelve states introduced consumer data privacy laws in 2019, many of those modeled after the California Consumer Privacy Act (CCPA) which became effective on January 1, 2020, and is widely considered the broadest and most sweeping privacy and data security law enacted in the United States to date. Of those states with legislation in 2019, only Mississippi's was a near-clone of the CCPA, with the rest being narrower in scope. Florida's law would be similarly narrower than the CCPA and notable differences would include:

• a prohibition on using public records data obtained from state agencies to market or solicit products or services without the person's affirmative (electronic or paper) consent, whereas the CCPA excludes publicly available information from the definition of personal information;
• an "operator" is an owner or operator of a website or online service who collects and maintains information on Florida consumers for commercial purposes, which varies from the CCPA's application to businesses of a certain revenue threshold or data sale activities that collect PI of California residents;
• a "sale" consists of an exchange of information by an operator for "monetary consideration" to a person in order for that person to license or sell the covered information to additional persons, which contrasts with the CCPA's very broad definition which includes selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means PI from one business to another or a third party for monetary or other valuable consideration;
• excluded from the definition of "sale" in the Florida bills is disclosure of covered information to a person providing a product or service to the consumer who has a direct relationship with the consumer, or disclosure that is consistent with the "reasonable expectations" of a consumer in the context of which the consumer provided the covered information to the operator, which contrasts with the CCPA which excludes from the definition of selling information instances where the consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided that the third party does not also sell the PI in a manner inconsistent with the Act;
• an apparent exclusion for small operators, i.e., operators whose revenue is derived primarily from a source other than the sale or lease of goods, services, or credit on websites or online services, and whose website or online service has fewer than 20,000 unique visitors per year, which contrasts with the CCPA which applies more broadly to businesses that collect PI and meet the revenue threshold of $25 million or engages in the commercial sale of PI for more than 50,000 consumers, households, or devices, or derives 50 percent or more of its annual revenues from selling consumer PI;
• no private right of action against an operator, although it also states that it is not "exclusive" and is "in addition to any other remedies provided by law;" the CCPA grants consumers a private right of action for an authorized disclosure of a consumer's PI as a result of a business's violation of its duty to implement and maintain reasonable security measures.

Similar to the CCPA, Florida would require an operator to provide notice regarding personal information of consumers that it collects and give them opportunities to opt out of the sale of "covered information," a specifically enumerated list of personally identifiable information. Requests to opt out of sales requires verification of the consumer. And the Consumer Data Privacy Act would be the first Florida law to require an online privacy notice. The bills propose a July 1, 2020 effective date.