Miami attorney Kelly Ruane Melchiondo of Bilzin Sumberg said now that House Bill 969 has passed in the House, the next step is to convince the Senate to pass the bill, or to find common ground for both sides. If the Senate and the Legislature cannot find this common ground by Friday, data privacy in Florida will remain the same, and the matter will not be revisited until next year.

"Everyone has their eyes on Florida to see what Florida will decide on," Melchiondo said. "If passed, this House Bill could be the strictest privacy statute in the United States, because the private right of action will enable consumers to sue companies directly, not just for data breaches that expose consumer information, but also for violations of the statute itself, including the privacy provisions."

On Feb. 15, Sarasota Rep. Fiona McFarland introduced HB 969, modeled after the California Consumer Privacy Act, similar to Senate Bill 1734—but with a critical difference.

The bill creates a private right of action for consumers against any company that neglects to comply with a consumer's request that the company remove, amend or stop selling the consumer's personal information.

The bill applies to companies that make more than $25 million a year in gross net revenue and collect consumer data, and it also applies to smaller businesses operating in Florida that collect data from more than 10,000 devices.

Melchiondo said the bill would mean that companies would have to update their privacy policies and allow consumers to opt out of giving their information to third parties. Companies would also need to monitor and remove data, if consumers ask.

Inspiration for the bill came from a consumer-friendly European Union General Data Privacy Regulation that caught the attention of U.S. lawmakers. The U.S. began to pay more attention to the privacy provisions and realized that their model was not the same, attorneys said.

States are following California's law because they say it is difficult for large companies that operate in multiple jurisdictions to comply with 50 different laws. This creates obstacles for a lot of big tech companies that are working nationally, because they don't have one standard framework for compliance, some lawmakers have said.

Melchiondo believes consumers and companies are in a tug-of-war over the control of data. She said the consumer-protection statute would give the power back to consumers to control what happens to the data they share.

"From a consumer's perspective it's the idea that knowledge is power," Melchiondo said. "From a company's perspective, companies want to learn more about consumers and want to collect more data."

Melchiondo believes it's going to be difficult for Florida businesses to catch up, if the proposed law passes.

"This bill can possibly cause companies who do not have the best infrastructure to have to take a good look inside, and figure out what their data storage capacity is, whether or not they're doing it themselves, or working with third parties," she said.

Melchiondo said, "Even if the law doesn't pass, it's very important to be proactive and not reactive. It's a good idea now to be reevaluating your own privacy structure and what you're doing to best protect the sensitive information that consumers are sharing with you."

She said it's a good idea to know how companies safeguard consumer data, and what happens to that data.

"All these questions should be things you should be able to answer readily if someone were to ask," Melchiondo said. "It's never a good thing to just collect it, and never see it again, and not know what happened to it."