Florida Senate - 2021 SB 1734
By Senator Bradley
5-01023C-21 20211734__
1 A bill to be entitled
2 An act relating to consumer data privacy; creating s.
3 501.172, F.S.; providing a short title; creating s.
4 501.173, F.S.; providing a purpose; creating s.
5 501.174, F.S.; defining terms; creating s. 501.175,
6 F.S.; providing that consumers have the right to
7 direct certain businesses not to sell their personal
8 information; providing construction; requiring such
9 businesses to notify consumers of such right;
10 requiring businesses to comply with such a request
11 under certain circumstances; prohibiting businesses
12 from selling the personal information of consumers
13 younger than a specified age without express
14 authorization from the consumer or the consumer’s
15 parent or guardian under certain circumstances;
16 providing that a business that willfully disregards a
17 consumer’s age is deemed to have actual knowledge of
18 the consumer’s age; requiring certain businesses to
19 provide a specified link on their web page for
20 consumers to opt out; providing requirements for
21 businesses to comply with a consumer’s opt-out
22 request; providing that consumers have the right to
23 submit a verified request for businesses to delete or
24 correct personal information the businesses have
25 collected about the consumers; prohibiting businesses
26 from taking certain actions to discriminate against
27 consumers who exercise certain rights; providing
28 construction; providing that consumers may authorize
29 other persons to opt out of the sale of the consumer’s
30 personal information or to request the deletion of
31 such information on the consumer’s behalf; requiring
32 businesses to establish designated addresses through
33 which consumers may submit verified requests;
34 specifying requirements for consumers’ verified
35 requests and businesses’ responses; requiring
36 businesses to comply with previous consumer requests
37 without requiring additional information from the
38 consumer, under certain circumstances; requiring
39 businesses to provide certain notices to consumers;
40 creating s. 501.176, F.S.; providing applicability;
41 authorizing businesses to charge consumers a
42 reasonable fee for manifestly unfounded or excessive
43 requests, or to refuse to complete a request under
44 certain circumstances; providing for business
45 liability under certain circumstances; providing
46 construction; providing that a consumer’s rights and
47 the obligations of a business may not adversely affect
48 the rights and freedoms of other consumers; creating
49 s. 501.177, F.S.; authorizing consumers to initiate
50 civil actions for violations; providing civil
51 remedies; requiring the Department of Legal Affairs to
52 adopt rules and to initiate legal proceedings against
53 a business under certain circumstances; providing
54 civil penalties; providing an effective date.
55
56 Be It Enacted by the Legislature of the State of Florida:
57
58 Section 1. Section 501.172, Florida Statutes, is created to
59 read:
60 501.172 Short title.—This act may be cited as the “Florida
61 Privacy Protection Act.”
62 Section 2. Section 501.173, Florida Statutes, is created to
63 read:
64 501.173 Purpose.—This act shall be construed liberally in
65 recognition that privacy is an important right, and consumers in
66 this state should have the ability to share their personal
67 information as they wish, in a way that is safe and that they
68 understand and control.
69 Section 3. Section 501.174, Florida Statutes, is created to
70 read:
71 501.174 Definitions.—As used in ss. 501.172-501.177, unless
72 the context otherwise requires, the term:
73 (1) “Biometric information” means an individual’s
74 physiological, biological, or behavioral characteristics,
75 including an individual’s deoxyribonucleic acid (DNA), which can
76 be used, singly or in combination with each other or with other
77 identifying data, to establish individual identity. The term
78 includes, but is not limited to, imagery of the iris, retina,
79 fingerprint, face, hand, or palm; vein patterns; voice
80 recordings from which an identifier template, such as a
81 faceprint, a minutiae template, or a voice print, can be
82 extracted; keystroke patterns or rhythms; gait patterns or
83 rhythms; and sleep, health, or exercise data that contain
84 identifying information.
85 (2) “Business” means:
86 (a) A sole proprietorship, a partnership, a limited
87 liability company, a corporation, or an association that meets
88 the following requirements:
89 1. Is organized or operated for the profit or financial
90 benefit of its shareholders or owners;
91 2. Does business in this state;
92 3. Collects personal information about consumers, or is the
93 entity on behalf of which such information is collected;
94 4. Determines the purposes and means of processing personal
95 information about consumers, alone or jointly with others; and
96 5. Satisfies at least one of the following thresholds:
97 a. Has global annual gross revenues in excess of $25
98 million, as adjusted in January of every odd-numbered year to
99 reflect any increase in the Consumer Price Index.
100 b. Annually buys, receives for the business’ commercial
101 purposes, sells, or shares for commercial purposes the personal
102 information of 50,000 or more consumers, households, or devices.
103 c. Derives 50 percent or more of its global annual revenues
104 from selling or sharing personal information about consumers.
105 (b) An entity that controls or is controlled by a business
106 and that shares common branding with the business. As used in
107 this paragraph, the term:
108 1. “Common branding” means a shared name, service mark, or
109 trademark.
110 2. “Control” means:
111 a. Ownership of, or the power to vote, more than 50 percent
112 of the outstanding shares of any class of voting security of a
113 business;
114 b. Control in any manner over the election of a majority of
115 the directors, or of individuals exercising similar functions;
116 or
117 c. The power to exercise a controlling influence over the
118 management of a company.
119 (c) A joint venture or partnership composed of businesses
120 in which each business has at least a 40 percent interest. For
121 the purposes of this act, the joint venture or partnership and
122 each business that composes the joint venture or partnership
123 must be considered a separate, single business, except that
124 personal information in the possession of each business and
125 disclosed to the joint venture or partnership may not be shared
126 with the other businesses.
127
128 The term does not include a third party that operates, hosts, or
129 manages a website or an online service on behalf of a business
130 or processes information on behalf of a business; or an entity
131 that is subject to the Health Insurance Portability and
132 Accountability Act of 1996, Pub. L. No. 104-191, and regulations
133 adopted pursuant thereto.
134 (3) “Business purpose” means a business or a service
135 provider that uses personal information for the operational
136 purposes of the business or service provider, which is necessary
137 and proportionate to achieve the operational purpose for which
138 the personal information was collected or processed or for
139 another operational purpose that is compatible with the context
140 in which the personal information was collected.
141 (4) “Commercial purposes” means to advance a business’
142 commercial or economic interests, such as by inducing a consumer
143 to buy, rent, lease, join, subscribe to, provide, or exchange
144 products, goods, property, information, or services or enabling
145 or effecting, directly or indirectly, a commercial transaction.
146 The term does not include engaging in speech that state or
147 federal courts have recognized as noncommercial speech,
148 including political speech and journalism.
149 (5) “Consumer” means a natural person who is in this state
150 for other than a temporary or transitory purpose, or a natural
151 person who is domiciled in this state but is outside this state
152 for a temporary or transitory purpose, who seeks or acquires, by
153 purchase or lease, any good, service, money, or credit for
154 personal, family, or household purposes from a business. The
155 term does not include any other natural person who is a
156 nonresident.
157 (6) “De-identified” means information:
158 (a) That cannot reasonably identify, relate to, describe,
159 be associated with, or be linked directly or indirectly to a
160 particular consumer or device;
161 (b) Containing data that the business has taken reasonable
162 measures to ensure could not be reidentified;
163 (c) Containing data that the business publicly commits to
164 maintain and use in a de-identified fashion and that it does not
165 attempt to reidentify; and
166 (d) Containing data that the business contractually
167 prohibits downstream recipients from attempting to reidentify.
168 (7) “Designated request address” means an electronic mail
169 address, a toll-free telephone number, or a website established
170 by a business through which a consumer may submit a verified
171 request to the business.
172 (8) “Personal information” means information that
173 identifies, relates to, describes, is reasonably capable of
174 being associated with, or could reasonably be linked, directly
175 or indirectly, with a particular consumer or household.
176 (a) The term includes, but is not limited to, all of the
177 following items of personal identifying information about a
178 consumer collected and maintained by a person or business in an
179 accessible format:
180 1. A first and last name.
181 2. A home or other physical address that includes the name
182 of a street and the name of a city or town.
183 3. An electronic mail address.
184 4. A telephone number.
185 5. A social security number.
186 6. An identifier that allows a consumer to be contacted
187 either physically or online.
188 7. Biometric information, such as DNA or fingerprints or
189 any other biometric information collected by a business about a
190 consumer without the consumer’s knowledge.
191 8. Internet or other electronic network activity
192 information, including, but not limited to, browsing history,
193 search history, and information regarding a consumer’s
194 interaction with a website, an application, or an advertisement.
195 9. Audio, electronic, visual, thermal, olfactory,
196 geolocation, or similar information.
197 10. Professional or employment-related information.
198 11. Education information, defined as only information that
199 is not publicly available.
200 12. Inferences drawn from any information specified in this
201 paragraph which can create a profile about a consumer reflecting
202 the consumer’s preferences, characteristics, psychological
203 trends, predispositions, behavior, attitudes, intelligence,
204 abilities, and aptitudes.
205 13. Any other information that may serve as a probabilistic
206 identifier concerning a consumer which is collected from the
207 consumer through a website, an online service, or some other
208 means by the business and maintained by the business in
209 combination with an identifier in a form that, when used
210 together with the information, identifies the consumer.
211 (b) The term does not include:
212 1. Information about a consumer actually obtained from
213 public records, including information that is lawfully made
214 available from federal, state, or local governmental records.
215 2. Consumer information that is de-identified or aggregate
216 consumer information that relates to a group or category of
217 consumers from which individual consumer identities have been
218 removed.
219 3. Information collected, processed, sold, or disclosed
220 pursuant to the federal Gramm-Leach-Bliley Act, 15 U.S.C. s.
221 6801 et seq., and regulations adopted pursuant thereto, if it is
222 inconsistent with that act, and only to the extent of the
223 inconsistency.
224 (9) “Probabilistic identifier” means the identification of
225 a consumer or a device to a degree of certainty more probable
226 than not, based on any categories of personal information
227 included in or similar to the categories enumerated in
228 subsection (8).
229 (10) “Profiling” means any form of automated processing
230 performed on personal data to evaluate, analyze, or predict
231 personal aspects related to an identified or identifiable
232 natural person’s economic situation, health, personal
233 preferences, interests, reliability, behavior, location, or
234 movements.
235 (11)(a) “Sale” or “sell” means to sell, rent, release,
236 disclose, disseminate, make available, loan, share, transfer, or
237 otherwise communicate orally, in writing, or by electronic or
238 other means, a consumer’s personal information by a business to
239 another business or a third party for monetary or other tangible
240 or intangible consideration or for any commercial purpose.
241 (b) The term does not include any of the following:
242 1. The business disclosing personal information to a
243 service provider that processes the personal information on
244 behalf of the business.
245 2. The business disclosing personal information to another
246 business that the consumer has a direct relationship, for the
247 purposes of providing a product or service requested by the
248 consumer.
249 (12) “Service provider” means a person that processes
250 personal information on behalf of a business and to which the
251 business discloses a consumer’s personal information pursuant to
252 a written or electronic contract if:
253 (a) The contract prohibits the person from retaining,
254 using, or disclosing the personal information for any purpose
255 other than the specific purposes of performing the services
256 specified in the contract for the business, including a
257 prohibition on retaining, using, or disclosing the personal
258 information for a commercial purpose other than providing the
259 services specified in the contract with the business; and
260 (b) The service provider does not combine the personal
261 information that the service provider receives from or on behalf
262 of the business with personal information that the service
263 provider receives from or on behalf of another person or persons
264 or collects from its own interaction with consumers.
265 (13) “Targeted advertising” means displaying an
266 advertisement to a consumer when the advertisement is selected
267 based on personal data obtained from a consumer’s activities
268 over time and across nonaffiliated websites or online
269 applications to predict such consumer’s preferences or
270 interests. The term does not include any of the following:
271 (a) Advertisements based on activities within a business’
272 own websites or online applications.
273 (b) Advertisements based on the context of a consumer’s
274 current search query, visit to a website, or online application.
275 (c) Advertisements directed to a consumer in response to
276 the consumer’s request for information or feedback.
277 (d) Processing personal data processed solely to measure or
278 report advertising performance, reach, or frequency.
279 (14) “Third party” means a person who is not any of the
280 following:
281 (a) The business that collects personal information from
282 consumers under this section.
283 (b) A service provider that the business discloses a
284 consumer’s personal information for a business purpose pursuant
285 to a written contract that does all of the following:
286 1. Prohibits the person receiving the personal information
287 from doing any of the following:
288 a. Selling the personal information.
289 b. Retaining, using, or disclosing the personal information
290 for any purpose other than for the specific purpose of
291 performing the services specified in the contract, including
292 retaining, using, or disclosing the personal information for a
293 commercial purpose other than providing the services specified
294 in the contract.
295 c. Retaining, using, or disclosing the information outside
296 of the direct business relationship between the person and the
297 business.
298 d. Combining the personal information that the service
299 provider receives from or on behalf of any person with personal
300 information that the service provider receives from or on behalf
301 of another person or persons or collects from its own
302 interaction with consumers.
303 2. Includes a certification made by the person who receives
304 the personal information that the person understands the
305 restrictions under this act and will comply with them.
306 (15) “Unique identifier” or “unique personal identifier”
307 means a persistent identifier that can be used to recognize a
308 consumer, a family, or a device linked to a consumer or family
309 over time and across different services, including, but not
310 limited to, a device identifier; an Internet protocol address;
311 cookies, beacons, pixel tags, mobile ad identifiers, or similar
312 technology; a customer number, unique pseudonym, or user alias;
313 telephone numbers; or other forms of persistent or probabilistic
314 identifiers that can be used to identify a particular consumer
315 or device. For purposes of this subsection, the term “family”
316 means a custodial parent or guardian and any minor children of
317 which the parent or guardian has custody.
318 (16) “Verified request” means a request submitted by a
319 consumer, by a consumer on behalf of the consumer’s minor child,
320 by a natural person or a person registered with the Secretary of
321 State, authorized by the consumer to act on the consumer’s
322 behalf, to a business for which a business can reasonably verify
323 the authenticity of the request.
324 Section 4. Section 501.175, Florida Statutes, is created to
325 read:
326 501.175 Use of personal information; third parties; other
327 rights.—
328 (1)(a) A consumer has the right, at any time, to direct a
329 business that sells personal information about the consumer not
330 to sell the consumer’s personal information. This right may be
331 referred to as the right to opt out of the sale.
332 (b) As part of the right to opt out of the sale of his or
333 her personal information, a consumer has the right, at any time,
334 to opt out of the processing of the consumer’s personal data for
335 purposes of targeted advertising or profiling in furtherance of
336 decisions that produce legal or similarly significant effects
337 concerning the consumer. However, this paragraph may not be
338 construed to prohibit the business that collected the consumer’s
339 personal information from offering a different price, rate,
340 level, quality, or selection of goods or services to a consumer,
341 including offering goods or services for no fee, if the consumer
342 has opted out of targeted advertising or the offer is related to
343 a consumer’s voluntary participation in a bona fide loyalty,
344 rewards, premium features, discounts, or club card program.
345 (2) A business that sells consumers’ personal information
346 to third parties shall provide notice to consumers that the
347 information may be sold and that consumers have the right to opt
348 out of the sale of their personal information.
349 (3) A business that has received direction from a consumer
350 not to sell the consumer’s personal information or, in the case
351 of a minor consumer’s personal information, has not received
352 consent to sell the minor consumer’s personal information, is
353 prohibited from selling the consumer’s personal information
354 after the business receives the consumer’s direction, unless the
355 consumer subsequently provides express authorization for the
356 sale of the consumer’s personal information. A business that is
357 able to authenticate the consumer, for example, by the consumer
358 logging in, or that uses some other unique identifier for the
359 consumer must comply with any privacy preferences the consumer
360 previously directed. The consumer may not be required to declare
361 privacy preferences every time the consumer visits the business’
362 website or uses the business’ online services.
363 (4)(a) Notwithstanding subsection (1), a business may not
364 sell the personal information of consumers if the business has
365 actual knowledge that the consumer is younger than 16 years of
366 age, unless:
367 1. The consumer, in the case of consumers between 13 and 16
368 years of age, has affirmatively authorized the sale of the
369 consumer’s personal information; or
370 2. The consumer’s parent or guardian, in the case of
371 consumers who are younger than 13 years of age, has
372 affirmatively authorized the sale of the consumer’s personal
373 information.
374 (b) A business that willfully disregards the consumer’s age
375 is deemed to have actual knowledge of the consumer’s age. This
376 right may be referred to as the right to opt in.
377 (5) A business that is required to comply with this section
378 shall, in a form that is reasonably accessible to consumers, do
379 all of the following:
380 (a) Provide a clear and conspicuous link on the business’
381 Internet home page, titled “Do Not Sell My Personal
382 Information,” to a web page that enables a consumer or a person
383 authorized by the consumer to opt out of the sale of the
384 consumer’s personal information. A business may not require a
385 consumer to create an account in order to direct the business
386 not to sell the consumer’s information.
387 (b) Ensure that all individuals responsible for handling
388 consumer inquiries about the business’ privacy practices or the
389 business’ compliance with this section are informed of all
390 requirements of this section and how to direct consumers to
391 exercise their rights.
392 (c) For consumers who exercise their right to opt out of
393 the sale of their personal information, refrain from selling
394 personal information the business collected about the consumer
395 within 15 business days after receiving the request to opt out.
396 (d) For consumers who have opted out of the sale of their
397 personal information, respect the consumer’s decision to opt out
398 for at least 12 months before requesting that the consumer
399 authorize the sale of the consumer’s personal information.
400 (e) Use any personal information collected from the
401 consumer in connection with the submission of the consumer’s
402 opt-out request solely for the purposes of complying with the
403 opt-out request.
404 (f) Ensure that consumers have the right to submit a
405 verified request for certain information from a business,
406 including the sources from which the consumer’s personal
407 information was collected, the specific elements of personal
408 information it collected about the consumer, and any third
409 parties to whom the personal information was sold.
410 (6) Consumers have the right to submit a verified request
411 that personal information that has been collected be deleted. A
412 business shall notify a third party to delete any consumer
413 personal information bought or received.
414 (7) Consumers have the right to submit a verified request
415 for correction of their personal information held by a business
416 if that information is inaccurate.
417 (8) Consumers have the right to receive equal service and
418 pricing from a business, even if they exercise their privacy
419 rights. A business may not discriminate against such consumers
420 by denying them goods or services, charging different prices, or
421 providing a different quality of goods or services to consumers
422 who exercise their right to opt out from having their personal
423 information sold.
424 (9) This section may not be construed to require a business
425 to comply by including the required links and text on the home
426 page that the business makes available to the public generally,
427 if:
428 (a) The business maintains a separate and additional home
429 page that is dedicated to consumers in this state and includes
430 the required links and text; and
431 (b) The business takes reasonable steps to ensure that
432 consumers in this state are directed to the home page for
433 consumers in this state and not the home page made available to
434 the public generally.
435 (10) A consumer may authorize another person to opt out of
436 the sale of the consumer’s personal information or to request
437 the deletion of the consumer’s personal information on the
438 consumer’s behalf. A business shall comply with an opt-out
439 request or deletion request received from a person authorized by
440 the consumer to act on the consumer’s behalf, including a
441 request received through a user-enabled global privacy control,
442 such as a browser plug-in or privacy setting, device setting, or
443 other mechanism, which communicates or signals the consumer’s
444 choice to opt out.
445 (11) Each business shall establish a designated request
446 address through which a consumer may submit a request to
447 exercise his or her rights under this act.
448 (12) A business shall respond to a verified request
449 submitted by a consumer to correct or delete personal
450 information within 30 days after the date the request is
451 submitted. A business may extend such period by up to 30 days if
452 the business, in good faith, determines that such an extension
453 is reasonably necessary. A business that extends the period
454 shall notify the consumer of the necessity of an extension.
455 (13) A business shall comply with a consumer’s previous
456 expressed decision to opt out of the sale of his or her personal
457 information without requiring the consumer to take any
458 additional action if:
459 (a) The business is able to identify the consumer through a
460 login protocol, and the consumer has previously exercised his or
461 her right to opt out of the sale of their personal information;
462 or
463 (b) The business is aware of the consumer’s desire to opt
464 out of the sale of his or her personal information through the
465 use of a user-enabled global privacy control, such as a browser
466 plug-in or privacy setting, device setting, or other mechanism,
467 which communicates or signals the consumer’s choice to opt out.
468 (14) A business shall make available, in a manner
469 reasonably accessible to consumers whose personal information
470 the business collects through its website or online service, a
471 notice that does all of the following:
472 (a) Identifies the categories of personal information that
473 the business collects through its website or online service
474 about consumers who use or visit the website or online service
475 and the categories of third parties with whom the business may
476 share such personal information.
477 (b) Provides a description of the process, if applicable,
478 for a consumer who uses or visits the website or online service
479 to review and request changes to any of his or her personal
480 information that is collected through the website or online
481 service.
482 (c) Describes the process by which the business notifies
483 consumers who use or visit the website or online service of
484 material changes to the notice.
485 (d) Discloses whether a third party may collect personal
486 information about a consumer’s online activities over time and
487 across different websites or online services when the consumer
488 uses the business’ website or online service.
489 (e) States the effective date of the notice.
490 Section 5. Section 501.176, Florida Statutes, is created to
491 read:
492 501.176 Exclusions.—
493 (1) The obligations imposed on a business by this act do
494 not restrict a business’ ability to do any of the following:
495 (a) Comply with federal, state, or local laws.
496 (b) Comply with a civil, criminal, or regulatory inquiry or
497 an investigation, a subpoena, or a summons by federal, state, or
498 local authorities.
499 (c) Cooperate with law enforcement agencies concerning
500 conduct or activity that the business, service provider, or
501 third party reasonably and in good faith believes may violate
502 federal, state, or local law.
503 (d) Exercise or defend legal claims.
504 (e) Collect, use, retain, sell, or disclose consumer
505 information that is de-identified or in the aggregate consumer
506 information that relates to a group or category of consumers
507 from which individual consumer identities have been removed.
508 (f) Collect or sell a consumer’s personal information if
509 every aspect of that commercial conduct takes place wholly
510 outside of this state. For purposes of this act, commercial
511 conduct takes place wholly outside of this state if the business
512 collected that information while the consumer was outside of
513 this state, no part of the sale of the consumer’s personal
514 information occurred in this state, and no personal information
515 collected while the consumer was in this state is sold. This
516 paragraph does not permit a business to store, including on a
517 device, personal information about a consumer when the consumer
518 is in this state and then to collect that personal information
519 when the consumer and stored personal information are outside of
520 this state.
521 (2) This act does not apply to the sale of personal
522 information to or from a consumer reporting agency if that
523 information is to be reported in, or used to generate, a
524 consumer report as defined by subdivision (d) of 15 U.S.C. s.
525 1681a, and use of that information is limited by the federal
526 Fair Credit Reporting Act, 15 U.S.C. s. 1681 et seq.
527 (3) If a request from a consumer is manifestly unfounded or
528 excessive, in particular because of the request’s repetitive
529 character, a business may either charge a reasonable fee, taking
530 into account the administrative costs of providing the
531 information or communication or taking the action requested, or
532 refuse to act on the request and notify the consumer of the
533 reason for refusing the request. The business bears the burden
534 of demonstrating that any verified consumer request is
535 manifestly unfounded or excessive.
536 (4) A business that discloses personal information to a
537 service provider is not liable under this act if the service
538 provider receiving the personal information uses it in violation
539 of the restrictions set forth in the act, provided that, at the
540 time of disclosing the personal information, the business does
541 not have actual knowledge, or reason to believe, that the
542 service provider intends to commit such a violation. A service
543 provider is likewise not liable under this act for the
544 obligations of a business for which it provides services as set
545 forth in this act.
546 (5) This act may not be construed to require a business to
547 reidentify or otherwise link information that is not maintained
548 in a manner that would be considered personal information.
549 (6) The rights afforded to consumers and the obligations
550 imposed on a business in this act may not adversely affect the
551 rights and freedoms of other consumers.
552 Section 6. Section 501.177, Florida Statutes, is created to
553 read:
554 501.177 Civil actions; private right of action; Attorney
555 General; rules.—
556 (1) If any business violates any provision of this act, the
557 consumer may initiate a civil action for any of the following:
558 (a) Recovery of damages of at least $100 and less than $750
559 per consumer per incident or actual damages, whichever is
560 greater.
561 (b) Injunctive or declaratory relief.
562 (c) Reasonable costs of enforcement, including a reasonable
563 attorney fee.
564 (d) Any other relief the court deems proper.
565 (2)(a) The Department of Legal Affairs shall adopt rules to
566 enforce this act. If the department has reason to believe that a
567 business, directly or indirectly, has violated or is violating
568 this section, the department may institute an appropriate legal
569 proceeding against the business.
570 (b) The trial court, upon a showing that any business,
571 directly or indirectly, has violated or is violating this act,
572 may take any of the following actions:
573 1. Issue a temporary or permanent injunction.
574 2. Impose a civil penalty not to exceed $5,000 for each
575 violation. If the consumer was under 16 years of age at the time
576 of the violation, the court may triple the civil penalty.
577 3. Award reasonable costs of enforcement, including a
578 reasonable attorney fee.
579 4. Grant such other relief as the court may deem
580 appropriate.
581 Section 7. This act shall take effect July 1, 2021.