1. The Florida Digital Bill of Rights (FDBR) was passed by the state legislature on May 9, 2023.
2. The bill is expected to be signed into law by Governor Ron DeSantis and will take effect on December 31, 2023.
3. The FDBR is modeled after consumer privacy laws in Virginia but includes unique aspects that set it apart.
4. The bill will regulate a wide scope of companies in terms of consumer privacy.
5. The FDBR adds a new dimension to the growing body of state consumer privacy laws. – The FDBR applies to businesses that are organized for profit, conduct business in Florida, and collect personal data about Florida consumers.
– The FDBR applies to businesses that make over $1 billion in global gross annual revenues and derive a certain percentage of their revenue from specific online activities.
– The FDBR also applies to businesses that sell sensitive data without the prior consent of the individual to whom the data relates. – A “consumer” in the FDBR is an individual residing in or domiciled in Florida, acting in an individual or household context.
– “Personal data” in the FDBR is any information linked to an identified or identifiable individual, including sensitive data.
– Enforcement of the FDBR is exclusive to the Florida Department of Legal Affairs, with no private right of action.
– The Florida Attorney General can seek damages of up to $50,000 per violation.
– Exemptions to the FDBR include coverage under federal laws like HIPAA, COPPA, and the Gramm-Leach-Bliley Act, as well as exemptions for government entities, nonprofit organizations, and higher education institutions.
– The FDBR also exempts the use of personal data for specific purposes such as compliance with the law, preventing fraud or injury to others, and defending legal claims. – Controllers must limit the purpose of processing personal information and implement safeguards for the data.
– They must not discriminate against consumers for exercising their rights or violate federal discrimination laws.
– They must provide a clear privacy notice and ensure contracts with their processors include necessary provisions.
– Consumers have access, correction, deletion, and data portability rights.
– They also have opt-out rights for targeted marketing, sensitive data collection, and voice recognition features, as well as appeal rights.
– Sensitive data includes information such as race, religion, health, sexual orientation, immigration status, genetic or biometric information, data from known children, and precise geolocation. – The FDBR prohibits the processing of sensitive data without consumer consent and requires compliance with COPPA for child data.
– For-profit businesses in Florida cannot sell sensitive data without consent from the data subject.
– Controllers must respond to consumer data requests within 45 days, with a 15-day extension available, and an appeal response must be delivered within 60 days.
– Data protection impact assessments are required for various processing activities, including targeted advertising and processing of sensitive data.
– Impact assessments done under other state laws can count towards the requirements of the FDBR.
– Businesses with self-service mechanisms for consumer data correction can deny correction requests and direct consumers to the self-service mechanism. – Search engines must provide plain language descriptions of the main parameters used to determine search results for consumers.
– Businesses must provide notices on their website if they sell sensitive or biometric personal data.
– The FDBR comes into effect on December 31, 2023, with a two-year retention period for consumer data.
– Organizations need to understand legal obligations and personal information for effective privacy programs.
– McDermott lawyers can provide assistance with readiness work for new state consumer privacy laws.
https://www.mwe.com/insights/florida-adds-a-new-twist-to-consumer-privacy-patchwork/
Leave a Reply