Highlights

Covered Entities: Sole proprietorships, partnerships, corporations, trusts, estates, cooperatives, associations, or other commercial entities that acquire, maintain, store, or use personal information. For purposes of notice requirements, the definition also includes governmental entities.

Consumer Notification: Any individual in Florida whose personal information was, or the covered entity reasonably believes to have been, accessed as a result of the breach.

Regulatory Notification: If 500 or more individuals in the state are affected, notice must be made to the Florida Department of Legal Affairs.

Notification Timeline: As expeditiously as practicable and without unreasonable delay, taking into account the time necessary to determine the scope of the breach, to identify affected individuals, and to restore the reasonable integrity of the data system that was breached, but no later than 30 days after the determination of a breach or reason to believe a breach occurred.

Data Format: Electronic.

Citations: Fla. Stat. § 501.171

More Details

Definitions:

• Breach: Unauthorized access of data in electronic form containing personal information.
• Personal Information (PI):
  • An individual’s first name or first initial and last name, in combination with any one or more of the following data elements if the data elements are not encrypted:
    • Social Security number;
    • Driver’s license number, identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity;
    • Financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual’s financial account;
    • Any information regarding an individual's medical history, mental or physical condition or medical treatment or diagnosis by a health care professional;
    • An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
    • Any information regarding an individual’s geolocation.
  • A username or e-mail address, in combination with a password or security question and answer that would permit access to an online account.
• Medical Information: NA
• Health Insurance Information: NA

Safe Harbors:

• Encryption: Statute does not apply to information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable.
• Good Faith: Good faith access of personal information by an employee or agent of the covered entity does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use.
• Risk of Harm: Notification to individuals is not required if, after an appropriate investigation and written consultation with relevant federal, state, or local law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm to the individuals whose personal information has been accessed. Such a determination must be in writing, maintained for at least five (5) years, and provided to the Department of Legal Affairs within 30 days after the determination.
• Law Enforcement Delay: If a federal, state, or local law enforcement agency determines that notice to individuals would interfere with a criminal investigation, the notice shall be delayed upon the written request of the law enforcement agency for a specified period that the law enforcement agency determines is reasonably necessary.
• Public Record: N/A

Direct Notice:

• Timing: As expeditiously as practicable and without unreasonable delay, but no later than 30 days after the determination of a breach or reason to believe that a breach has occurred.
• Format: N/A
• Content: Written notice to an individual must include, at a minimum:
  • The date, estimated date, or estimated date range of the breach of security;
  • A description of the personal information that was accessed or reasonably believed to have been accessed as a part of the breach of security; and
  • Information that the individual can use to contact the covered entity to inquire about the breach of security and the personal information that the covered entity maintained about the individual.
• Method: Consumer notice to an affected individual shall be by one of the following methods:
  • Written notice sent to the mailing address of the individual in the records of the subject entity; or
  • Email notice sent to the email address of the individual in the records of the subject entity.

Substitute Notice:

An entity may provide substitute notice if (1) the cost of direct notice would exceed $250,000, (2) the notification population exceeds 500,000, or (3) the covered entity does not have an e-mail address or mailing address for the affected individuals. Such substitute notice shall include 1) conspicuous notice on the Internet website of the covered entity if the covered entity maintains a website; and 2) notice in print and to broadcast media, including major media in urban and rural areas where the affected individuals reside.

Remediation Services:

N/A

Regulatory Notice:

If 500 or more individuals in the state are affected, notice must be made to the Florida Department of Legal Affairs.

Credit Reporting Agencies Notice:

If required to notify more than 1,000 Florida residents at a single time, must also notify all nationwide consumer reporting agencies of the timing, distribution and content of the notices.

Third-Party Notice:

Third-party agents must notify the covered entity of the breach of security as expeditiously as practicable, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred. The covered entity must then provide required notices.

HIPAA:

Notice provided pursuant to rules, regulations, procedures, or guidelines established by the covered entity’s primary or functional federal regulator is deemed to be in compliance with the notice requirement in this subsection if the covered entity notifies affected individuals in accordance with the rules, regulations, procedures, or guidelines established by the primary or functional federal regulator in the event of a breach of security. Under this paragraph, a covered entity that timely provides a copy of such notice to the department is deemed to be in compliance with the notice requirement.

Private Action:

N/A

Associated Regulations:

• Information Security Standard (Fla. Stat. § 501.171)
• Florida Digital Bill of Rights

Florida Digital Bill of Rights

Fla. Stat. § 501.701-719

Highlights

Applicability:

For-profit entities that conduct business in Florida and:

• Act as a controller of personal data of Florida consumers;
• Make in excess of $1 billion in global gross annual revenues; and
• Satisfy at least one of the following:
  
  • Derive 50% or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online;
  • Operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation; or
  • Operate an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.

Among other exclusions, the Florida Digital Bill of Rights excludes state or local government entities, postsecondary education institutions, nonprofit organizations, employment-related data, and entities or data regulated by HIPAA, FCRA, or GLBA, as well as the processing of personal data for purely personal or household activities or solely for measuring or reporting advertising performance, reach, or frequency. Entities in compliance with COPPA, with respect to data collected online, are considered to be in compliance with parental consent requirements.

The Act also excludes certain categories of information, including information subject to the Driver’s Privacy Protection Act, FERPA, the Farm Credit Act, certain payment-processing data, certain airline data, and certain manufacturer, distributor, or vendor data used solely for advertising, marketing, or servicing the product.

However, the law prohibits government entities from communicating with social media platforms to request that they remove content or accounts or initiate or maintain any agreements or working relationships with social media platforms for the purpose of content moderation, subject to statutory exceptions.

Covered Entity Obligations:

Controllers. Controller duties include obligations to:

• Limit collection of personal data to data that is adequate, relevant, and reasonably necessary in relation to the purposes for which it is processed, as disclosed to the consumer.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue to protect the confidentiality, integrity, and accessibility of personal data.
• Refrain from processing personal data for a purpose that is neither reasonably necessary nor compatible with the purpose for which the personal data is processed without consumers’ consent.
• Refrain from processing personal data in violation of state or federal laws that prohibit unlawful discrimination against consumers.
• Not discriminate against consumers for exercising consumer rights. Controllers may offer financial incentives for processing of personal data with prior consent that clearly describes the material terms of the financial incentive program, provided that the incentive practices are not unjust, unreasonable, coercive, or usurious in nature. Consent may be revoked by the consumer at any time.
• Not process sensitive data without obtaining consumers' consent, including consent for the processing of a child’s sensitive data, in accordance with COPPA for a known child under the age of 13, or with affirmative authorization from a known child who is between 13 and 18 years of age. 
• Make available a reasonably accessible and clear privacy notice, updated at least annually, to include: categories of personal data processed, purposes of processing personal data, including, if applicable, sensitive data, how consumers may exercise their rights; categories of personal data shared with third parties; categories of third parties with whom controller shares personal data; description of methods by which consumers may appeal a controller’s refusal to take action on data rights requests; and a description of the methods by which consumers can submit request to exercise the rights.
• Clearly and conspicuously disclose whether they sell personal data or use personal data for targeted advertising and how to exercise opt-out rights.
• Post a notice regarding the sale of sensitive or biometric personal data, if applicable, using the required notices: “NOTICE: This website may sell your sensitive personal data” and/or “NOTICE: This website may sell your biometric personal data.”
• Enter into a contract with a processor to include certain terms limiting a processor’s data processing, clear instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of controller and processor.
• The processor contract must also require the processor to ensure that each person processing personal data is subject to a duty of confidentiality; delete or return personal data at the controller’s direction after services are completed, unless retention is required by law; make compliance information available to the controller upon reasonable request; allow and cooperate with reasonable assessments by the controller or designated assessor; and engage subcontractors only under written contracts requiring the subcontractor to meet the processor’s requirements.
• Conduct data protection assessments for each of the controller’s processing activities that present a heightened risk of harm, including processing of personal data for targeted advertising, sale of personal data, profiling (if the profiling presents reasonably foreseeable risks of harm or substantial injury to consumers), as well as the processing of sensitive data or other personal data that presents a heightened risk of harm to consumers.
• Data protection assessments must identify and weigh the direct or indirect benefits of the processing against potential risks to consumer rights, as mitigated by safeguards, and must factor in the use of deidentified data, reasonable consumer expectations, the context of processing, and the relationship between the controller and consumer.
• If online platforms provide services, products games, or features that likely will be predominantly accessed by children, the Florida statute imposes additional restrictions on processing of children’s data.
• Controllers that operate search engines must make available, in an easily accessible location on the webpage that does not require a consumer to log in or register, an up-to-date, plain-language description of the main parameters that are most significant in determining ranking and the relative importance of those parameters, including prioritization or deprioritization of political partisanship or political ideology in search results.
• Controllers must establish two or more secure, reliable, and clearly and conspicuously accessible methods for consumers to submit rights requests, considering how consumers normally interact with the controller, the need for secure and reliable communication, and the controller’s ability to authenticate the consumer. Controllers may not require consumers to create a new account to exercise rights and must provide a website mechanism for consumer requests if the controller maintains a website.

Processors. Processor duties include obligations to:

• Adhere to the instructions of the controller.
• Reasonably assist the controller in meeting its obligations, including:
  
  • Responding to consumer rights requests;
  • Implementing data security practices and breach notification; and
  • Providing necessary information to enable the controller to conduct and document data protection assessments.
• Entering into written contracts with any subcontractors engaged to process personal data that meet the obligations of the processor with respect to the personal data.
• Ensuring that each person processing personal data is subject to a duty of confidentiality with respect to the data.
• At the controller’s direction, deleting or returning all personal data to the controller, as requested at the end of the provision of services, unless retention of the personal data is required by law.
• Upon the reasonable request of the controller, making available to the controller all information in the processor’s possession necessary to demonstrate the processor’s compliance with its obligations.
• Allowing and cooperating with reasonable assessments by the controller or the controller’s designated assessor.
• Alternatively, arranging for a qualified and independent assessor to conduct an assessment of the processor’s policies and technical and organizational measures using an appropriate and accepted control standard or framework and assessment procedure, and providing the assessment report to the controller upon request.

Consumer Rights:

Controllers must respond without undue delay and within 45 days (with a possible extension of 15 days when reasonably necessary) to verified consumer requests regarding the processing of personal data and sensitive data, including consumers’:

• Right to know whether a controller is processing their personal data;
• Right to access personal data;
• Right to request deletion of personal data;
• Right to obtain personal data in a format that is generally portable and readily usable, if technically feasible;
• Right to correct inaccurate personal data;
• Right to opt out of personal data  for the purpose of sale, targeting advertising, or profiling for decisions producing legal or other significant effects;
• Right to opt out of collection or processing of sensitive data, including precise geolocation data or collection of personal data through operation of a voice recognition or facial recognition feature.
• With respect to personal data belonging to a known child, a parent or legal guardian may exercise consumer rights on behalf of the child.

Additionally, a controller must establish two or more methods to enable consumers to submit a request to exercise their rights and establish a process for the consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the receipt of the controller's decision. The appeal process must be made conspicuously available and similar to the process for submitting requests to initiate action. The controller is required to take action within sixty (60) days of receipt of an appeal and inform the consumer in writing of action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

More Details

Definitions:

• Consumer: An individual who is a resident of or is domiciled in Florida acting only in an individual or household context. The term does not include an individual acting in a commercial or employment context.
• Controller: A for-profit legal entity that conducts business in Florida, collects personal data about consumers, or is the entity on behalf of which such information is collected, determines the purposes and means of processing personal data about consumers alone or jointly with others, makes in excess of $1 billion in global gross annual revenues, and satisfies at least one of the statute’s additional threshold requirements; or an entity that controls or is controlled by such controller.
• Personal Data: Any information, including sensitive data, which is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual.

Personal data excludes: de-identified data and publicly available data (defined as information lawfully made available through government records and information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience).

Personal data also excludes personal data regulated under HIPAA, FCRA, Driver’s Privacy Protection Act, FERPA, Farm Credit Act, employment data, and other exceptions.

• Process: An operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
• Processor: A person who processes personal data on behalf of a controller.
• Profiling: Any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Sale of Personal Data: Sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party.

The Florida statute excludes the following disclosures from this definition: (i) disclosure of personal data to a processor who processes the personal data on the controller’s behalf; (ii) disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer; (iii) disclosure of information that the consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience; and (iv) disclosure or transfer of personal data to a third party as an asset that is part of a merger or an acquisition.

• Sensitive Data: Personal data revealing:  racial or ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, or citizenship/immigration status; genetic or biometric data processed for the purpose of uniquely identifying an individual; personal data  collected from a known child; and/or precise geolocation data.
• Biometric Data: Data generated by automatic measurements of an individual’s biological characteristics, including fingerprints, voiceprints, eye retinas or irises, or other unique biological patterns or characteristics used to identify a specific individual. The term does not include physical or digital photographs, video or audio recordings or data generated from video or audio recordings, or information collected, used, or stored for health care treatment, payment, or operations under HIPAA.
• Child: An individual younger than 18 years of age.
• Known Child: A child under circumstances where a controller has actual knowledge of, or willfully disregards, the child’s age.
• Precise Geolocation Data: Information derived from technology, including GPS-level latitude and longitude coordinates or other mechanisms, which directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The term does not include the content of communications or any data generated by or connected to an advanced utility metering infrastructure system or to equipment for use by a utility.
• Targeted Advertising: Displaying to a consumer an advertisement selected based on personal data obtained from that consumer’s activities over time across affiliated or unaffiliated websites and online applications used to predict the consumer’s preferences or interests. The term does not include an advertisement based on the context of a consumer’s current search query on the controller’s own website or online application, or directed to a consumer search query on the controller’s own website or online application in response to the consumer’s request for information or feedback.
• Third Party: A person, other than the consumer, controller, processor, or an affiliate of the controller or processor.
• Voice Recognition Feature: The function of a device that enables the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds.

Penalties:

Violations of the Florida statute constitute an unfair and deceptive trade practice enforced by the Florida Department of Legal Affairs. The Department may collect a civil penalty up to $50,000 per violation, which may be tripled for violations committed against a known child, failure to delete or correct personal data in response to an authenticated consumer request, or for continuing to sell or share personal data after a consumer chooses to opt out.

The Florida statute provides a 45-day cure period that may be granted by the Department of Legal Affairs at its discretion but does not apply to alleged violations involving a known child.

Private Action:

No

Associated Regulations & Rulemakings:

Florida Department of Legal Affairs. The Department is required to adopt rules to implement the Florida Digital Bill of Rights, including standards for authenticated consumer requests, enforcement, data security, and authorized persons who may act on a consumer’s behalf.

Notes on AI Related Regulations:

The Florida Digital Bill of Rights is not a standalone AI law, but it regulates AI-adjacent processing through consumer opt-out rights for profiling in furtherance of decisions that produce legal or similarly significant effects, data protection assessments for high-risk profiling, and transparency requirements for certain search engines. Controllers that operate search engines must disclose the main parameters that determine ranking, including the prioritization or deprioritization of political partisanship or political ideology in search results.

Effective Date:

July 1, 2024

Highlights

Covered Entities: A sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses PI.

First Party Security Standard: Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information. Separately, a controller subject to the Florida Digital Bill of Rights (FDBR) must establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue, for purposes of protecting the confidentiality, integrity, and accessibility of that data. 

Third Party Security Standard: N/A

Disposal/Destruction Standard: Each covered entity or third-party agent shall take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within its custody or control when the records are no longer to be retained. Such disposal shall involve shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.

Data Format: Electronic and physical.

Citations: Fla. Stat. §§ 501.701 to 501.722.

More Details

Definitions:

• Personal Information (PI): An individual’s first name / first initial and last name in combination with one (1) or more of the following data elements:
  
  • Social Security number;
  • Driver’s license number or state identification card number;
  • Passport number, military identification number, or other similar government-issued identification number used to verify identity;
  • Financial account or payment card number plus any required security code, access code, or password that would permit access to an individual’s financial account;
  • Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or
  • Health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.

A username or email address in combination with a password or security question and answer that would permit access to an online account.

PI does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

Methods of Compliance:

The statute does not define what constitutes reasonable measures and methods of compliance.

Exclusions:

• Health Care: N/A
• Financial: N/A
• Other: N/A

Enforcement/Penalties:

A violation of this section shall be treated as an unfair or deceptive trade practice in any action brought by the department under s. 501.207 against a covered entity or third-party agent.

A consumer may not bring a private cause of action for violation of these standards.

Associated Regulations:

N/A