Skip to main content

What Does the Florida Digital Bill of Rights Mean for Your Business?

Kelly Ruane Melchiondo

Photo illustration that says Personal DataFlorida Governor Ron DeSantis signed into law Senate Bill 262, known as the “Florida Digital Bill of Rights” (“FDBR”), on June 6, 2023. 

The FDBR will go into effect on July 1, 2024, which means businesses subject to it will have just over a year to prepare for compliance. The law significantly expands the definition of “personal information” in Florida’s existing Information Protection Act, Chapter 501.171, to include (i) “biometric data,” which includes fingerprints, voiceprints, retina scans and other unique biological patterns used to identify specific individuals, and (ii) information regarding an individual’s geolocation.

Aside from this major change which will apply generally to most companies that collect consumer data, the remaining provisions of the FDBR, Fla. Stat. 501.701, et. seq., will only apply to a limited number of companies that do business in Florida. The FDBR takes aim squarely at Big Tech companies, such as Apple, Amazon and Google who act as “controllers” of data from consumers. The FDBR defines a “controller” as an entity that conducts business in Florida, collects personal data about consumers, makes over $1 billion in global gross annual revenues, and meets at least one of the following: (1) derives 50 percent or more of its global gross annual revenues from selling advertisements online, including providing targeted advertising or selling ads online, (2) operates a smart speaker and voice command component service, with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation (i.e., Siri and Alexa), or (3) operates an app store, or digital distribution platform, that offers at least 250,000 different software applications for consumers to download and install.

Companies that fit this “controller” bill are required to, among other things, establish secure and reliable means for consumers to exercise their privacy rights under the laws, obtain consumer consent to process “sensitive data,” and to conduct and document data protection assessments. The FDBR now defines “sensitive data” as any data that reveals an individual’s racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, biometric data such as fingerprints and retina scans, personal data collected from children and precise geolocation data.  

The FDBR affords Florida consumers considerably more protection than existing Florida data protection statutes. Consumers now have the ability to confirm whether controllers are processing their personal data and to access that data, correct inaccuracies in their data, ask controllers to delete all their data, and opt out of the sale of their data, or the processing of personal data, for purposes of sending targeted advertising. Consumers also have the ability to opt out of the collection of personal data through operation of a voice recognition or facial recognition feature.

Florida’s Department of Legal Affairs has jurisdiction over enforcement, and is permitted, but not required, to afford offending companies a 45-day safe harbor period to cure violations. While the FDBR does not afford consumers a private right of action for violations, the fines that the government can impose are hefty—up to $50,000 per violation, with tripled penalties for certain violations, including those that involve known children.

While the FDBR will likely only apply narrowly to “Big Tech” companies, because of the new categories of “personal information” that Florida law protects, all companies that collect consumer data in Florida should review the type of data they collect from consumers, how they collect that data, and what they do to protect that data once collected.

Related Practices
Speaking Engagement July 19, 2024
Howard E. Nelson participates on the panel Hot Topics/Emerging Issues In Waste Management at the 38th Annual Environmental Permitting Summer School. The panelists discuss the latest policy changes including new emerging elements for site closures involving Water Management Districts, the effects of ...
Speaking Engagement July 18, 2024
Thomas F. Mullin participates on the panel Keeping Your Eye On The Ball: Scoping The Appropriate Environmental Due Diligence For The Project at the 38th Annual Environmental Permitting Summer School. The panelists discuss appropriate scoping of the environmental due diligence process, taking into co...
Speaking Engagement July 17, 2024
Howard E. Nelson participates on the panel Land and Golf Course Redevelopment: Opportunities and Challenges at the 38th Annual Environmental Permitting Summer School. The panelists discuss how to navigate the substantial challenges regarding land use, availability of water (quantity and quality), an...