Processes personal data, in Florida

Fla. Stat. § 627.4301 · Read the law's page

• If you are a health insurer, life insurer or long-term care insurer authorized to transact insurance in Florida, do not cancel, limit or deny coverage, or set differing premium rates, based on a person's genetic information unless a condition related to that information has been diagnosed.
• Do not require or solicit genetic information, use genetic test results, or consider a person's decisions or actions relating to genetic testing in any manner for any insurance purpose.

Fla. Stat. § 501.171 · Read the law's page

• Notify the Florida Department of Legal Affairs of a breach of security affecting 500 or more individuals in Florida as expeditiously as practicable, and no later than 30 days after determining a breach occurred or having reason to believe one occurred.
• Notify each affected Florida individual of a breach as expeditiously as practicable and without unreasonable delay, and no later than 30 days after determining a breach occurred or having reason to believe one occurred; you may have 15 additional days if you give the Florida Department of Legal Affairs written good cause for the delay within those 30 days.
• If you need 15 additional days to notify affected individuals, give the Florida Department of Legal Affairs written notice of good cause for the delay within 30 days after determining a breach occurred or having reason to believe one occurred.
• If you determine that a breach is not likely to result in identity theft or other financial harm and so do not notify individuals, submit that written determination to the Florida Department of Legal Affairs within 30 days after the determination.
• If you are a third-party agent that maintains a system that suffers a breach of security, notify the covered entity as expeditiously as practicable and no later than 10 days after determining a breach occurred or having reason to believe one occurred.

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Fla. Stat. § 1014.04(1)(g) to (i) · Read the law's page

• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not make, share or store a biometric scan of a minor child without the parent's written consent (Fla. Stat. § 1014.04(1) and (1)(g)).
• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not create, store or share any record of a minor child's blood or deoxyribonucleic acid (DNA) without the parent's written consent, except as required by general law or authorized pursuant to a court order (Fla. Stat. § 1014.04(1) and (1)(h)).
• If you are the state or one of its political subdivisions, do not make a video or voice recording of a minor child without the parent's written consent, unless the recording is made during or as part of a court proceeding, as part of a forensic interview in a criminal or Department of Children and Families investigation, or solely for a safety demonstration, a legitimate academic or extracurricular activity, regular classroom instruction, security or surveillance of buildings or grounds, or a photo identification card (Fla. Stat. § 1014.04(1)(i)).

Fla. Stat. §§ 760.40, 817.5655 · Read the law's page

• If you perform DNA analysis, get the express consent of the person tested first: an authorization shown by an affirmative action, given after a clear and prominent disclosure of how the DNA sample and the results will be collected, used, retained, maintained or disclosed.
• Do not disclose the results of a person's DNA analysis to anyone without that person's express consent.
• If you perform DNA analysis or receive its results, notify the person tested that the analysis was performed or the information received, that it will be made available to their physician on request, and whether it was used in any decision to grant or deny insurance, employment, a mortgage, a loan, credit or an educational opportunity.
• If the information was used in a decision that resulted in a denial, repeat the analysis to verify the first one, and review the denial if the first analysis is inaccurate.
• Do not willfully collect or retain another person's DNA sample with the intent to perform DNA analysis, or submit a sample for analysis or conduct or procure the analysis, without express consent.
• Do not willfully sell or transfer another person's DNA sample or the results of a DNA analysis to a third party without express consent, even if the sample was first collected, retained or analyzed with express consent.

Fla. Stat. § 501.713 · Read the law's page

• Conduct and document a data protection assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Apply the assessment duty to processing activities generated on or after July 1, 2023, and not to earlier ones.

Fla. Stat. § 501.714 · Read the law's page

• If you are a controller under the Florida Digital Bill of Rights and hold deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual (Fla. Stat. 501.714(1)(a)).
• Maintain and use the data in deidentified form and do not attempt to reidentify it, except solely to determine whether your deidentification processes satisfy the section (Fla. Stat. 501.714(1)(b)).
• Contractually obligate every recipient of the deidentified data to comply with Part VI of Chapter 501, and implement business processes to prevent the inadvertent release of the data (Fla. Stat. 501.714(1)(c) and (d)).
• If you disclose pseudonymous data, deidentified data or aggregate consumer information, monitor compliance with the contractual commitments attached to it and take appropriate steps to address any breach (Fla. Stat. 501.714(4)).

Fla. Stat. § 501.72 · Read the law's page

• Expect FDBR violations to be enforced exclusively by the Florida Department of Legal Affairs as an unfair and deceptive trade practice, never by a private plaintiff.
• Do not assume a cure opportunity as of right. The Department may, but is not required to, grant a 45-day cure period and issue a letter of guidance, and no cure period applies at all to a known-child violation.
• Expect a civil penalty of up to $50,000 per violation, tripled for a known-child violation, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.

Fla. Stat. §§ 501.701, 501.702(9) · Read the law's page

• Confirm whether you are a controller under Florida's narrow test before relying on FDBR: it binds only a for-profit entity conducting business in Florida that collects personal data, determines the purposes and means of processing, makes more than $1 billion in global gross annual revenue, and either derives 50 percent or more of that revenue from online advertising, operates a qualifying smart speaker service, or operates an app store or digital distribution platform offering at least 250,000 applications.
• Do not treat FDBR as Florida's general consumer-privacy law. Outside the $1 billion-plus platform set it defines, Florida imposes no state-law data-minimization, purpose-limitation, or consumer-rights duty under Part VI at all.

Fla. Stat. §§ 501.705, 501.706, 501.707 · Read the law's page

• Give a qualifying Florida consumer a means to confirm whether you process their personal data, access it, correct it, delete data you provided or obtained about them, and receive it in a portable, readily usable digital format.
• Offer a Florida consumer an opt-out of targeted advertising, sale of personal data, profiling producing a legal or similarly significant effect, collection or processing of sensitive data including precise geolocation, and collection of personal data through a voice or facial recognition feature.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 15-day extension available when reasonably necessary, and decide an appeal of a denial within 60 days.

Fla. Admin. Code R. 2-3.001, 2-3.003 and 2-3.004 · Read the law's page

• If you are a controller under the Florida Digital Bill of Rights, use a commercially reasonable method to authenticate a consumer who submits a request to exercise a right (Florida Administrative Code Rule 2-3.004(1)).
• Treat a request from an authorized person, who is the consumer, a person with the consumer's express written authority or power of attorney, or a child's parent or legal guardian, and who is authenticated under Rule 2-3.004, as a request made on the consumer's behalf (Rule 2-3.001(1), (2)).