Processes biometric data, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Fla. Stat. § 1014.04(1)(g) to (i) · Read the law's page

• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not make, share or store a biometric scan of a minor child without the parent's written consent (Fla. Stat. § 1014.04(1) and (1)(g)).
• If you are the state, one of its political subdivisions, another governmental entity or another institution, do not create, store or share any record of a minor child's blood or deoxyribonucleic acid (DNA) without the parent's written consent, except as required by general law or authorized pursuant to a court order (Fla. Stat. § 1014.04(1) and (1)(h)).
• If you are the state or one of its political subdivisions, do not make a video or voice recording of a minor child without the parent's written consent, unless the recording is made during or as part of a court proceeding, as part of a forensic interview in a criminal or Department of Children and Families investigation, or solely for a safety demonstration, a legitimate academic or extracurricular activity, regular classroom instruction, security or surveillance of buildings or grounds, or a photo identification card (Fla. Stat. § 1014.04(1)(i)).

Fla. Stat. § 501.702 (SB 262, 2023 session) · Read the law's page

• Check whether you are a controller under section 501.702(9) before assuming the controller duties bind you: they reach only a for-profit entity over $1 billion in global gross annual revenue that also meets an online-advertising, smart-speaker, or large app-store criterion, and any entity that controls or is controlled by it. The ban on selling sensitive data without consent in section 501.715 reaches a wider group, any for-profit entity that does business in Florida, collects consumers' personal data and determines the purposes and means of processing it.
• If the FDBR does apply to you, personal data a consumer restricted to a specific audience is not publicly available under section 501.702(28), even if it is otherwise widely distributed.

Fla. Stat. §§ 501.702(4), 501.702(31), 501.71(2)(d) · Read the law's page

• Obtain a qualifying Florida consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, if you meet FDBR's $1 billion-plus controller threshold.
• Do not treat an identifier derived solely from a video or audio recording as FDBR biometric data. The definition excludes data generated from video or audio recordings, with no exception for data generated to identify someone.
• Display the notice "NOTICE: This website may sell your sensitive personal data" and obtain consent before selling a qualifying consumer's sensitive personal data.

Fla. Stat. §§ 501.705, 501.706, 501.707 · Read the law's page

• Give a qualifying Florida consumer a means to confirm whether you process their personal data, access it, correct it, delete data you provided or obtained about them, and receive it in a portable, readily usable digital format.
• Offer a Florida consumer an opt-out of targeted advertising, sale of personal data, profiling producing a legal or similarly significant effect, collection or processing of sensitive data including precise geolocation, and collection of personal data through a voice or facial recognition feature.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 15-day extension available when reasonably necessary, and decide an appeal of a denial within 60 days.

Rule 2-3.002, Fla. Admin. Code · Read the law's page

• Applies to a controller under the Florida Digital Bill of Rights, which you declare by stating that you are a controller: a for-profit entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing it and makes more than $1 billion in global gross annual revenues, and that also derives 50 percent or more of those revenues from online advertising, operates a consumer smart speaker and voice command component service, or operates an app store or digital distribution platform offering at least 250,000 applications, together with any entity that controls or is controlled by such a controller.
• Protect the confidentiality, integrity and accessibility of the personal data you create, receive, process, archive, maintain or transmit from unauthorized access, use, disclosure, deletion or modification, with data security practices that comply with the risk management framework and standards of the National Institute of Standards and Technology that the rule adopts.
• Apply the security practices for the most sensitive type of data to a data set of mixed sensitivity, and establish, implement and maintain procedures for the secure disposal of personal data.
• Designate a qualified individual to oversee and implement the data security practices, and regularly test and monitor compliance with them, including key controls, systems and procedures.
• Manage access permissions on the principles of least privilege and separation of duties, and maintain effective technical controls including encryption, audit controls that record and examine activity, time synchronization, and safeguards against unauthorized access or modification.
• Limit and protect any storage of personal data on mobile electronic devices and passive storage media, and do not store personal data unencrypted on them.