Makes housing decisions, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Fla. Stat. § 501.713 · Read the law's page

• Conduct and document a data protection assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Apply the assessment duty to processing activities generated on or after July 1, 2023, and not to earlier ones.

Fla. Stat. §§ 501.705, 501.706, 501.707 · Read the law's page

• Give a qualifying Florida consumer a means to confirm whether you process their personal data, access it, correct it, delete data you provided or obtained about them, and receive it in a portable, readily usable digital format.
• Offer a Florida consumer an opt-out of targeted advertising, sale of personal data, profiling producing a legal or similarly significant effect, collection or processing of sensitive data including precise geolocation, and collection of personal data through a voice or facial recognition feature.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 15-day extension available when reasonably necessary, and decide an appeal of a denial within 60 days.