Law / United States / 
Florida
Florida Digital Bill of Rights, sensitive data and biometric data definitions
Fla. Stat. §§ 501.702(4), 501.702(31), 501.71(2)(d)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- Audit expectation
- none
What it requires
- Obtain a qualifying Florida consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, if you meet FDBR's $1 billion-plus controller threshold.NIST Privacy FrameworkCT.PO-P1
- Do not treat an identifier derived solely from a video or audio recording as FDBR biometric data. The definition excludes data generated from video or audio recordings, with no exception for data generated to identify someone.
- Display the notice "NOTICE: This website may sell your sensitive personal data" and obtain consent before selling a qualifying consumer's sensitive personal data.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Florida Department of Legal Affairs (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
Rule 2-3.003 of the Florida Administrative Code is the Department's implementing rule and serves as guidance because no other Department page construes this duty. It defines when a controller willfully disregards a consumer's age, the test for a known child under section 501.702(17).
- As of
- Guidance link
- https://www.flrules.org/gateway/readFile.asp?sid=0&tid=28502982&type=1&file=2-3.003.doc
- Guidance body
- Florida Department of Legal Affairs
- Open questions
- Does the exclusion in Fla. Stat. § 501.702(4) for "data generated from video or audio recordings" reach a faceprint generated from a photograph, which the exclusion names only as "physical or digital photographs"?
- Does "mental or physical health diagnosis" in § 501.702(31)(a) reach a health condition a controller infers from browsing or purchase data when no health care professional has made a diagnosis?
What it makes you log
Logging duty
Section 501.702(4) defines biometric data and subsection (31) defines sensitive data as personal data revealing racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation or citizenship or immigration status, genetic or biometric data processed to identify an individual, data collected from a known child, and precise geolocation data. Definitions state no record. Section 501.71(2)(d), which the row also cites, bars a controller from processing a consumer's sensitive data without the consumer's consent, a condition of processing that does not say a record of the consent is kept. The cited text names no territorial reach: the consumer and controller definitions in section 501.702(8) and (9) are not among this row's cited provisions. The documented data protection assessment that covers processing of sensitive data is in section 501.713, which this row does not cite.
- Kind
- None
- As of
What this law does
For a qualifying controller, FDBR classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, a known child's personal data, and precise geolocation data as sensitive data, which may not be processed without the consumer's prior consent.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, including fingerprints, voiceprints, or eye retinas or irises, but the definition carries a blanket, unconditional exclusion for physical or digital photographs, for video or audio recordings, and for data generated from video or audio recordings, with no clawback for data generated to identify someone.
A voiceprint or faceprint extracted from a video or audio recording for identification purposes is therefore categorically outside biometric, and so sensitive, data here, the opposite posture from Connecticut's and Delaware's clawback structure. The exclusion names the photograph itself but names no data generated from a photograph.
A controller may not sell sensitive personal data without prior consent and must display the notice "NOTICE: This website may sell your sensitive personal data" before doing so.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .