Law / United States / 
Florida
Florida Digital Bill of Rights (FDBR), publicly available information exemption and narrow applicability
Fla. Stat. § 501.702 (SB 262, 2023 session)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence, Operator establishment
- Audit expectation
- none
What it requires
- Check whether you are a controller under section 501.702(9) before assuming the controller duties bind you: they reach only a for-profit entity over $1 billion in global gross annual revenue that also meets an online-advertising, smart-speaker, or large app-store criterion, and any entity that controls or is controlled by it. The ban on selling sensitive data without consent in section 501.715 reaches a wider group, any for-profit entity that does business in Florida, collects consumers' personal data and determines the purposes and means of processing it.
- If the FDBR does apply to you, personal data a consumer restricted to a specific audience is not publicly available under section 501.702(28), even if it is otherwise widely distributed.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When a consumer limits a post to followers or a closed group, has the consumer "restricted the information to a specific audience" under Fla. Stat. section 501.702(28), and does a large follower count still make the audience specific?
- Does a business have a "reasonable basis for believing" that information is "lawfully made available to the general public" under Fla. Stat. section 501.702(28) when the site it was collected from forbids automated collection?
What it makes you log
Logging duty
Section 501.702 is the definitions section of the Florida Digital Bill of Rights: it defines consumer, controller, personal data, publicly available information and the other terms the part uses. It states no duty to create, keep or produce a log or record. The controller and processor duties sit in later sections the row does not cite.
- Kind
- None
- As of
What this law does
Section 501.702(19) excludes publicly available information from the FDBR's definition of personal data, and section 501.702(28) defines publicly available information as information lawfully made available through government records, or information that a business has a reasonable basis for believing is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.
Section 501.702(9) defines a controller as a for-profit entity that conducts business in Florida, collects personal data about consumers or is the entity on behalf of which such information is collected, determines the purposes and means of processing personal data about consumers alone or jointly with others, makes in excess of $1 billion in global gross annual revenues, and additionally derives 50 percent or more of its global gross annual revenues from the sale of advertisements online, operates a consumer smart speaker and voice command component service with an integrated virtual assistant, or operates an app store or digital distribution platform that offers at least 250,000 different software applications; any entity that controls or is controlled by a controller is also a controller.
The FDBR was created by Senate Bill 262 of the 2023 Regular Session (ch. 2023-201) and took effect .
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .