Law / United States / 
Florida
Florida Digital Bill of Rights, data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Apply the assessment duty to processing activities generated on or after , and not to earlier ones.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of targeted advertising, the sale of personal data, risky profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers (501.713(1)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights (501.713(2)). The section sets no period for keeping an assessment. Subsection (3) treats disclosure of an assessment in compliance with a request from the Attorney General pursuant to section 501.72 as no waiver of attorney-client privilege or work-product protection, which presupposes such a request, but section 501.713 does not itself give the power to make it, and section 501.72 as published names the Department of Legal Affairs as the enforcer and states no power to demand an assessment, so the on-request audit and the regulator's access rest on the request that subsection (3) assumes. The section has no scope clause; the reach is in sections 501.702 and 501.72(10), which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- Fla. Stat. 501.713(1)-(3)
- Trigger
- personal_data_processing
What this law does
FDBR requires a controller to conduct and document a data protection assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.
Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and must factor in the use of deidentified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.
A single assessment may address a comparable set of processing operations, and an assessment conducted to comply with another law or regulation may satisfy the section if it has a reasonably comparable scope and effect. Disclosing an assessment in compliance with a request from the Attorney General under section 501.72 does not waive attorney-client privilege or work-product protection. The section applies only to processing activities generated on or after .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.