Law / United States / 
Florida
Florida Digital Bill of Rights, deidentified data, pseudonymous data and aggregate consumer information
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Prohibition, Contract terms, Security
- Audit expectation
- none
What it requires
- If you are a controller under the Florida Digital Bill of Rights and hold deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual (Fla. Stat. 501.714(1)(a)).
- Maintain and use the data in deidentified form and do not attempt to reidentify it, except solely to determine whether your deidentification processes satisfy the section (Fla. Stat. 501.714(1)(b)).
- Contractually obligate every recipient of the deidentified data to comply with Part VI of Chapter 501, and implement business processes to prevent the inadvertent release of the data (Fla. Stat. 501.714(1)(c) and (d)).
- If you disclose pseudonymous data, deidentified data or aggregate consumer information, monitor compliance with the contractual commitments attached to it and take appropriate steps to address any breach (Fla. Stat. 501.714(4)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 501.714 states no log or record duty. It requires oversight of a recipient's contractual commitments in subsection (4) but sets no record a controller must keep.
- Kind
- None
- As of
What this law does
Section 501.714(1) requires a controller in possession of deidentified data to take reasonable measures to ensure that the data cannot be associated with an individual. Section 501.714(1)(b) requires the controller to maintain and use the data in deidentified form and bars it from attempting to reidentify the data, except solely to determine whether its deidentification processes satisfy the section.
Section 501.714(1)(c) and (d) require the controller to contractually obligate any recipient of the deidentified data to comply with Part VI and to implement business processes to prevent the inadvertent release of deidentified data.
Section 501.714(3) provides that the consumer rights in section 501.705(2) and the controller duties in section 501.71 do not apply to pseudonymous data or aggregate consumer information when the controller can demonstrate that the information needed to identify the consumer is kept separate and subject to effective technical and organizational controls that prevent the controller from accessing it.
Section 501.714(4) requires a controller that discloses pseudonymous data, deidentified data or aggregate consumer information to exercise reasonable oversight of compliance with the contractual commitments attached to it and to take appropriate steps to address any breach of them.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .