Law / United States / 
Florida
Florida Digital Bill of Rights, Department of Legal Affairs enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Expect FDBR violations to be enforced exclusively by the Florida Department of Legal Affairs as an unfair and deceptive trade practice, never by a private plaintiff.
- Do not assume a cure opportunity as of right. The Department may, but is not required to, grant a 45-day cure period and issue a letter of guidance, and no cure period applies at all to a known-child violation.
- Expect a civil penalty of up to $50,000 per violation, tripled for a known-child violation, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.
These lines are LexLint's reading of the law's text. Also read by: Florida Department of Legal Affairs (guidance, recorded ).
Who enforces it
Settledness
Rule 2-3.003 of the Florida Administrative Code is the Department's implementing rule and serves as guidance because no other Department page construes this enforcement provision. It also states that the Department will not grant a cure period for alleged violations involving a child.
- As of
- Guidance link
- https://www.flrules.org/gateway/readFile.asp?sid=0&tid=28502982&type=1&file=2-3.003.doc
- Guidance body
- Florida Department of Legal Affairs
- Open questions
- Does the Department's rule barring a cure period for alleged violations "involving a child" reach a violation involving a child who is not a "known child", when Fla. Stat. § 501.72(2) bars the cure period only for an alleged violation of § 501.72(1)(a)?
- Is a "violation" under § 501.72(1) counted per consumer, per request, or per practice when the Department collects a civil penalty of up to $50,000?
What it makes you log
Logging duty
Section 501.72 makes a violation of the Act an unfair and deceptive trade practice actionable only by the Department of Legal Affairs, with a civil penalty of up to $50,000 per violation, an optional 45-day cure period, an annual public report by the Department of its own enforcement statistics (subsection (4)) and rulemaking. It states no record a controller must keep and gives the Department no express power to demand records in these subsections. The Act's documented data protection assessments are in section 501.713, which this row does not cite. Subsection (10) treats a controller that collects, shares or sells the personal data of Florida consumers as doing business in the state for jurisdiction in an enforcement action.
- Kind
- None
- As of
What this law does
A violation of FDBR is an unfair and deceptive trade practice actionable solely by the Florida Department of Legal Affairs, with a civil penalty of up to $50,000 per violation, tripled for a known-child violation, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.
After written notice of an alleged violation, the Department may, but is not required to, grant a 45-day cure period and issue a letter of guidance; that cure period does not apply to a known-child violation, and no sunset date for the cure provision appears anywhere in the text reviewed. FDBR creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .