Law / United States / 
Florida
Florida Digital Bill of Rights, controller data security rule
Rule 2-3.002, Fla. Admin. Code
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Retention
As of .
What it requires
- Applies to a controller under the Florida Digital Bill of Rights, which you declare by stating that you are a controller: a for-profit entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing it and makes more than $1 billion in global gross annual revenues, and that also derives 50 percent or more of those revenues from online advertising, operates a consumer smart speaker and voice command component service, or operates an app store or digital distribution platform offering at least 250,000 applications, together with any entity that controls or is controlled by such a controller.
- Protect the confidentiality, integrity and accessibility of the personal data you create, receive, process, archive, maintain or transmit from unauthorized access, use, disclosure, deletion or modification, with data security practices that comply with the risk management framework and standards of the National Institute of Standards and Technology that the rule adopts.
- Apply the security practices for the most sensitive type of data to a data set of mixed sensitivity, and establish, implement and maintain procedures for the secure disposal of personal data.
- Designate a qualified individual to oversee and implement the data security practices, and regularly test and monitor compliance with them, including key controls, systems and procedures.
- Manage access permissions on the principles of least privilege and separation of duties, and maintain effective technical controls including encryption, audit controls that record and examine activity, time synchronization, and safeguards against unauthorized access or modification.
- Limit and protect any storage of personal data on mobile electronic devices and passive storage media, and do not store personal data unencrypted on them.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Fla. Stat. 501.72(1) lets the department collect a civil penalty of up to $50,000 per violation, which may be tripled for a violation involving a known child, a failure to delete or correct data after a valid request, or continuing to sell or share data after an opt-out.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
The Department of Legal Affairs (the Florida Attorney General's office) is the sole enforcing authority: a violation of the Florida Digital Bill of Rights is an unfair and deceptive trade practice actionable solely by the department.
What this law does
Rule 2-3.002 requires a controller to protect the confidentiality, integrity, and accessibility of the personal data it creates, receives, processes, archives, maintains, or transmits from the unauthorized access, use, disclosure, deletion, or modification of personal data.
A controller must establish, implement, and maintain data security practices that comply with the risk management framework and standards adopted by the National Institute of Standards and Technology of the United States Department of Commerce. A controller must establish, implement, and maintain procedures for the secure disposal of personal data.
A controller must designate a qualified individual responsible for overseeing and implementing the data security practices required under the Florida Digital Bill of Rights. A controller must regularly test and monitor compliance with data security practices, including key controls, systems, and procedures, to detect actual and attempted attacks on, or intrusions into systems that contain personal data.
A controller must manage access permissions, incorporating the principles of least privilege and separation of duties with respect to different types of personal data. A controller must maintain effective technical controls for personal data, including the use of encryption, audit controls that record and examine activity, time synchronization, and safeguards against unauthorized access or modification to personal data.
A controller must limit and protect any storage of personal data on mobile electronic devices and passive storage media, and unencrypted storage of personal data on those devices and media is prohibited. A controller must also apply the security practices for the most sensitive type of data within a data set with mixed levels of sensitivity.
A controller is a for-profit entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing it, and makes in excess of $1 billion in global gross annual revenues, and that also satisfies at least one of three further conditions.
Those conditions are deriving 50 percent or more of global gross annual revenues from the sale of advertisements online, or operating a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. The third condition is operating an app store or digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.
Any entity that controls or is controlled by a controller is also a controller. Section 501.72(5) of the Florida Statutes directs the Department of Legal Affairs to adopt rules to implement the section, including standards for data security. A violation of the Florida Digital Bill of Rights is an unfair and deceptive trade practice actionable solely by the Department of Legal Affairs, which may collect a civil penalty of up to $50,000 per violation. The part creates no private cause of action. Rule 2-3.002 took effect on .
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or operates an app store.