On June 6, 2023, Florida Governor Ron DeSantis signed legislation to create a “Digital Bill of Rights for Floridians” (SB 262). At signing, Floridians were told that they “should have the right to control their own personal data.” The newly created Digital Bill of Rights includes:
- The right to control personal data, including the right to confirm, access, and delete your personal data from a social platform;
- The right to know that your personal data will not be used against you when purchasing a home, obtaining health insurance, or being hired;
- The right to know how internet search engines manipulate search results;
- The right to opt out of having personal data sold; and
- The right to protect children from personal data collection.
With all these rights, does Florida’s new Digital Bill of Rights apply to your business?
Probably not. The Digital Bill of Rights largely applies only to companies that generate more than $1 billion in global gross annual revenue and meet other criteria (deriving at least 50 percent of their global gross revenue from the sale of online advertising; operating a consumer smart-speaker and voice command service; or operating an app store that offers at least 250,000 apps). Companies meeting this [extremely high] threshold are deemed “controllers” and targeted by the new law.
Does this mean that other businesses should ignore the new Digital Bill of Rights entirely?
Not entirely. Provisions requiring consumer consent for the sale of “sensitive data” apply to all for-profit entities that conduct business in Florida. Moreover, the law incorporates some requirements of data processors. This may sound scary at first, but it is important to note that the definition of “processor” is limited to persons who process data on behalf of controllers. Again, given the extremely narrow definition of controllers, few processors will exist under this law. The takeaway here is that if your business does in fact do business with a billion-dollar company and you process personal data belonging to Florida consumers on behalf of same, your contracts with said billion-dollar company will look a bit different and you will need to understand your heightened responsibilities as a processor under the Digital Bill of Rights.
Bonus Florida Privacy Law.
If you’ve made it this far after realizing Florida’s new Digital Bill of Rights probably does not apply to your business, I would like to offer you this informational reward: Florida does in fact have a privacy law already in existence that probably does apply to your business, which you should be aware: F.S. § 501.171 – Security of Confidential Personal Information. Under this law, every commercial entity that acquires, maintains, stores, or uses personal information must take reasonable measures to protect and secure such data in electronic form, must give notice to each individual whose personal information was accessed as the result of a breach, and must take all reasonable measures to dispose of such personal information.
Whether your company would like to discuss Florida’s new Digital Bill of Rights or Florida’s requirements for securing confidential personal information (F.S. § 501.171), Roberts Law is here to help. Contact us for a free consultation to discuss your needs and how we can help your business run smoothly.
Author: Josh Roberts
Email: josh@joshrobertslaw.com
Josh Roberts is a business and litigation attorney at Roberts Law, PLLC with over a decade of BigLaw and in-house technology experience helping businesses and business owners navigate contracts, privacy concerns, negotiations, and dispute resolutions.
Disclaimer: The information in this blog post (“post”) is provided for general informational purposes only and may not reflect the current law in your jurisdiction or the jurisdiction applicable to your issue/matter. No information contained in this post should be construed as legal advice from Roberts Law, PLLC or the individual author, nor is it intended to be a substitute for legal counsel on any subject matter. No reader of this post should act or refrain from acting on the basis of any information included in, or accessible through, this post without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from a lawyer licensed in the recipient’s state, country or other appropriate licensing jurisdiction.
