Update applicable to:

All employers meeting the applicable factors specified below

What happened?

Florida enacted a new data privacy law that mirrors similar privacy laws in other states such as Virginia, Colorado, and Utah. 

What are the details?

Senate Bill  262, otherwise known as the Florida Digital Bill of Rights (“FDBR”), was signed into legislation by Governor Ron DeSantis on June 6 and will take effect on July 1, 2024.

Applicability: The FDBR applies to companies that generate more than $1 billion U.S.D. in gross annual revenue and derive at least 50% of their revenue from the sale of digital advertisements, operate an app store or digital distribution platform that offers at least 250,000 different software applications, or operate a smart-speaker and voice-command service with an integrated virtual assistant connected to a cloud computing service with verbal activation. The FDBR applies to all entities, with the exception of state agencies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA-covered entities, nonprofit organizations, and postsecondary education institutions.

The Florida Data Privacy Rights Act (FDBR) grants consumers several rights over their personal data held by companies, including access, correction, deletion, and opting out of certain data processing. Data controllers must respond to consumer requests within 45 days and cannot discriminate against consumers making such requests. Sensitive data processing requires consumer consent, and data controllers must conduct data protection assessments for certain activities.

Businesses must provide clear privacy notices and are restricted from collecting data when voice-activated devices are not in use without explicit authorization. Government entities are prohibited from requesting content removal on social media platforms. The FDBR also includes strict provisions protecting children’s data, prohibiting profiling and the use of dark patterns.

Enforcement is through the Florida attorney general, with fines of up to $50,000 per violation, tripled under specific circumstances. Consumers do not have a private right of action under this law.

For more information, please see the links below:

Complete Summary

Summary 2

Summary 3

What do employers need to do?

Employers subject to the law will need to evaluate their data privacy compliance programs in light of some of the Florida law’s diverging provisions. Additionally, as the law broadens some rights under the existing US state privacy laws, employers will need to evaluate their user rights mechanisms to ensure compliance.

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.