Law: Florida Digital Bill of Rights (FDBR)

Regulator: The Florida Attorney General (AG)

Summary:  On July 1, 2024, the FDBR entered into force following its enactment on June 6, 2023. The FDBR introduces obligations for controllers, including data processing principles, disclosure, and retention requirements when processing personal information. In addition, the FDBR requires conducting Data Protection Assessments in specified circumstances and vendor contracts between controllers and processors. Moreover, the FDBR establishes data subject rights, including confirmation, access, correction, deletion, and data portability, as well as the right to opt out of certain processing activities.

The FDBR provides the Department of Legal Affairs (the Department) with enforcement powers but does not provide a private right of action. The Department adopted implementing rules related to authorized persons, which enters into force on July 18, 2024. Furthermore, Section 23 of the Constitution of the State of Florida provides for the right to privacy, and under §501.171 et seq. of Chapter 501 of Title 33 of the Florida Statutes, there is a requirement for covered entities to notify individuals individually as well as the AG of personal data breaches of electronic records when a breach affects 500 or more individuals.