On June 6, 2023, Senate Bill 262 creating the Florida Digital Bill of Rights was signed by the Governor of Florida, Ron DeSantis, and will enter into effect on July 1, 2024.

Scope

The Digital Bill of Rights will apply to persons that conduct business in Florida or provide a product or service used by residents of Florida and processes or engages in the sale of personal data. However, 'controller' is defined as a sole proprietorship, partnership, limited liability company, corporation, association, or legal entity that meets requirements including making in excess of $1 billion in global gross annual revenue.

Consumer rights

The bill establishes consumer rights including:

• the right to access;

• the right to correction;

• the right to deletion;

• the right to portability; and

• the right to opt out of certain processing. 

The bill also establishes specific requirements for the controller's response to such requests.

Controller and processor requirements

The bill establishes obligations for controllers including data processing principles, restrictions on the processing of sensitive data, and requirements for the publication of a privacy notice. In addition, the bill requires the conducting of Data Protection Assessments (DPAs) in specific circumstances and provides rules for the processing of deidentified data, pseudonymous data, and aggregated consumer information.

On data processors, the bill stipulates vendor management requirements including information that must be included in the controller processor contract.

You can read the bill here and view its history here.