Florida Senate Bill 262 has passed in the Republican-led Florida legislature. The Florida Privacy Act attempts to give consumers the right to opt out of sharing their data for targeted online ads, which are often collected and sold by companies to advertisers.
Mass surveillance and overreach by huge online tech companies have pushed the proposal for a far-reaching legislative agenda that ended in success last week. Florida is now reigning in on the big tech world with a newly enshrined “Florida Digital Bill of Rights.”
Republican Gov. Ron DeSantis aimed to pass several “priority legislations” set to increase Florida data privacy laws and safeguard consumers against censorship and tracking. The DeSantis digital privacy boost joins some other notable efforts, more controversial in nature, like banning the discussion of sexual orientation or gender identity until a certain age.
In addition to the “bill of rights,” Florida lawmakers are poised to pass additional legislation aiming to protect children online. HB 591, which was passed by a House subcommittee, would require social networking sites used by children under the age of 18 to disclose their content moderation standards and ask young users to agree to a disclaimer that the site may be harmful to their mental health.
Two Strikes and… In!
This is the third year in a row that Senator Bradley and Rep. McFarland, both Republicans, have sponsored a Florida privacy bill. This year’s version weaves together some strings of other data privacy laws in the US. The new law is similarly crafted to the Virginia bill but with a narrower scope of applicability. It would require companies with gross revenues of over $1 billion a year to implement new consumer rights for data privacy in Florida if they make at least half their revenue from targeted or online ads.
Bill SB 262 Takes Aim at Tech Giants
Faced with the backlash that Florida’s small businesses would suffer from these sweeping laws, the legislative committee scaled back the law by narrowing the threshold to target larger companies specifically.
The fear was that the original bill would not only harm the ability of small and medium-sized businesses to generate advertising sales, but it would also limit potential customers from reaching smaller-sized retail businesses.
For instance, Alexander Fedorowicz, co-founder and CEO of Doral-based QRX Labs, a small skincare company with 35 products sold worldwide, testified before the Senate Rules Committee that thanks to online advertising, his 18-person business can “compete against very large companies like the Procter and Gambles and L’Oreals of this world, in an efficient and cost-effective way.”
He cautioned that enabling consumers to opt out of internet advertising could have a significant negative effect on the financial health of his business and that, given the proposed July 1 effective date, he might not have enough time to change his strategies to continue reaching customers.
To mitigate this phenomenon, the Florida privacy protection act was amended to limit the applicability of the law to tech giants.
The amended measure now applies to for-profit companies that make over $1 billion in gross revenue and that either manufacture smart devices or derive at least 50 percent of revenue from online or targeted advertising.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
Bill Takeaways
Consumer Rights
- Requires that companies get consumer permission to collect and sell personal data and impose new disclosure requirements so that customers can know when and if their personal data is collected
- Prevents companies from selling someone’s personal data to a data broker without their consent
- Proposes the right to opt out of the sale of personal information and the right to request the correction and deletion of certain data
- In contrast to privacy laws in Colorado, Connecticut, and Virginia, Florida’s privacy bill does not include the right to opt out of processing for targeted advertisements and using automated decision-making processes to opt-out automatically
Obligations for Eligible Businesses
- Controllers must provide consumers with a notice about certain data practices and privacy policies.
- Controllers must obtain express consent for the processing of personal data of children between the ages of 13 and 18.
- Controllers that sell sensitive personal or biometric data must clearly disclose their activities on their websites, as instructed.
- Both controllers and processors must adopt and implement a retention schedule.
- The Florida legislation does not propose a formal requirement for businesses to perform risk assessments of privacy procedures other than for pre-specified purposes, in contrast to privacy laws in California, Colorado, and Connecticut.
Search Engine Transparency Requirements
In contrast to other state privacy laws in the United States, the Florida law proposes transparency requirements for controllers that operate search engines to provide an “up-to-date plain language description of the main parameters that are individually or collectively the most significant in determining ranking and the relative importance of those main parameters, including the prioritization or deprioritization of political partisanship or political ideology in search results.”
Transparency Rules for Social Media Platforms
Uncharacteristic of any state privacy laws in the U.S., the Florida bill proposes that government officers and salaried employees would not be able to use their position and state resources to communicate with social media platforms and request the removal of content or accounts.
Conclusion
On May 4, the day before the Florida legislature closed, SB 262 passed in the House with 110 Yeas and 2 Nays and is expected to be sent to the governor for his signature in the coming weeks.
Centraleyes is committed to bringing you up-to-date reports of progress on state and federal privacy laws across the United States. Refer to our other articles on other state legislation passed in 2023.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
