FLORIDA DIGITAL BILL OF RIGHTS (FDBR) PRIVACY NOTICE

Effective Date: [DATE]
Last Updated: [DATE]

NOTICE TO FLORIDA RESIDENTS

This Privacy Notice is provided pursuant to the Florida Digital Bill of Rights, codified at Florida Statutes Section 501.701 et seq. (FDBR), which became effective July 1, 2024.

1. SCOPE AND APPLICABILITY

1.1 Who This Notice Applies To

This Notice applies to "consumers" as defined by Fla. Stat. Section 501.702, meaning natural persons who are Florida residents acting only in an individual or household context. This Notice does not apply to persons acting in a commercial or employment context.

1.2 Unique High Applicability Thresholds

The FDBR is intentionally designed to regulate large technology companies. Pursuant to Fla. Stat. Section 501.703, this law applies only to for-profit entities that:

MUST have gross annual revenues exceeding $1 BILLION AND meet one of the following:

☐ Derives 50% or more of global gross annual revenues from the sale of online advertisements, including targeted advertising or sale of ads online

☐ Operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that has more than 250,000 units sold in Florida

☐ Operates an app store or digital distribution platform with at least 250,000 different software applications available for download

Important: Due to the $1 billion revenue threshold, the FDBR applies only to very large technology companies and will NOT apply to most businesses.

1.3 Exemptions

The following are exempt from the FDBR pursuant to Fla. Stat. Section 501.703:

• State agencies and political subdivisions
• Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA)
• Covered entities and business associates under HIPAA
• Nonprofit organizations
• Higher education institutions
• Utility service providers

2. DEFINITIONS

Pursuant to Fla. Stat. Section 501.702:

"Personal Data" means any information that is linked or reasonably linkable to an identified or identifiable individual, excluding de-identified data and publicly available information.

"Sensitive Data" means personal data that includes:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data for identification purposes
- Personal data collected from a known child
- Precise geolocation data

"Child" means an individual under 18 years of age (broader than the typical 13-year COPPA definition).

"Sale of Personal Data" means sharing, disclosing, or transferring personal data for monetary or other valuable consideration.

"Targeted Advertising" means displaying advertisements based on personal data obtained from consumer activities across nonaffiliated websites or applications.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Pursuant to Fla. Stat. Section 501.705, we process the following categories of personal data:

3.1 General Personal Data

3.2 Sensitive Data

Pursuant to Fla. Stat. Section 501.705, we collect sensitive data ONLY with your consent:

4. REQUIRED SENSITIVE DATA SALE NOTICES

4.1 Notice of Sensitive Data Sale

Pursuant to Fla. Stat. Section 501.705, if we sell sensitive personal data:

NOTICE: We may sell your sensitive personal data.

☐ This notice applies to our business

☐ This notice does NOT apply - we do not sell sensitive personal data

4.2 Notice of Biometric Data Sale

Pursuant to Fla. Stat. Section 501.705, if we sell biometric personal data:

NOTICE: We may sell your biometric personal data.

☐ This notice applies to our business

☐ This notice does NOT apply - we do not sell biometric personal data

5. YOUR FLORIDA PRIVACY RIGHTS

Pursuant to Fla. Stat. Section 501.704, Florida consumers have the following rights:

5.1 Right to Confirm and Access (Section 501.704(1))

You have the right to confirm whether we are processing your personal data and to access such data.

5.2 Right to Correct (Section 501.704(2))

You have the right to correct inaccuracies in your personal data.

5.3 Right to Delete (Section 501.704(3))

You have the right to delete personal data provided by or obtained about you.

5.4 Right to Data Portability (Section 501.704(4))

You have the right to obtain a copy of your personal data in a portable and readily usable format.

5.5 Right to Opt Out (Section 501.704(5))

You have the right to opt out of:
- The sale of your personal data
- Processing for targeted advertising

5.6 Right to Opt Out of Voice/Facial Recognition

Pursuant to Fla. Stat. Section 501.704, you have the right to opt out of the collection of personal data through:
- Voice recognition technology
- Facial recognition technology

6. EXERCISING YOUR RIGHTS

6.1 How to Submit a Request

Methods to Submit Requests:

☐ Online Portal: [URL]

☐ Email: [PRIVACY EMAIL]

☐ Phone: [PHONE NUMBER]

☐ Mail: [MAILING ADDRESS]

6.2 Response Timeline

Pursuant to Fla. Stat. Section 501.704:

• Initial Response: Within 45 days of receipt
• Extension: May extend by an additional 15 days when reasonably necessary
• Notification: We will inform you of any extension and the reason

6.3 No Fee

We provide responses free of charge.

7. RIGHT TO APPEAL

7.1 Appeal Process

If we decline your request, you have the right to appeal.

To Submit an Appeal:

☐ Email: [APPEAL EMAIL]

☐ Online Form: [URL]

☐ Mail: [ADDRESS]

7.2 Contact the Attorney General

If you are not satisfied with our appeal decision, you may file a complaint with:

Office of the Attorney General of Florida
Department of Legal Affairs
The Capitol PL-01
Tallahassee, Florida 32399-1050
Phone: (850) 414-3300
Website: www.myfloridalegal.com

8. CHILD PROTECTION PROVISIONS

8.1 Definition of Child

Under the FDBR, a "child" is an individual under 18 years of age - broader than the typical COPPA definition of under 13.

8.2 Requirements for Children's Data

Pursuant to Fla. Stat. Section 501.709:

☐ We obtain prior consumer consent before processing personal data of a known child

☐ We do not process a child's personal data in a manner that may result in substantial harm or privacy risk to the child

☐ We do not profile children unless we have appropriate safeguards and profiling is necessary to provide the requested service

8.3 Platform Requirements

If we operate an online platform:

☐ We do not process any child's personal information if we have actual knowledge (or willfully disregard) that the processing may result in substantial harm or privacy risk to the child

☐ We do not profile a child unless appropriate safeguards are in place and profiling is necessary for the service

9. ENFORCEMENT

9.1 Discretionary Cure Period

Pursuant to Fla. Stat. Section 501.711, the Florida Attorney General may, at their discretion, provide a 45-day cure period before initiating enforcement action.

Important: Unlike most state privacy laws, Florida's cure period is discretionary, not mandatory.

9.2 Penalties

Violations are considered unfair and deceptive trade practices. Penalties include:
- Civil penalties up to $50,000 per violation
- Triple penalties (up to $150,000 per violation) if:
- The violation involves a consumer under 18
- The controller fails to delete or correct data
- The controller continues to sell/share data after opt-out

9.3 No Private Right of Action

The FDBR does not provide consumers with a private right of action. Enforcement is exclusively through the Florida Department of Legal Affairs.

10. DATA SECURITY

Pursuant to Fla. Stat. Section 501.705, we maintain appropriate technical and physical measures to protect the confidentiality and integrity of personal data.

Our security measures include:

☐ Encryption of data in transit and at rest

☐ Access controls and authentication measures

☐ Regular security assessments and audits

☐ Employee training on data protection

☐ Incident response procedures

☐ Vendor security assessments

11. DATA MINIMIZATION

Pursuant to Fla. Stat. Section 501.705, we limit the processing of personal data to what is "adequate, relevant, and reasonably necessary" for the purposes disclosed to consumers.

12. CONTROLLER AND PROCESSOR RELATIONSHIPS

12.1 Controller Information

[COMPANY NAME] is the controller of personal data processed under this Notice.

Controller Contact:
[ADDRESS]
[EMAIL]
[PHONE]

12.2 Processor Requirements

Our contracts with processors require appropriate data protection measures.

13. CONTACT INFORMATION

Privacy Inquiries:

Name: [PRIVACY OFFICER NAME]
Title: [TITLE]
Email: [EMAIL]
Phone: [PHONE]
Address: [ADDRESS]

Consumer Rights Requests:

Email: [EMAIL]
Online: [URL]
Phone: [PHONE]

14. CHANGES TO THIS NOTICE

We update this Notice at least annually. Material changes will be communicated:

☐ By posting an updated Notice on our website

☐ By email notification

☐ By notice within our application

DOCUMENT CONTROL

Legal Review: ☐ Completed Date: _________ Reviewer: _________

Next Review Date: _____________

This Notice is provided for informational purposes and compliance with the Florida Digital Bill of Rights. It does not constitute legal advice. Consult with qualified legal counsel for specific compliance questions.