United States of America: Opened consultation on regulations implementing Florida Digital Bill of Rights (rule 2-3.001/ 2-3.002/2-3.004) including data protection regulation

On 12 April 2024, the Attorney General published the regulations implementing the Florida Digital Bill of Rights (rule 2-3.001/ 2-3.002/ 2-3.003/2-3.004) and opened a public consultation until 3 May 2024. The regulations implement Section 501.72(5) of the Florida Statutes, which were amended by the Florida Digital Bill of Rights (SB 262). The regulations include definitions for authorised persons and authorised users. Under the Regulations, an authorised person is a consumer whose data is processed or sold by a processor or controller. An authorised user is an affiliate, controller, processor, employee, or contractor who is authorised to access any personal data. Controllers must protect the confidentiality, integrity and accessibility of personal data they administer while maintaining a data security practice that is in line with the management framework and standards adopted by the National Institute of Standards and Technology (NIST). Allegations can be addressed to the department by consumers and authorised persons wishing to exercise their rights.