Page 237 - GDPR and US States General Privacy Laws Deskbook

Section 4. Section 501.701, Florida Statutes, is created to read:
501.701 Short title.
This part may be cited as the “Florida Digital Bill of Rights.”
Section 5. Section 501.702, Florida Statutes, is created to read:
501.702 Definitions.
As used in this part, the term:
(1)  “Affiliate” means a legal entity that controls, is controlled by, or is under common control with another legal entity
or that shares common branding with another legal entity. For purposes of this subsection, the term “control” or
“controlled” means any of the following:
(a)  The ownership of, or power to vote, more than 50 percent of the outstanding shares of any class of voting security
of a company.
(b)  The control in any manner over the election of a majority of the directors or of individuals exercising similar
functions.
(c)  The power to exercise controlling influence over the management of a company.
(2)  “Aggregate consumer information” means information that relates to a group or category of consumers, from which
the identity of an individual consumer has been removed and is not reasonably capable of being directly or indirectly
associated or linked with any consumer, household, or device. The term does not include information about a group or
category of consumers used to facilitate targeted advertising or the display of ads online. The term does not include
personal information that has been deidentified.
(3)  “Authenticate” or “authenticated” means to verify or the state of having been verified, respectively, through reasonable
means that the consumer who is entitled to exercise the consumer’s rights under s. 501.705 is the same consumer
exercising those consumer rights with respect to the personal data at issue.
(4)  “Biometric data” means data generated by automatic measurements of an individual’s biological characteristics. The
term includes fingerprints, voiceprints, eye retinas or irises, or other unique biological patterns or characteristics used
to identify a specific individual. The term does not include physical or digital photographs, video or audio recordings
or data generated from video or audio recordings, or information collected, used, or stored for health care treatment,
payment, or operations under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et
seq.
(5)  “Business associate” has the same meaning as in 45 C.C.R. s. 160.103 and the Health Insurance Portability and
Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq.
(6) “Child” means an individual younger than 18 years of age.
(7)  “Consent,” when referring to a consumer, means a clear affirmative act signifying a consumer’s freely given, specific,
informed, and unambiguous agreement to process personal data relating to the consumer. The term includes a written
statement, including a statement written by electronic means, or any other unambiguous affirmative act. The term
does not include any of the following:
(a)  Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data
processing along with other, unrelated information.
(b)  Hovering over, muting, pausing, or closing a given piece of content.
(c)  Agreement obtained through the use of dark patterns.
237 | Florida Technology Transparency