(1) Except as otherwise provided by this part, a controller shall comply with a request submitted by a consumer to exercise the consumer’s rights pursuant to s. 501.705, as provided in this section.
(2) A controller shall respond to the consumer request without undue delay, which may not be later than 45 days after the date of receipt of the request. The controller may extend the response period once by an additional 15 days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of the extension within the initial 45-day response period, together with the reason for the extension.
(3) If a controller cannot take action regarding the consumer’s request, the controller must inform the consumer without undue delay, which may not be later than 45 days after the date of receipt of the request, of the justification for the inability to take action on the request and provide instructions on how to appeal the decision in accordance with s. 501.707. A controller is not required to comply with a consumer request submitted under s. 501.705 if the controller cannot authenticate the request. However, the controller must make a reasonable effort to request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer’s request. If a controller maintains a self-service mechanism to allow a consumer to correct certain personal data, the controller may deny the consumer’s request and require the consumer to correct his or her own personal data through such mechanism.
(4) A controller must provide the consumer with notice within 60 days after the request is received that the controller has complied with the consumer’s request as required in this section.
(5) A controller shall provide information or take action in response to a consumer request free of charge, at least twice annually per consumer. If a request from a consumer is manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or may decline to act on the request. The controller bears the burden of demonstrating for purposes of this subsection that a request is manifestly unfounded, excessive, or repetitive.
(6) A controller who has obtained personal data about a consumer from a source other than the consumer is considered in compliance with a consumer’s request to delete that personal data pursuant to s. 501.705(2)(c), by doing any of the following:

(a) Deleting the personal data, retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring that the consumer’s personal data remains deleted from the business’s records, and not using the retained data for any other purpose under this part.

Terms Used In Florida Statutes 501.706

  • Appeal: A request made after a trial, asking another court (usually the court of appeals) to decide whether the trial was conducted properly. To make such a request is "to appeal" or "to take an appeal." One who appeals is called the appellant.
  • Consumer: means an individual who is a resident of or is domiciled in this state acting only in an individual or household context. See Florida Statutes 501.702
  • Controller: means :
    (a) A sole proprietorship, partnership, limited liability company, corporation, association, or legal entity that meets the following requirements:
    1. See Florida Statutes 501.702
  • Personal data: means any information, including sensitive data, which is linked or reasonably linkable to an identified or identifiable individual. See Florida Statutes 501.702
  • processing: means an operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. See Florida Statutes 501.702
(b) Opting the consumer out of the processing of that personal data for any purpose other than a purpose exempt under this part.
  Previous section
Next section  
 Part V Contents