(1) A violation of this part is an unfair and deceptive trade practice actionable under part II of this chapter solely by the Department of Legal Affairs. If the department has reason to believe that a person is in violation of this section, the department may, as the enforcing authority, bring an action against such person for an unfair or deceptive act or practice. For the purpose of bringing an action pursuant to this section, ss. 501.211 and 501.212 do not apply. In addition to other remedies under part II of this chapter, the department may collect a civil penalty of up to $50,000 per violation. Civil penalties may be tripled for any of the following violations:

(a) A violation involving a Florida consumer who is a known child. A controller that willfully disregards the consumer’s age is deemed to have actual knowledge of the consumer’s age.

Terms Used In Florida Statutes 501.72

  • authenticated: means to verify or the state of having been verified, respectively, through reasonable means that the consumer who is entitled to exercise the consumer's rights under…. See Florida Statutes 501.702
  • Child: means an individual younger than 18 years of age. See Florida Statutes 501.702
  • Consumer: means an individual who is a resident of or is domiciled in this state acting only in an individual or household context. See Florida Statutes 501.702
  • Contract: A legal written agreement that becomes binding when signed.
  • Controller: means :
    (a) A sole proprietorship, partnership, limited liability company, corporation, association, or legal entity that meets the following requirements:
    1. See Florida Statutes 501.702
  • Department: means the Department of Legal Affairs. See Florida Statutes 501.203
  • Enforcing authority: means the office of the state attorney if a violation of this part occurs in or affects the judicial circuit under the office's jurisdiction. See Florida Statutes 501.203
  • Jurisdiction: (1) The legal authority of a court to hear and decide a case. Concurrent jurisdiction exists when two courts have simultaneous responsibility for the same case. (2) The geographic area over which the court has authority to decide cases.
  • Litigation: A case, controversy, or lawsuit. Participants (plaintiffs and defendants) in lawsuits are called litigants.
  • person: includes individuals, children, firms, associations, joint adventures, partnerships, estates, trusts, business trusts, syndicates, fiduciaries, corporations, and all other groups or combinations. See Florida Statutes 1.01
  • Personal data: means any information, including sensitive data, which is linked or reasonably linkable to an identified or identifiable individual. See Florida Statutes 501.702
  • Tort: A civil wrong or breach of a duty to another person, as outlined by law. A very common tort is negligent operation of a motor vehicle that results in property damage and personal injury in an automobile accident.
  • Violation of this part: means any violation of this act or the rules adopted under this act and may be based upon any of the following as of July 1, 2017:
    (a) Any rules promulgated pursuant to the Federal Trade Commission Act, 15 U. See Florida Statutes 501.203
  • writing: includes handwriting, printing, typewriting, and all other methods and means of forming letters and characters upon paper, stone, wood, or other materials. See Florida Statutes 1.01
(b) Failure to delete or correct the consumer’s personal data pursuant to this section after receiving an authenticated consumer request or directions from a controller to delete or correct such personal data, unless an exception to the requirements to delete or correct such personal data under this section applies.
(c) Continuing to sell or share the consumer’s personal data after the consumer chooses to opt out under this part.
(2) After the department has notified a person in writing of an alleged violation, the department may grant a 45-day period to cure the alleged violation and issue a letter of guidance. The 45-day cure period does not apply to an alleged violation of paragraph (1)(a). The department may consider the number and frequency of violations, the substantial likelihood of injury to the public, and the safety of persons or property in determining whether to grant 45 calendar days to cure and the issuance of a letter of guidance. If the alleged violation is cured to the satisfaction of the department and proof of such cure is provided to the department, the department may not bring an action for the alleged violation but, in its discretion, may issue a letter of guidance that indicates that the person will not be offered a 45-day cure period for any future violations. If the person fails to cure the alleged violation within 45 calendar days, the department may bring an action against such person for the alleged violation.
(3) Any action brought by the department may be brought only on behalf of a Florida consumer.
(4) By February 1 of each year, the department shall make a report publicly available on the department’s website describing any actions taken by the department to enforce this section. The report must include statistics and relevant information detailing all of the following:

(a) The number of complaints received and the categories or types of violations alleged by the complainant.
(b) The number and type of enforcement actions taken and the outcomes of such actions, including the amount of penalties issued and collected.
(c) The number of complaints resolved without the need for litigation.
(d) For the report due February 1, 2024, the status of the development and implementation of rules to implement this section.
(5) The department shall adopt rules to implement this section, including standards for authenticated consumer requests, enforcement, data security, and authorized persons who may act on a consumer’s behalf.
(6) The department may collaborate and cooperate with other enforcement authorities of the Federal Government or other state governments concerning consumer data privacy issues and consumer data privacy investigations if such enforcement authorities have restrictions governing confidentiality at least as stringent as the restrictions provided in this section.
(7) Liability for a tort, contract claim, or consumer protection claim unrelated to an action brought under this section does not arise solely from the failure of a person to comply with this part.
(8) This part does not establish a private cause of action.
(9) The department may employ or use the legal services of outside counsel and the investigative services of outside personnel to fulfill the obligations of this section.
(10) For purposes of bringing an action pursuant to this section, any person who meets the definition of controller as defined in this part who collects, shares, or sells the personal data of Florida consumers is considered to be engaged in both substantial and not isolated activities within this state and operating, conducting, engaging in, or carrying on a business, and doing business in this state, and is, therefore, subject to the jurisdiction of the courts of this state.
  Previous section
Next section  
 Part V Contents