Florida Jurisdiction: Sale of Personal Data Criterion in the Florida Digital Bill of Rights

The Florida Digital Bill of Rights employs the sale of personal data criterion to determine its applicability. Specifically, the law applies to entities that "engage in the sale of personal data," thereby extending its scope to businesses that monetize personal information.

Text of Relevant Provisions

FDPA Sec.501.703(1):

"(1) This part applies only to a person who: (a) Conducts business in this state or produces a product or service used by residents of this state; and (b) Processes or engages in the sale of personal data."

Analysis of Provisions

• Applicability Criteria: FDPA Sec.501.703(1) sets forth two cumulative conditions for the law's applicability:
  1. Geographical/Business Presence: The entity must "conduct business in this state" or "produce a product or service used by residents of this state." This ensures that the law targets entities with a nexus to Florida.
  2. Data Activities: The entity must either "process" personal data or "engage in the sale of personal data." The inclusion of "engages in the sale of personal data" explicitly brings entities that monetize personal information within the ambit of the law.
• "Engages in the Sale of Personal Data": The phrase underscores that any entity involved in selling personal data, irrespective of other processing activities, falls under the law's jurisdiction. This captures businesses whose primary or ancillary operations include the commercialization of personal information.
• Absence of Definition: The provision does not provide a specific definition of what constitutes a "sale" of personal data. Without further elaboration in the provided sections, the term's interpretation may rely on its ordinary meaning or other parts of the act not provided here.
• Combined Criteria: Both conditions (a) and (b) must be met for the law to apply. Therefore, an entity that sells personal data but neither conducts business in Florida nor offers products or services used by Florida residents would not fall under this law.

Implications

• For Businesses Selling Personal Data: Entities that sell personal data and have a business presence or market products/services used in Florida are subject to the Florida Digital Bill of Rights. They must comply with the law's provisions regarding data processing and protection.
• Due Diligence: Companies must assess whether their data monetization practices involve the sale of personal data as understood under this law. Given the absence of a detailed definition, businesses should err on the side of caution.
• Operational Scope: Businesses without a physical presence in Florida but whose products or services are used by Florida residents must evaluate their data practices, especially if they engage in selling personal data.
• Exemptions and Clarifications: While this provision establishes the sale criterion for applicability, entities should review other sections of the law (not provided here) for potential definitions, exemptions, or further obligations related to the sale of personal data.