Florida Senate - 2023 SB 262 By Senator Bradley 6-01845D-23 2023262__ Page 1 of 35 CODING: Words stricken are deletions; words underlined are additions. A bill to be entitled 1

An act relating to technology transparency; creating 2 s. 112.23, F.S.; defining terms; prohibiting officers 3 or salaried employees of governmental entities from 4 using their positions or state resources to make 5 certain requests of social media platforms; 6 prohibiting governmental entities from initiating or 7 maintaining agreements or working relationships with 8 social media platforms under a specified circumstance; 9 providing exceptions; creating s. 501.173, F.S.; 10 providing applicability; defining terms; prohibiting a 11 controller from collecting certain consumer 12 information without the consumer’s authorization; 13 requiring controllers that collect a consumer’s 14 personal information to disclose certain information 15 regarding data collection and selling practices to the 16 consumer at or before the point of collection; 17 specifying that such information may be provided 18 through a general privacy policy or through a notice 19 informing the consumer that additional specific 20 information will be provided upon a certain request; 21 prohibiting controllers from collecting additional 22 categories of personal information or using personal 23 information for additional purposes without notifying 24 the consumer; requiring controllers that collect 25 personal information to implement reasonable security 26 procedures and practices to protect such information; 27 authorizing consumers to request controllers to 28 disclose the specific personal information the 29

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 2 of 35 CODING: Words stricken are deletions; words underlined are additions. controller has collected about the consumer; requiring 30 controllers to make available two or more methods for 31 consumers to request their personal information; 32 requiring controllers to provide such information free 33 of charge within a certain timeframe and in a certain 34 format upon receiving a verifiable consumer request; 35 specifying requirements for third parties with respect 36 to consumer information acquired or used; providing 37 construction; authorizing consumers to request 38 controllers to delete or correct personal information 39 collected by the controllers; providing exceptions; 40 specifying requirements for controllers to comply with 41 deletion or correction requests; authorizing consumers 42 to opt out of third-party disclosure of personal 43 information collected by a controller; prohibiting 44 controllers from selling or disclosing the personal 45 information of consumers younger than a certain age, 46 except under certain circumstances; prohibiting 47 controllers from selling or sharing a consumer’s 48 information if the consumer has opted out of such 49 disclosure; prohibiting controllers from taking 50 certain actions to retaliate against consumers who 51 exercise certain rights; providing applicability; 52 providing that a contract or agreement that waives or 53 limits certain consumer rights is void and 54 unenforceable; authorizing the Department of Legal 55 Affairs to bring an action under the Florida Deceptive 56 and Unfair Trade Practices Act and to adopt rules; 57 requiring the department to submit an annual report to 58

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 3 of 35 CODING: Words stricken are deletions; words underlined are additions. the Legislature; providing report requirements; 59 providing that controllers must have a specified 60 timeframe to cure any violations; providing 61 jurisdiction; declaring that the act is a matter of 62 statewide concern; preempting the collection, 63 processing, sharing, and sale of consumer personal 64 information to the state; amending s. 501.171, F.S.; 65 revising the definition of “personal information”; 66 amending s. 16.53, F.S.; requiring that certain 67 attorney fees, costs, and penalties recovered by the 68 Attorney General be deposited in the Legal Affairs 69 Revolving Trust Fund; providing an effective date. 70 71 Be It Enacted by the Legislature of the State of Florida: 72 73

Section

Section 112.23, Florida Statutes, is created to 74 read: 75 112.23 Government-directed content moderation of social 76 media platforms prohibited.— 77

(1) As used in this section, the term: 78 (a) “Social media platform” means a form of electronic 79 communication through which users create online communities to 80 share information, ideas, personal messages, and other content. 81 (b) “Governmental entity” means any state, county, 82 district, authority, or municipal officer, department, division, 83 board, bureau, commission, or other separate unit of government 84 created or established by law, including, but not limited to, 85 the Commission on Ethics, the Public Service Commission, the 86 Office of Public Counsel, and any other public or private 87

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 4 of 35 CODING: Words stricken are deletions; words underlined are additions. agency, person, partnership, corporation, or business entity 88 acting on behalf of any public agency. 89

(2) An officer or a salaried employee of a governmental 90 entity may not use his or her position or any state resources to 91 communicate with a social media platform to request that it 92 remove content or accounts from the social media platform. 93

(3) A governmental entity, or an officer or a salaried 94 employee acting on behalf of a governmental entity, may not 95 initiate or maintain any agreements or working relationships 96 with a social media platform for the purpose of content 97 moderation. 98 (4) Subsections (2) and (3) do not apply if the 99 governmental entity or an officer or a salaried employee acting 100 on behalf of a governmental entity is acting as part of any of 101 the following: 102 (

a) Routine account management of the governmental entity’s 103 account. 104 (

b) An attempt to remove content or an account that 105 pertains to the commission of a crime or violation of this 106 state’s public records law. 107 (

c) An investigation or inquiry related to public safety. 108

Section

Section 501.173, Florida Statutes, is created to 109 read: 110 501.173 Consumer data privacy.— 111

(1) APPLICABILITY.—This

section does not apply to: 112 (

a) Personal information collected and transmitted which is 113 necessary for the sole purpose of sharing such personal 114 information with a financial service provider solely to 115 facilitate short term, transactional payment processing for the 116

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 5 of 35 CODING: Words stricken are deletions; words underlined are additions. purchase of products or services. 117 (

b) Personal information collected, used, retained, sold, 118 shared, or disclosed as deidentified personal information or 119 aggregate consumer information. 120 (

c) Compliance with federal, state, or local laws. 121 (

d) Compliance with a civil, criminal, or regulatory 122 inquiry, investigation, subpoena, or summons by federal, state, 123 or local authorities. 124 (

e) Cooperation with law enforcement agencies concerning 125 conduct or activity that the controller, processor, or third 126 party reasonably and in good faith believes may violate federal, 127 state, or local law. 128 (

f) Exercising or defending legal rights, claims, or 129 privileges. 130 (

g) Personal information collected through the controller’s 131 direct interactions with the consumer, if collected in 132 accordance with this section, which is used by the controller or 133 the processor that the controller directly contracts with for 134 advertising or marketing services to advertise or market 135 products or services that are produced or offered directly by 136 the controller. Such information may not be sold, shared, or 137 disclosed unless otherwise authorized under this section. 138 (

h) Personal information of a person acting in the role of 139 a job applicant, employee, owner, director, officer, contractor, 140 volunteer, or intern of a controller which is collected by a 141 controller, to the extent the personal information is collected 142 and used solely within the context of the person’s role or 143 former role with the controller. For purposes of this paragraph, 144 personal information includes employee benefit information. 145

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 6 of 35 CODING: Words stricken are deletions; words underlined are additions. (

i) Protected health information for purposes of the 146 federal Health Insurance Portability and Accountability Act of 147 1996 and related regulations, and patient identifying 148 information for purposes of 42 C.F.R.

part 2, established 149 pursuant to 42 U.S.C. s. 290dd-2. 150 (

j) An entity or business associate governed by the 151 privacy, security, and breach notification rules issued by the 152 United States Department of Health and Human Services in 45 153 C.F.R. parts 160 and 164, or a program or a qualified service 154 program as defined in 42 C.F.R.

part 2, to the extent the 155 entity, business associate, or program maintains personal 156 information in the same manner as medical information or 157 protected health information as described in paragraph (i), and 158 as long as the entity, business associate, or program does not 159 use personal information for targeted advertising with third 160 parties and does not sell or share personal information to a 161 third party unless such sale or sharing is covered by an 162 exception under this section. 163 (

k) Identifiable private information collected for purposes 164 of research as defined in 45 C.F.R. s. 164.501 conducted in 165 accordance with the Federal Policy for the Protection of Human 166 Subjects for purposes of 45 C.F.R.

part 46, the good clinical 167 practice guidelines issued by the International Council for 168 Harmonisation of Technical Requirements for Pharmaceuticals for 169 Human Use, or the Federal Policy for the Protection for Human 170 Subjects for purposes of 21 C.F.R. parts 50 and 56, or personal 171 information used or shared in research conducted in accordance 172 with one or more of these standards. 173 (

l) Information and documents created for purposes of the 174

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 7 of 35 CODING: Words stricken are deletions; words underlined are additions. federal Health Care Quality Improvement Act of 1986 and related 175 regulations, or patient safety work product for purposes of 42 176 C.F.R.

part 3, established pursuant to 42 U.S.C. s. 299b-21 177 through 299b-26. 178 (

m) Information that is deidentified in accordance with 45 179 C.F.R.

part 164 and derived from individually identifiable 180 health information as described in the Health Insurance 181 Portability and Accountability Act of 1996, or identifiable 182 personal information, consistent with the Federal Policy for the 183 Protection of Human Subjects or the human subject protection 184 requirements of the United States Food and Drug Administration. 185 (

n) Information used only for public health activities and 186 purposes as described in 45 C.F.R. s. 164.512. 187 (

o) Personal information collected, processed, sold, or 188 disclosed pursuant to the federal Fair Credit Reporting Act, 15 189 U.S.C. s. 1681 and implementing regulations. 190 (

p) Nonpublic personal information collected, processed, 191 sold, or disclosed pursuant to the Gramm-Leach-Bliley Act, 15 192 U.S.C. s. 6801 et seq., and implementing regulations. 193 (

q) A financial institution as defined in the Gramm-Leach-194 Bliley Act, 15 U.S.C. s. 6801 et seq., to the extent the 195 financial institution maintains personal information in the same 196 manner as nonpublic personal information as described in 197 paragraph (p), and as long as such financial institution does 198 not use personal information for targeted advertising with third 199 parties and does not sell or share personal information to a 200 third party unless such sale or sharing is covered by an 201 exception under this section. 202 (

r) Personal information collected, processed, sold, or 203

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 8 of 35 CODING: Words stricken are deletions; words underlined are additions. disclosed pursuant to the federal Driver’s Privacy Protection 204 Act of 1994, 18 U.S.C. s. 2721 et seq. 205 (

s) Education information covered by the Family Educational 206 Rights and Privacy Act, 20 U.S.C. s. 1232(

g) and 34 C.F.R.

part 207 99. 208 (

t) Information collected as part of public or peer-209 reviewed scientific or statistical research in the public 210 interest and which adheres to all other applicable ethics and 211 privacy laws, if the consumer has provided informed consent. 212 Research with personal information must be subjected by the 213 controller conducting the research to additional security 214 controls that limit access to the research data to only those 215 individuals necessary to carry out the research purpose, and 216 such personal information must be subsequently deidentified. 217 (

u) Personal information disclosed for the purpose of 218 responding to an alert of a present risk of harm to a person or 219 property or prosecuting those responsible for that activity. 220 (

v) Personal information disclosed when a consumer uses or 221 directs a controller to intentionally disclose information to a 222 third party or uses the controller to intentionally interact 223 with a third party. An intentional interaction occurs when the 224 consumer intends to interact with the third party, by one or 225 more deliberate interactions. Hovering over, muting, pausing, or 226 closing a given piece of content does not constitute a 227 consumer’s intent to interact with a third party. 228 (

w) An identifier used for a consumer who has opted out of 229 the sale or sharing of the consumer’s personal information for 230 the sole purpose of alerting processors and third parties that 231 the consumer has opted out of the sale or sharing of the 232

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 9 of 35 CODING: Words stricken are deletions; words underlined are additions. consumer’s personal information. 233 (

x) Personal information transferred by a controller to a 234 third party as an asset that is part of a merger, acquisition, 235 bankruptcy, or other transaction in which the third party 236 assumes control of all or part of the controller, provided that 237 the information is used or shared consistently with this 238 section.

If a third party materially alters how it uses or 239 shares the personal information of a consumer in a manner that 240 is materially inconsistent with the commitments or promises made 241 at the time of collection, it must provide prior notice of the 242 new or changed practice to the consumer. The notice must be 243 sufficiently prominent and robust to ensure that consumers can 244 easily exercise choices consistent with this section. 245 (

y) Personal information necessary to fulfill the terms of 246 a written warranty when such warranty was purchased by the 247 consumer or the product that is warranted was purchased by the 248 consumer. Such information may not be sold or shared unless 249 otherwise authorized under this section. 250 (

z) Personal information necessary for a product recall for 251 a product purchased or owned by the consumer conducted in 252 accordance with federal law. Such information may not be sold or 253 shared unless otherwise authorized under this section. 254 (aa) Personal information processed solely for the purpose 255 of independently measuring or reporting advertising or content 256 performance, reach, or frequency pursuant to a contract with a 257 controller that collected personal information in accordance 258 with this section. Such information may not be sold or shared 259 unless otherwise authorized under this section. 260 (bb) Personal information shared between a manufacturer of 261

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 10 of 35 CODING: Words stricken are deletions; words underlined are additions. a tangible product and authorized third-party distributors or 262 vendors of the product, as long as such personal information is 263 used solely for advertising, marketing, or servicing the product 264 that is acquired directly through such manufacturer and such 265 authorized third-party distributors or vendors. Such personal 266 information may not be sold or shared unless otherwise 267 authorized under this section. 268

(2) DEFINITIONS.—As used in this section, the term: 269 (a) “Aggregate consumer information” means information that 270 relates to a group or category of consumers, from which the 271 identity of an individual consumer has been removed and is not 272 reasonably capable of being directly or indirectly associated or 273 linked with any consumer, household, or device. The term does 274 not include information about a group or category of consumers 275 used to facilitate targeted advertising or the display of ads 276 online.

The term does not include personal information that has 277 been deidentified. 278 (b) “Biometric information” means an individual’s 279 physiological, biological, or behavioral characteristics that 280 can be used, singly or in combination with each other or with 281 other identifying data, to establish individual identity.

The 282 term includes, but is not limited to, imagery of the iris, 283 retina, fingerprint, face, hand, palm, vein patterns, and voice 284 recordings, from which an identifier template, such as a 285 faceprint, a minutiae template, or a voiceprint, can be 286 extracted, and keystroke patterns or rhythms, gait patterns or 287 rhythms, and sleep, health, or exercise data that contain 288 identifying information. 289 (c) “Collect” means to buy, rent, gather, obtain, receive, 290

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 11 of 35 CODING: Words stricken are deletions; words underlined are additions. or access any personal information pertaining to a consumer by 291 any means. The term includes, but is not limited to, actively or 292 passively receiving information from the consumer or by 293 observing the consumer’s behavior or actions. 294 (d) “Consumer” means a natural person who resides in or is 295 domiciled in this state, however identified, including by any 296 unique identifier, who is acting in a personal capacity or 297 household context.

The term does not include a natural person 298 acting on behalf of a legal entity in a commercial or employment 299 context. 300 (e) “Controller” means: 301 1. A sole proprietorship, partnership, limited liability 302 company, corporation, association, or legal entity that meets 303 the following requirements: 304 a. Is organized or operated for the profit or financial 305 benefit of its shareholders or owners; 306 b. Does business in this state; 307 c. Collects personal information about consumers, or is the 308 entity on behalf of which such information is collected; 309 d.

Determines the purposes and means of processing personal 310 information about consumers alone or jointly with others; 311 e. Makes in excess of $1 billion in gross revenues, as 312 adjusted in January of every odd-numbered year to reflect any 313 increase in the Consumer Price Index; and 314 f. Satisfies one of the following: 315 (

I) Derives 50 percent or more of its global annual 316 revenues from providing targeted advertising or the sale of ads 317 online; or 318 (II) Operates a consumer smart speaker and voice command 319

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 12 of 35 CODING: Words stricken are deletions; words underlined are additions. component service with an integrated virtual assistant connected 320 to a cloud computing service that uses hands-free verbal 321 activation. For purposes of this sub-sub-subparagraph, a 322 consumer smart speaker and voice command component service does 323 not include a motor vehicle or speaker or device associated with 324 or connected to a vehicle. 325 2. Any entity that controls or is controlled by a 326 controller.

As used in this subparagraph, the term “control” 327 means: 328 a. Ownership of, or the power to vote, more than 50 percent 329 of the outstanding shares of any class of voting security of a 330 controller; 331 b. Control in any manner over the election of a majority of 332 the directors, or of individuals exercising similar functions; 333 or 334 c.

The power to exercise a controlling influence over the 335 management of a company. 336 (f) “Deidentified” means information that cannot reasonably 337 be used to infer information about or otherwise be linked to a 338 particular consumer, provided that the controller that possesses 339 the information: 340 1. Takes reasonable measures to ensure that the information 341 cannot be associated with a specific consumer; 342 2.

Maintains and uses the information in deidentified form 343 and does not attempt to reidentify the information, except that 344 the controller may attempt to reidentify the information solely 345 for the purpose of determining whether its deidentification 346 processes satisfy the requirements of this paragraph; 347 3. Contractually obligates any recipients of the 348

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 13 of 35 CODING: Words stricken are deletions; words underlined are additions. information to comply with all this paragraph to avoid 349 reidentifying such information; and 350 4.

Implements business processes to prevent the inadvertent 351 release of deidentified information. 352 (g) “Department” means the Department of Legal Affairs. 353 (h) “Device” means a physical object associated with a 354 consumer or household capable of directly or indirectly 355 connecting to the Internet. 356 (i) “Genetic information” means information about an 357 individual’s deoxyribonucleic acid (DNA). 358 (j) “Homepage” means the introductory page of an Internet 359 website and any Internet webpage where personal information is 360 collected.

In the case of a mobile application, the homepage is 361 the application’s platform page or download page, a link within 362 the application, such as the “About” or “Information” 363 application configurations, or the settings page, and any other 364 location that allows consumers to review the notice required by 365 subsection (7), including, but not limited to, before 366 downloading the application. 367 (k) “Household” means a natural person or a group of people 368 in this state who reside at the same address, share a common 369 device or the same service provided by a controller, and are 370 identified by a controller as sharing the same group account or 371 unique identifier. 372 (l) “Personal information” means information that is linked 373 or reasonably linkable to an identified or identifiable consumer 374 or household, including biometric information, genetic 375 information, and unique identifiers to the consumer. 376 1.

The term includes, but is not limited to, the following: 377

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 14 of 35 CODING: Words stricken are deletions; words underlined are additions. a. Identifiers such as a real name, alias, postal address, 378 unique identifier, online identifier, internet protocol address, 379 email address, account name, social security number, driver 380 license number, passport number, or other similar identifiers. 381 b.

Information that identifies, relates to, or describes, 382 or could be associated with, a particular individual, including, 383 but not limited to, a name, signature, social security number, 384 physical characteristics or description, address, location, 385 telephone number, passport number, driver license or state 386 identification card number, insurance policy number, education, 387 employment, employment history, bank account number, credit card 388 number, debit card number, or any other financial information, 389 medical information, or health insurance information. 390 c.

Characteristics of protected classifications under state 391 or federal law. 392 d. Commercial information, including records of personal 393 property, products or services purchased, obtained, or 394 considered, or other purchasing or consuming histories or 395 tendencies. 396 e. Biometric information. 397 f. Internet or other electronic network activity 398 information, including, but not limited to, browsing history, 399 search history, and information regarding a consumer’s 400 interaction with an Internet website, application, or 401 advertisement. 402 g. Geolocation data. 403 h.

Audio, electronic, visual, thermal, olfactory, or 404 similar information. 405 i. Inferences drawn from any of the information identified 406

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 15 of 35 CODING: Words stricken are deletions; words underlined are additions. in this paragraph to create a profile about a consumer 407 reflecting the consumer’s preferences, characteristics, 408 psychological trends, predispositions, behavior, attitudes, 409 intelligence, abilities, and aptitudes. 410 2. The term does not include consumer information that is: 411 a.

Consumer employment contact information, including a 412 position name or title, employment qualifications, emergency 413 contact information, business telephone number, business 414 electronic mail address, employee benefit information, and 415 similar information used solely in an employment context. 416 b. Deidentified or aggregate consumer information. 417 c. Publicly and lawfully available information reasonably 418 believed to be made available to the general public in a lawful 419 manner and without legal restrictions: 420 (

I) From federal, state, or local government records. 421 (II) By a widely distributed media source. 422 (III) By the consumer or by someone to whom the consumer 423 disclosed the information unless the consumer has purposely and 424 effectively restricted the information to a certain audience on 425 a private account. 426 (m) “Precise geolocation data” means information from 427 technology, such as global positioning system level latitude and 428 longitude coordinates or other mechanisms, which directly 429 identifies the specific location of a natural person with 430 precision and accuracy within a radius of 1,750 feet.

The term 431 does not include information generated by the transmission of 432 communications or any information generated by or connected to 433 advance utility metering infrastructure systems or equipment for 434 use by a utility. 435

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 16 of 35 CODING: Words stricken are deletions; words underlined are additions. (n) “Processing” means any operation or set of operations 436 performed on personal information or on sets of personal 437 information, regardless of whether by automated means. 438 (o) “Processor” means a sole proprietorship, partnership, 439 limited liability company, corporation, association, or other 440 legal entity that is organized or operated for the profit or 441 financial benefit of its shareholders or other owners, that 442 processes information on behalf of a controller and to which the 443 controller discloses a consumer’s personal information pursuant 444 to a written contract, provided that the contract prohibits the 445 entity receiving the information from retaining, using, or 446 disclosing the personal information for any purpose other than 447 for the specific purpose of performing the services specified in 448 the contract for the controller, as authorized by this section. 449 (p) “Sell” means to sell, rent, release, disclose, 450 disseminate, make available, transfer, or otherwise communicate 451 orally, in writing, or by electronic or other means, a 452 consumer’s personal information or information that relates to a 453 group or category of consumers by a controller to another 454 controller or a third party for monetary or other valuable 455 consideration. 456 (q) “Share” means to share, rent, release, disclose, 457 disseminate, make available, transfer, or access a consumer’s 458 personal information for advertising or marketing.

The term 459 includes: 460 1. Allowing a third party to advertise or market to a 461 consumer based on a consumer’s personal information without 462 disclosure of the personal information to the third party. 463 2. Monetary transactions, nonmonetary transactions, and 464

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 17 of 35 CODING: Words stricken are deletions; words underlined are additions. transactions for other valuable consideration between a 465 controller and a third party for advertising or marketing. 466 (r) “Targeted advertising” means marketing to a consumer or 467 displaying an advertisement to a consumer when the advertisement 468 is selected based on personal information used to predict such 469 consumer’s preferences or interests. 470 (s) “Third party” means a person who is not a controller or 471 a processor. 472 (t) “Unique identifier” means a persistent identifier that 473 can be used to recognize a consumer, a family, or a device that 474 is linked to a consumer or a family, over time and across 475 different services, including, but not limited to, a device 476 identifier; an Internet Protocol address; cookies, beacons, 477 pixel tags, mobile ad identifiers, or similar technology; a 478 customer number, unique pseudonym, or user alias; telephone 479 numbers, or other forms of persistent or probabilistic 480 identifiers that can be used to identify a particular consumer, 481 family, or device that is linked to a consumer or family.

As 482 used in this paragraph, the term “family” means a custodial 483 parent or guardian and any minor children of whom the parent or 484 guardian has custody, or a household as defined in paragraph 485 (k). 486 (u) “Verifiable consumer request” means a request made by a 487 consumer, by a parent or guardian on behalf of a consumer who is 488 a minor child, or by a person authorized by the consumer to act 489 on the consumer’s behalf, that the controller can reasonably 490 verify to be the consumer, pursuant to rules adopted by the 491 department.

A verifiable consumer request is presumed to have 492 been made when requested through an established account using 493

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 18 of 35 CODING: Words stricken are deletions; words underlined are additions. the controller’s established security features to access the 494 account through communication features offered to consumers, but 495 a controller may not require the consumer to create or have an 496 account with the controller in order to make a verifiable 497 consumer request. 498 (v) “Voice recognition feature” means the function of a 499 device which enables the collection, recording, storage, 500 analysis, transmission,

interpretation, or other use of spoken 501 words or other sounds. 502

(3) CONTROLLER REQUIREMENTS; CONSUMER DATA COLLECTION 503 REQUIREMENTS AND RESPONSIBILITIES.— 504 (

a) A controller may not collect, without the consumer’s 505 authorization, a consumer’s precise geolocation data or personal 506 information through the operation of a voice recognition 507 feature. 508 (

b) A controller that operates a search engine shall 509 provide a consumer with information of how the controller’s 510 search engine algorithm prioritizes or deprioritizes political 511 partisanship or political ideology in its search results. 512 (

c) A controller that collects personal information about 513 consumers shall maintain an up-to-date online privacy policy and 514 make such policy available on its homepage. The online privacy 515 policy must include the following information: 516 1. Any Florida-specific consumer privacy rights. 517 2. A list of the types and categories of personal 518 information that the controller collects, sells, or shares, or 519 has collected, sold, or shared, about consumers. 520 3. The consumer’s right to request deletion or correction 521 of certain personal information. 522

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 19 of 35 CODING: Words stricken are deletions; words underlined are additions. 4. The consumer’s right to opt out of the sale or sharing 523 to third parties. 524 (

d) A controller that collects personal information from 525 the consumer shall, at or before the point of collection, 526 inform, or direct the processor to inform, consumers of the 527 categories of personal information to be collected and the 528 purposes for which such categories of personal information will 529 be used. 530 (

e) A controller may not collect additional categories of 531 personal information or use personal information collected for 532 additional purposes without providing the consumer with notice 533 consistent with this section. 534 (

f) A controller that collects a consumer’s personal 535 information shall implement and maintain reasonable security 536 procedures and practices appropriate to the nature of the 537 personal information to protect such personal information from 538 unauthorized or illegal access, destruction, use, modification, 539 or disclosure. A controller shall require any processors to 540 implement and maintain the same or similar security procedures 541 and practices for personal information. 542 (

g) A controller shall adopt and implement a retention 543

schedule that prohibits the use or retention of personal 544 information not subject to an exemption by the controller or 545 processor after the satisfaction of the initial purpose for 546 which such information was collected or obtained, after the 547 expiration or termination of the contract pursuant to which the 548 information was collected or obtained, or 2 years after the 549 consumer’s last interaction with the controller. This paragraph 550 does not apply to personal information reasonably used or 551

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 20 of 35 CODING: Words stricken are deletions; words underlined are additions. retained to do any of the following: 552 1. Fulfill the terms of a written warranty or product 553 recall conducted in accordance with federal law. 554 2. Provide a good or service requested by the consumer, or 555 reasonably anticipate the request of such good or service within 556 the context of a controller’s ongoing business relationship with 557 the consumer. 558 3.

Detect security threats or incidents; protect against 559 malicious, deceptive, fraudulent, unauthorized, or illegal 560 activity or access; or prosecute those responsible for such 561 activity or access. 562 4. Debug to identify and repair errors that impair existing 563 intended functionality. 564 5.

Engage in public or peer-reviewed scientific, 565 historical, or statistical research in the public interest which 566 adheres to all other applicable ethics and privacy laws when the 567 controller’s deletion of the information is likely to render 568 impossible or seriously impair the achievement of such research, 569 if the consumer has provided informed consent. 570 6.

Enable solely internal uses that are reasonably aligned 571 with the expectations of the consumer based on the consumer’s 572 relationship with the controller or that are compatible with the 573 context in which the consumer provided the information. 574 7. Comply with a legal obligation, including any state or 575 federal retention laws. 576 8. Protect the controller’s interests against existing 577 disputes, legal action, or governmental investigations. 578 9. Assure the physical security of persons or property. 579

(4) CONSUMER RIGHT TO REQUEST COPY OF PERSONAL INFORMATION 580

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 21 of 35 CODING: Words stricken are deletions; words underlined are additions. COLLECTED, SOLD, OR SHARED.— 581 (

a) A consumer has the right to request that a controller 582 that collects, sells, or shares personal information about the 583 consumer disclose the following to the consumer: 584 1. The specific pieces of personal information which have 585 been collected about the consumer. 586 2. The categories of sources from which the consumer’s 587 personal information was collected. 588 3. The specific pieces of personal information about the 589 consumer which were sold or shared. 590 4. The third parties to which the personal information 591 about the consumer was sold or shared. 592 5. The categories of personal information about the 593 consumer which were disclosed to a processor. 594 (

b) A controller that collects, sells, or shares personal 595 information about a consumer shall disclose the information 596 specified in paragraph (

a) to the consumer upon receipt of a 597 verifiable consumer request. 598 (

c) This subsection does not require a controller to 599 retain, reidentify, or otherwise link any data that, in the 600 ordinary course of business is not maintained in a manner that 601 would be considered personal information. 602 (

d) The controller shall deliver to a consumer the 603 information required under this subsection or act on a request 604 made under this subsection by a consumer free of charge within 605 45 calendar days after receiving a verifiable consumer request. 606 The response period may be extended once by 45 additional 607 calendar days when reasonably necessary, provided the controller 608 informs the consumer of any such extension within the initial 609

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 22 of 35 CODING: Words stricken are deletions; words underlined are additions. 45-day response period and the reason for the extension. The 610 information must be delivered in a portable and, to the extent 611 technically feasible, readily usable format that allows the 612 consumer to transmit the data to another entity without 613 hindrance.

A controller may provide the data to the consumer in 614 a manner that does not disclose the controller’s trade secrets. 615 A controller is not obligated to provide information to the 616 consumer if the consumer or a person authorized to act on the 617 consumer’s behalf does not provide verification of identity or 618 verification of authorization to act with the permission of the 619 consumer. 620 (

e) A controller may provide personal information to a 621 consumer at any time, but is not required to provide personal 622 information to a consumer more than twice in a 12-month period. 623 (

f) This subsection does not apply to personal information 624 relating solely to households. 625

(5) RIGHT TO HAVE PERSONAL INFORMATION DELETED OR 626 CORRECTED.— 627 (

a) A consumer has the right to request that a controller 628 delete any personal information about the consumer or about the 629 consumer’s child younger than 18 years of age which the 630 controller has collected. 631 1. A controller that receives a verifiable consumer request 632 to delete the consumer’s personal information shall delete the 633 consumer’s personal information from its records and direct any 634 processors to delete such information within 90 calendar days 635 after receipt of the verifiable consumer request. 636 2. A controller or a processor acting pursuant to its 637 contract with the controller may not be required to comply with 638

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 23 of 35 CODING: Words stricken are deletions; words underlined are additions. a consumer’s request to delete the consumer’s personal 639 information if it is reasonably necessary for the controller or 640 processor to maintain the consumer’s personal information to do 641 any of the following: 642 a. Complete the transaction for which the personal 643 information was collected. 644 b. Fulfill the terms of a written warranty or product 645 recall conducted in accordance with federal law. 646 c.

Provide a good or service requested by the consumer, or 647 reasonably anticipate the request of such good or service within 648 the context of a controller’s ongoing business relationship with 649 the consumer, or otherwise perform a contract between the 650 controller and the consumer. 651 d. Detect security threats or incidents; protect against 652 malicious, deceptive, fraudulent, unauthorized, or illegal 653 activity or access; or prosecute those responsible for such 654 activity or access. 655 e. Debug to identify and repair errors that impair existing 656 intended functionality. 657 f.

Engage in public or peer-reviewed scientific, 658 historical, or statistical research in the public interest which 659 adheres to all other applicable ethics and privacy laws when the 660 controller’s deletion of the information is likely to render 661 impossible or seriously impair the achievement of such research, 662 if the consumer has provided informed consent. 663 g.

Enable solely internal uses that are reasonably aligned 664 with the expectations of the consumer based on the consumer’s 665 relationship with the controller or that are compatible with the 666 context in which the consumer provided the information. 667

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 24 of 35 CODING: Words stricken are deletions; words underlined are additions. h. Comply with a legal obligation, including any state or 668 federal retention laws. 669 i. Protect the controller’s interests against existing 670 disputes, legal action, or governmental investigations. 671 j. Assure the physical security of persons or property. 672 (

b) A consumer has the right to request that a controller 673 correct inaccurate personal information maintained by the 674 controller about the consumer or about the consumer’s child 675 younger than 18 years of age. A controller that receives a 676 verifiable consumer request to correct inaccurate personal 677 information shall use commercially reasonable efforts to correct 678 the inaccurate personal information as directed by the consumer 679 and shall direct any processors to correct such information 680 within 90 calendar days after receipt of the verifiable consumer 681 request.

If a controller maintains a self-service mechanism to 682 allow a consumer to correct certain personal information, the 683 controller may require the consumer to correct their own 684 personal information through such mechanism. A controller or a 685 processor acting pursuant to its contract with the controller 686 may not be required to comply with a consumer’s request to 687 correct the consumer’s personal information if it is reasonably 688 necessary for the controller or processor to maintain the 689 consumer’s personal information to do any of the following: 690 1.

Complete the transaction for which the personal 691 information was collected. 692 2. Fulfill the terms of a written warranty or product 693 recall conducted in accordance with federal law. 694 3. Detect security threats or incidents; protect against 695 malicious, deceptive, fraudulent, unauthorized, or illegal 696

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 25 of 35 CODING: Words stricken are deletions; words underlined are additions. activity or access; or prosecute those responsible for such 697 activity or access. 698 4. Debug to identify and repair errors that impair existing 699 intended functionality. 700 5. Enable solely internal uses that are reasonably aligned 701 with the expectations of the consumer based on the consumer’s 702 relationship with the controller or that are compatible with the 703 context in which the consumer provided the information. 704 6.

Comply with a legal obligation, including any state or 705 federal retention laws. 706 7. Protect the controller’s interests against existing 707 disputes, legal action, or governmental investigations. 708 8. Assure the physical security of persons or property. 709

(6) RIGHT TO OPT OUT OF THE SALE OR SHARING OF PERSONAL 710 INFORMATION.— 711 (

a) A consumer has the right at any time to direct a 712 controller not to sell or share the consumer’s personal 713 information to a third party. This right may be referred to as 714 the right to opt out. 715 (

b) Notwithstanding paragraph (a), a controller may not 716 sell or share the personal information of a minor consumer if 717 the controller has actual knowledge that the consumer is not 18 718 years of age or older. However, if a consumer who is between 13 719 and 18 years of age, or if the parent or guardian of a consumer 720 who is 12 years of age or younger, has affirmatively authorized 721 the sale or sharing of such consumer’s personal information, 722 then a controller may sell or share such information in 723 accordance with this section. A controller that willfully 724 disregards the consumer’s age is deemed to have actual knowledge 725

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 26 of 35 CODING: Words stricken are deletions; words underlined are additions. of the consumer’s age. A controller that complies with the 726 verifiable parental consent requirements of the Children’s 727 Online Privacy Protection Act, 15 U.S.C. s. 6501 et seq., shall 728 be deemed compliant with any obligation to obtain parental 729 consent. 730 (

c) A controller that has received direction from a 731 consumer opting out of the sale or sharing of the consumer’s 732 personal information is prohibited from selling or sharing the 733 consumer’s personal information beginning 4 calendar days after 734 receipt of such direction, unless the consumer subsequently 735 provides express authorization for the sale or sharing of the 736 consumer’s personal information. 737

(7) FORM TO OPT OUT OF SALE OR SHARING OF PERSONAL 738 INFORMATION.— 739 (

a) A controller shall: 740 1. In a form that is reasonably accessible to consumers, 741 provide a clear and conspicuous link on the controller’s 742 Internet homepage, entitled “Do Not Sell or Share My Personal 743 Information,” to an Internet webpage that enables a consumer, a 744 parent or guardian of a minor who is a consumer, or a person 745 authorized by the consumer, to opt out of the sale or sharing of 746 the consumer’s personal information. A controller may not 747 require a consumer to create an account in order to direct the 748 controller not to sell or share the consumer’s personal 749 information.

A controller may accept a request to opt out 750 received through a user-enabled global privacy control, such as 751 a browser plug-in or privacy setting, device setting, or other 752 mechanism, which communicates or signals the consumer’s choice 753 to opt out. 754

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 27 of 35 CODING: Words stricken are deletions; words underlined are additions. 2. For consumers who opted out of the sale or sharing of 755 their personal information, respect the consumer’s decision to 756 opt out for at least 12 months before requesting that the 757 consumer authorize the sale or sharing of the consumer’s 758 personal information. 759 3. Use any personal information collected from the consumer 760 in connection with the submission of the consumer’s opt-out 761 request solely for the purposes of complying with the opt-out 762 request. 763 (

b) A consumer may authorize another person to opt out of 764 the sale or sharing of the consumer’s personal information on 765 the consumer’s behalf pursuant to rules adopted by the 766 department. 767

(8) ACTIONS RELATED TO CONSUMERS WHO EXERCISE PRIVACY 768 RIGHTS.— 769 (

a) A controller may not deny goods or services to a 770 consumer because the consumer exercised any of the consumer’s 771 rights under this section. 772 (

b) A controller may charge a consumer who exercised any of 773 the consumer’s rights under this

section a different price or 774 rate, or provide a different level or quality of goods or 775 services to the consumer, only if that difference is reasonably 776 related to the value provided to the controller by the 777 consumer’s data or is related to a consumer’s voluntary 778 participation in a financial incentive program, including a bona 779 fide loyalty, rewards, premium features, discounts, or club card 780 program offered by the controller. 781 (

c) A controller may offer financial incentives, including 782 payments to consumers as compensation, for the collection, 783

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 28 of 35 CODING: Words stricken are deletions; words underlined are additions. sharing, sale, or deletion of personal information if the 784 consumer gives the controller prior consent that clearly 785 describes the material terms of the financial incentive program. 786 The consent may be revoked by the consumer at any time. 787 (

d) A controller may not use financial incentive practices 788 that are unjust, unreasonable, coercive, or usurious in nature. 789

(9) CONTRACTS AND ROLES.— 790 (

a) Any contract or agreement between a controller and a 791 processor must: 792 1. Prohibit the processor from selling, sharing, retaining, 793 using, or disclosing the personal information for any purpose 794 that violates this section; 795 2. Prohibit the processor from retaining, using, or 796 disclosing the personal information other than for the purposes 797 specified in the contract or agreement; 798 3.

Prohibit the processor from combining the personal 799 information that the processor receives from or on behalf of the 800 controller with personal information that the processor receives 801 from or on behalf of another person or that the processor 802 collects from its own interaction with the consumer, provided 803 that the processor may combine personal information to perform 804 any purpose specified in the contract or agreement and such 805 combination is reported to the controller; 806 4.

Govern the processor’s personal information processing 807 procedures with respect to processing performed on behalf of the 808 controller, including processing instructions, the nature and 809 purpose of processing, the type of information subject to 810 processing, the duration of processing, and the rights and 811 obligations of both the controller and processor; 812

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 29 of 35 CODING: Words stricken are deletions; words underlined are additions. 5. Require the processor to return or delete all personal 813 information under the contract to the controller as requested by 814 the controller at the end of the provision of services, unless 815 retention of the information is required by law; and 816 6. Upon request of the controller, require the processor to 817 make available to the controller all personal information in its 818 possession under the contract or agreement. 819 (

b) Determining whether a person is acting as a controller 820 or processor with respect to a specific processing of data is a 821 fact-based determination that depends upon the context in which 822 personal information is to be processed. The contract between a 823 controller and processor must reflect their respective roles and 824 relationships related to handling personal information. A 825 processor that continues to adhere to a controller’s 826 instructions with respect to a specific processing of personal 827 information remains a processor. 828 (

c) A third party that has collected personal information 829 from a controller in accordance with this section: 830 1. May not sell or share personal information about a 831 consumer unless the consumer is provided an opportunity by such 832 third party to opt out under this section. Once a third party 833 sells or shares personal information after providing the 834 opportunity to opt out, the third party becomes a controller 835 under this

section if the entity meets the definition of 836 controller in subsection (2). 837 2. May use such personal information from a controller to 838 advertise or market products or services that are produced or 839 offered directly by such third party. 840 (

d) A processor or third party must require any 841

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 30 of 35 CODING: Words stricken are deletions; words underlined are additions. subcontractor to meet the same obligations of such processor or 842 third party with respect to personal information. 843 (

e) A processor or third party or any subcontractor thereof 844 who violates any of the restrictions imposed upon it under this 845

section is liable or responsible for any failure to comply with 846 this section. A controller that discloses personal information 847 to a third party or processor in compliance with this

section is 848 not liable or responsible if the person receiving the personal 849 information uses it without complying with the restrictions 850 under this

section if, provided that at the time of disclosing 851 the personal information, the controller does not have actual 852 knowledge or reason to believe that the person does not intend 853 to comply with this section. 854 (

f) Any provision of a contract or agreement of any kind 855 that waives or limits in any way a consumer’s rights under this 856 section, including, but not limited to, any right to a remedy or 857 means of enforcement, is deemed contrary to public policy and is 858 void and unenforceable. This

section does not prevent a consumer 859 from declining to exercise the consumer’s rights under this 860 section. 861

(10) ENFORCEMENT AND IMPLEMENTATION BY THE DEPARTMENT.— 862 (

a) Any violation of this

section is an unfair and 863 deceptive trade practice actionable under

part II of

chapter 501 864 solely by the department against a controller, processor, or 865 third party. If the department has reason to believe that any 866 controller, processor, or third party is in violation of this 867 section, the department, as the enforcing authority, may bring 868 an action against such controller, processor, or third party for 869 an unfair or deceptive act or practice. For the purpose of 870

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 31 of 35 CODING: Words stricken are deletions; words underlined are additions. bringing an action pursuant to this section, ss. 501.211 and 871 501.212 do not apply. In addition to other remedies under

part 872 II of

chapter 501, the department may collect a civil penalty of 873 up to $50,000 per violation of this section. Civil penalties may 874 be tripled for the following violations: 875 1. Any violation involving a Florida consumer who the 876 controller, processor, or third party has actual knowledge is 18 877 years of age or younger. 878 2. Failure to delete or correct the consumer’s personal 879 information pursuant to this

section after receiving a 880 verifiable consumer request or directions from a controller to 881 delete or correct such personal information unless the 882 controller, processor, or third party qualifies for an exception 883 to the requirements to delete or correct such personal 884 information under this section. 885 3. Continuing to sell or share the consumer’s personal 886 information after the consumer chooses to opt out under this 887 section. 888 (

b) After the department has notified a controller, 889 processor, or third party in writing of an alleged violation, 890 the department may in its discretion grant a 45-day period to 891 cure the alleged violation. The 45-day cure period does not 892 apply to a violation of subparagraph (a)1. The department may 893 consider the number and frequency of violations, the substantial 894 likelihood of injury to the public, and the safety of persons or 895 property when determining whether to grant 45 calendar days to 896 cure and the issuance of a letter of guidance.

If the violation 897 is cured to the satisfaction of the department and proof of such 898 cure is provided to the department, the department may not bring 899

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 32 of 35 CODING: Words stricken are deletions; words underlined are additions. an action for the alleged violation but in its discretion may 900 issue a letter of guidance that indicates that the controller, 901 processor, or person will not be offered a 45-day cure period 902 for any future violations. If the controller, processor, or 903 third party fails to cure the violation within 45 calendar days, 904 the department may bring an action against the controller, 905 processor, or third party for the alleged violation. 906 (

c) Any action brought by the department may be brought 907 only on behalf of a Florida consumer. 908 (

d) By February 1 of each year, the department shall submit 909 a report to the President of the Senate and the Speaker of the 910 House of Representatives describing any actions taken by the 911 department to enforce this section. Such report must be made 912 publicly available on the department’s website. The report must 913 include statistics and relevant information detailing: 914 1. The number of complaints received and the categories or 915 types of violations alleged by the complainant; 916 2.

The number and type of enforcement actions taken and the 917 outcomes of such actions, including the amount of penalties 918 issued and collected; 919 3. The number of complaints resolved without the need for 920 litigation; and 921 4. The status of the development and implementation of 922 rules to implement this section. 923 (

e) The department may adopt rules to implement this 924 section, including standards for verifiable consumer requests, 925 enforcement, data security, and authorized persons who may act 926 on a consumer’s behalf. 927 (

f) The department may collaborate and cooperate with other 928

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 33 of 35 CODING: Words stricken are deletions; words underlined are additions. enforcement authorities of the federal government or other state 929 governments concerning consumer data privacy issues and consumer 930 data privacy investigations if such enforcement authorities have 931 restrictions governing confidentiality at least as stringent as 932 the restrictions provided in this section. 933 (

g) Liability for a tort, contract claim, or consumer 934 protection claim that is unrelated to an action brought under 935 this subsection does not arise solely from the failure of a 936 controller, processor, or third party to comply with this 937 section. 938 (

h) This

section does not establish a private cause of 939 action. 940 (

i) The department may employ or use the legal services of 941 outside counsel and the investigative services of outside 942 personnel to fulfill the obligations of this section. 943

(11) JURISDICTION.—For purposes of bringing an action 944 pursuant to subsection (10), any person who meets the definition 945 of controller as defined in this

section which collects, shares, 946 or sells the personal information of Florida consumers is 947 considered to be both engaged in substantial and not isolated 948 activities within this state and operating, conducting, engaging 949 in, or carrying on a business, and doing business in this state, 950 and is therefore subject to the jurisdiction of the courts of 951 this state. 952

(12) PREEMPTION.—This

section is a matter of statewide 953 concern and supersedes all rules, regulations, codes, 954 ordinances, and other laws adopted by a city, county, city and 955 county, municipality, or local agency regarding the collection, 956 processing, sharing, or sale of consumer personal information by 957

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 34 of 35 CODING: Words stricken are deletions; words underlined are additions. a controller or processor. The regulation of the collection, 958 processing, sharing, or sale of consumer personal information by 959 a controller or processor is preempted to the state. 960

Section 3. Paragraph (

g) of subsection (1) of

section 961 501.171, Florida Statutes, is amended to read: 962 501.171 Security of confidential personal information.— 963

(1) DEFINITIONS.—As used in this section, the term: 964 (g)1. “Personal information” means either of the following: 965 a. An individual’s first name or first initial and last 966 name in combination with any one or more of the following data 967 elements for that individual: 968 (

I) A social security number; 969 (II) A driver license or identification card number, 970 passport number, military identification number, or other 971 similar number issued on a government document used to verify 972 identity; 973 (III) A financial account number or credit or debit card 974 number, in combination with any required security code, access 975 code, or password that is necessary to permit access to an 976 individual’s financial account; 977 (IV) Any information regarding an individual’s medical 978 history, mental or physical condition, or medical treatment or 979 diagnosis by a health care professional; or 980 (

V) An individual’s health insurance policy number or 981 subscriber identification number and any unique identifier used 982 by a health insurer to identify the individual; 983 (VI) An individual’s biometric information or genetic 984 information as defined in s. 501.173(2); or 985 (VII) Any information regarding an individual’s 986

Florida Senate - 2023 SB 262 6-01845D-23 2023262__ Page 35 of 35 CODING: Words stricken are deletions; words underlined are additions. geolocation. 987 b. A user name or e-mail address, in combination with a 988 password or security question and answer that would permit 989 access to an online account. 990 2. The term does not include information about an 991 individual that has been made publicly available by a federal, 992 state, or local governmental entity.

The term also does not 993 include information that is encrypted, secured, or modified by 994 any other method or technology that removes elements that 995 personally identify an individual or that otherwise renders the 996 information unusable. 997

Section 4. Subsection (1) of

section 16.53, Florida 998 Statutes, is amended, and subsection (8) is added to that 999 section, to read: 1000 16.53 Legal Affairs Revolving Trust Fund.— 1001

(1) There is created in the State Treasury the Legal 1002 Affairs Revolving Trust Fund, from which the Legislature may 1003 appropriate funds for the purpose of funding investigation, 1004 prosecution, and enforcement by the Attorney General of the 1005 provisions of the Racketeer Influenced and Corrupt Organization 1006 Act, the Florida Deceptive and Unfair Trade Practices Act, the 1007 Florida False Claims Act, or state or federal antitrust laws, or 1008 s. 501.173. 1009

(8) All moneys recovered by the Attorney General for 1010 attorney fees, costs, and penalties in an action for a violation 1011 of s. 501.173 must be deposited in the fund. 1012

Section 5. This act shall take effect July 1, 2023. 1013