Florida Digital Bill of Rights (FDBR) 2-3.004(1)(a): Rules 2-3.004(1)(a) to (c) and 2-3.001: commercially reasonable authentication of consumers and authorised persons

Before acting on or answering a rights request, a controller must authenticate the consumer by a commercially reasonable method, and where someone acts for another consumer, authenticate that person and confirm they are an authorised person (the consumer, a person with express written authority, an agent under a power of attorney, or a parent or legal guardian of a child). The method must weigh the rights sought, the type, sensitivity, value and volume of data, the harm from improper access or deletion, and cost. The controller should avoid asking for more personal data, may use extra information only to authenticate and must delete it immediately afterwards, and may not charge the requester or require payment to a third party for authentication.