Under the Florida statute, data breach notification can mean up to three audiences. Those are each affected individual, the Florida Department of Legal Affairs and nationwide consumer reporting agencies. For the first two, the statute sets an outer limit of thirty days. The count starts the day the business determines, or has reason to believe, a breach occurred.
The statute also sets a penalty schedule that grows with each thirty-day period of delay. So a business that waits to learn its duties may add a second problem to the incident. That’s a short first job. Write down that day. List what was accessed. Then take the legal calls to a lawyer.
What Does Florida’s Data Breach Notification Statute Cover?
The statute asks a business that holds certain personal information to take reasonable measures to protect it. After a breach of security, it asks the business to notify affected individuals. In some cases it also asks for notice to the department and to nationwide consumer reporting agencies, within the outer limits the statute sets.
The text is public. It’s worth reading once. It appears as the Florida statute titled Security of confidential personal information on the Florida Senate’s website. That page says the information on the system is unverified, and that the official journals or bills govern. So confirm the current text before leaning on any detail.
The statute’s word for a business is covered entity. It names a sole proprietorship, partnership, corporation, trust, estate, cooperative, association or other commercial entity that acquires, maintains, stores or uses personal information. A breach of security, in the statute’s words, means unauthorized access of data in electronic form containing personal information. There’s a carve-out for staff acting in good faith. Good faith access by an employee or agent isn’t a breach, the statute says, provided the information isn’t used for an unrelated purpose or subject to further unauthorized use. Whether a business or an incident fits those definitions is a lawyer’s call.
Personal information has two shapes in the statute. One is a first name or first initial and last name, plus one of several listed data elements. Those include a social security number. A driver license, identification card, passport, military or similar number on a government document used to verify identity. A financial account, credit or debit card number with the required security code, access code or password. Medical history, a mental or physical condition, or medical treatment or diagnosis. Biometric data and geolocation are on the list too. The other shape stands alone: a user name or e-mail address with a password or security question and answer that would permit access to an online account.
The definition has a limit. The statute says the term doesn’t include information that is encrypted, secured or modified by another method or technology that removes the elements identifying an individual, or that otherwise renders it unusable. Whether a given case qualifies is a legal call. An IT provider can still establish what sat on a device and whether it was encrypted. O&O Systems has a post on what encryption does and does not protect on a lost laptop.
Who Has to Be Told, and by When?
Under the statute, three audiences may be involved, plus a vendor’s duty to the business. Each affected individual gets notice no later than thirty days. The department is notified when five hundred or more individuals in this state are affected. Notice also goes to nationwide consumer reporting agencies for more than one thousand individuals at a single time.
- Each affected individual — as expeditiously as practicable and without unreasonable delay, and no later than thirty days after the determination of the breach.
- The department — when five hundred or more individuals in this state are affected, no later than thirty days, with fifteen additional days available if the business gives the department good cause in writing within those thirty days.
- Nationwide consumer reporting agencies — sometimes called the credit bureaus, when more than one thousand individuals are notified at a single time, without unreasonable delay, of the timing, distribution and content of the notices.
- A third-party agent — tells the business rather than the individuals, no later than ten days after it determines a breach occurred or has reason to believe one did.
All of those deadlines run from one point: the determination of the breach, or the reason to believe one occurred. That’s why writing down the moment matters. The statute says individual notice should come as expeditiously as practicable and without unreasonable delay. It allows time to determine the scope of the breach. It allows time to identify the individuals affected and to restore the reasonable integrity of the breached system. But it fixes the outer limit at thirty days.
What Do the Notices Have to Say?
The statute sets a floor for the individual notice. It must give the date, estimated date or date range of the breach. It must describe the personal information accessed, or reasonably believed accessed. And it must give the individual a way to ask the business about the breach and about what it keeps on them.
Notice goes to the mailing address or the e-mail address in the business’s records. The department’s notice is a written one, and the statute lists what it carries. A synopsis of the events surrounding the breach. The number of individuals in this state affected or potentially affected. Any free services offered because of the breach, and how to use them. A copy of the individual notice, or an explanation of the other actions taken. And the name, address, telephone number and e-mail address of the employee or agent who can say more.
The department may ask for more. The statute says it may request a police report, an incident report or a computer forensics report. It may request a copy of the policies in place regarding breaches, and the steps taken to rectify the breach. A business may also add supplemental information at any time. An IT provider can supply facts for those requests. The wording and the decisions stay with the business and its lawyer.
Substitute notice is the narrow alternative. The statute describes it as a notice on the business’s website along with notice in print and broadcast media. It can stand in only when direct notice isn’t feasible. The statute names the conditions. The cost of providing notice would exceed two hundred fifty thousand dollars. Or the affected individuals exceed five hundred thousand persons. Or the business has no e-mail address or mailing address for them.
Can a Notice Be Delayed or Skipped?
The statute allows two routes and one shortcut, and each comes with conditions. A law enforcement agency can ask in writing for a delay. A business can make a written determination that the breach has not and will not likely cause harm. And notice given under a federal regulator’s own rules can count. Each one is a lawyer’s call.
The first route runs through law enforcement. If a federal, state or local law enforcement agency determines that notice to individuals would interfere with a criminal investigation, the statute says the notice is delayed. That delay follows the agency’s written request, for a period the agency determines is reasonably necessary.
The second is a written no-harm determination. The statute says notice to affected individuals isn’t required if the business reasonably determines that the breach has not and will not likely result in identity theft or other financial harm. That follows an appropriate investigation and consultation with relevant law enforcement agencies. There are strings attached. The determination must be documented in writing and kept for at least five years. And the business must give it to the department within thirty days after making it. Whether a case meets that test is a legal question.
The third path is the shortest. The statute says a business that notifies affected individuals under the rules, procedures or guidelines established by its primary or functional federal regulator is deemed to comply with the individual notice requirement, and that a timely copy to the department meets the department notice.
What Does a Late Notice Cost Under the Statute?
The statute treats a violation as an unfair or deceptive trade practice in an action the department brings. It adds a civil penalty for failing to notify: one thousand dollars for each day up to the first thirty days, then fifty thousand dollars for each subsequent thirty-day period or portion of one, up to one hundred eighty days.
If the violation runs past one hundred eighty days, the statute sets a civil penalty not to exceed five hundred thousand dollars. It says those penalties apply per breach, and not per individual affected by the breach. The statute also states that it doesn’t establish a private cause of action. Other laws, contracts and insurance terms can add duties of their own, and a lawyer can say which ones reach a given business.
There’s a second duty in the same statute. It asks every covered entity and third-party agent to take reasonable measures to protect and secure data in electronic form containing personal information. So the obligations aren’t only about the notice.
What Should an Owner Do on the First Day?
Write down the date and time the business first had reason to believe a breach occurred. Keep the incident record from that point on. List the personal information that may have been accessed, and whether it was encrypted. Ask any vendor that holds the data what it knows. Then call a lawyer.
The date carries weight because the statute counts from the determination of the breach, or the reason to believe one occurred. A written timeline, kept as the facts come in, gives the lawyer something to work from. It helps the IT provider line up what happened. And the synopsis the department’s notice calls for has to come from somewhere.
The notice step belongs in the incident plan, beside the technical steps. O&O Systems has a separate post on what an incident response plan should contain, which is worth reading before anyone needs it.
A vendor changes the sequence. The statute calls a vendor that holds the data a third-party agent: an entity contracted to maintain, store or process personal information for a covered entity. It says the agent must tell the business no later than ten days after determining a breach occurred. The business then gives the notices. And an agent’s failure to give proper notice is deemed a violation against the business.
O&O Systems’ Cybersecurity and Compliance page says its team performs in-depth assessments and audits to uncover vulnerabilities and prepare businesses for regulatory inspections.
Frequently Asked Questions About Data Breach Notification
Does the statute apply to a very small business?
The statute’s definition of a covered entity reaches a sole proprietorship, a partnership, a corporation and other commercial entities that acquire, maintain, store or use personal information. The definition turns on what a business does with personal information. Whether a particular business falls inside it is a question for a lawyer.
Does a lost laptop count as a breach?
The statute defines a breach of security as unauthorized access of data in electronic form containing personal information. It also says personal information doesn’t include information that is encrypted, secured or otherwise rendered unusable. Whether a particular lost device meets those definitions is a legal call. An IT provider can establish the facts underneath it: what was on the device, and whether it was encrypted.
Do customers outside Florida count?
The statute speaks of individuals in this state. Other places can have their own rules for their own residents, and those rules may run on different timelines. A lawyer can say which ones reach a given business and its customer list. That’s a question worth asking before a notice goes out rather than after.
Who should write the notice?
The statute lists the minimum contents, so the floor is set. The wording beyond that floor is the business’s to decide, and a lawyer may review it before it goes out. An IT provider can supply the facts underneath: which accounts and files were accessed, and when.
Can a customer sue under the statute?
The statute states that it does not establish a private cause of action. That’s a statement about this statute and nothing wider. Other laws and contracts can work differently, so a lawyer is the one to ask about a specific situation.
Write Down the Day First
The order is simple. Record the moment the business first had reason to believe something happened. Gather the facts about what was accessed and whether it was encrypted. Then talk to a lawyer before any notice goes out. A notice built on a guessed timeline can create work twice.
If you’re mapping your own data breach notification steps and want a second opinion on your incident plan, ask O&O Systems about your incident readiness and bring whatever plan or contact list you have.
