Key takeaways

  • Individuals in Florida whose personal information was affected must be notified no later than 30 days after the breach is determined or reasonably believed to have occurred.
  • A breach affecting 500 or more individuals in Florida must also be reported to the Florida Department of Legal Affairs within 30 days.
  • When more than 1,000 individuals must be notified at once, the nationwide consumer reporting agencies must also be informed.
  • Missing the deadline exposes a business to civil penalties of up to $500,000.

What the law covers

Section 501.171 of the Florida Statutes — the Florida Information Protection Act of 2014 — requires businesses that hold personal information of people in Florida to take reasonable measures to protect it, and sets firm deadlines for notice when it is breached.

The 30‑day clock

Thirty days pass quickly while you are still finding out what happened. Within that window you need to determine what was accessed, whose data it was, where those people live, and what to tell them. A firm that gives the Department written good cause within the first 30 days may receive 15 additional days to notify individuals. Law enforcement may also request a delay in writing.

What counts as personal information

The statute defines personal information in two ways. The first is an individual's first name or first initial and last name combined with one or more of the following: a Social Security number; a driver license, identification card, passport or military identification number, or a similar government-issued number; a financial account or card number together with any required security code, access code or password; medical history, condition, treatment or diagnosis; a health insurance policy or subscriber number and related identifier; biometric data; or geolocation information. The second is a username or email address combined with a password or security question and answer that would permit access to an online account. Publicly available government information is excluded. So is information that is encrypted, secured or otherwise rendered unusable. That last exclusion is one of the strongest practical reasons to encrypt laptops, phones and backups.

What counts as a breach

A breach of security under the statute is unauthorized access of data in electronic form containing personal information. Good-faith access by an employee or agent is not a breach, as long as the information is not used for an unrelated purpose or subject to further unauthorized use. A stolen paper file is outside this definition, although other laws and your own policies may still apply. A compromised email account that holds spreadsheets of customer data is inside it.

Two audiences, two notices

The statute requires notice to the Florida Department of Legal Affairs when a breach affects 500 or more individuals in Florida. The notice is due as expeditiously as practicable and no later than 30 days after the breach is determined or there is reason to believe it occurred, with up to 15 more days if good cause is given in writing within the 30. It must include a synopsis of the events, the number of Floridians affected, the free services offered to them and how to use those services, a copy of the notice sent to individuals (or an explanation of other actions), and a contact person. On request, the Department can also ask for police, incident or computer forensics reports, your breach policies, and the steps you took to fix the problem.

Individuals must be notified as expeditiously as practicable and without unreasonable delay, and no later than 30 days after the determination, subject to a law-enforcement delay. Notice is by mail to the address in your records or by email to the email address in your records. It must state the date or estimated date range of the breach, describe the personal information accessed, and give contact information for questions. If direct notice is not feasible because the cost would exceed $250,000, more than 500,000 people are affected, or you have no mailing or email address, the statute allows substitute notice through your website and print and broadcast media. If you notify more than 1,000 individuals at one time, you must also notify the nationwide consumer reporting agencies of the timing, distribution and content of the notices.

The harm exception and its paperwork

Notice to individuals is not required if, after an appropriate investigation and consultation with law enforcement, you reasonably determine that the breach has not and will not likely result in identity theft or other financial harm. That determination must be documented in writing and kept for at least five years. A copy must go to the Department within 30 days of the determination. The exception exists, but it carries a paperwork duty and a judgment that regulators may review. Do not treat it as a way to avoid thinking about the problem.

Vendors have 10 days

A third-party agent that holds data for you must notify you as expeditiously as practicable, and no later than 10 days after it determines, or has reason to believe, that a breach occurred. After that, you must give the notices. A vendor may give notice on your behalf, but if it fails to do so, the statute treats that as your violation. In practice, vendor contracts should require notice in much less than 10 days, because your 30‑day clock is running from your own determination or reason to believe, and every day a vendor sits on information is a day you may not recover.

Other duties in the same section

The statute does more than set deadlines. Businesses must take reasonable measures to protect and secure electronic data containing personal information, and to dispose of customer records when they no longer retain them, by shredding, erasing or otherwise making them unreadable. If your notice complies with the rules of your primary or functional federal regulator, the statute treats it as compliant, and timely giving that notice to the Department satisfies the Department notice. That matters for banks, broker-dealers and healthcare providers that already follow federal timelines.

Penalties

A violation of the notice provisions is treated as an unfair or deceptive trade practice in an enforcement action by the Department. Civil penalties are $1,000 per day for the first 30 days, then $50,000 for each subsequent 30‑day period, up to 180 days. After that, the total cannot exceed $500,000. The penalties apply per breach, not per affected person. The statute states that it does not create a private cause of action, although lawsuits under other theories can still follow a breach. Those are the limits of this statute, not a promise of what a plaintiff may try.

A one-page response timeline

  • Day 0: you determine, or have reason to believe, that a breach occurred. Write down the date and time and who decided.
  • Days 0 to 3: contain, preserve evidence, engage counsel and a forensic firm, and identify the data involved.
  • Days 3 to 15: identify affected individuals and their states of residence, decide whether the harm exception applies, and ask law enforcement whether a delay is needed.
  • Days 15 to 25: finalize the notice, arrange mailing or email and any credit monitoring, and prepare the Department filing if 500 or more Floridians are affected.
  • By day 30: notices sent to individuals and to the Department. If you need the additional 15 days, the written good-cause request must reach the Department within the first 30.
  • Afterward: notify consumer reporting agencies if more than 1,000 were notified, record lessons learned, and update your controls.

Other states have their own laws, and people outside Florida may be among your customers. The Florida statute is one piece of a larger picture. Our team helps businesses prepare the inventory, the contracts and the plan that make the 30 days manageable. Please have your counsel confirm which laws apply to you.

Checklist: prepare before an incident

  • Know where personal information is stored, including email attachments and file shares
  • Encrypt devices and backups that hold personal information
  • Enforce multi-factor authentication on email and remote access
  • Keep logs long enough to answer "what was accessed?"
  • Name an incident lead and an outside forensic partner in advance
  • Prepare notice templates for individuals and the Department of Legal Affairs
  • Write vendor contracts that require prompt breach notice
  • Rehearse once a year

Hurricane season is a security issue too

Many hurricane-exposed businesses discover their backups do not restore during a storm, not during a breach. The same preparation — tested, off-site, encrypted backups — protects you from both.

Sources

This article is general information, not legal advice. Confirm your obligations with your counsel. Last reviewed .

Keep reading

Need help with this?

Your entire IT operation, run by engineers who have operated infrastructure for global enterprises.

Managed IT Services