What does Florida's data breach law ask a business to do?

Who does this law apply to?

The law applies to a covered entity: a sole proprietorship, partnership, corporation, trust, estate, cooperative, association or other commercial entity that acquires, maintains, stores or uses personal information.

It must notify each individual in Florida whose personal information was, or is reasonably believed to have been, accessed in the breach.

"Covered entity" means a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information.

A covered entity shall give notice to each individual in this state whose personal information was, or the covered entity reasonably believes to have been, accessed as a result of the breach.

What counts as personal information?

Personal information is a first name or first initial and last name joined with items such as a Social Security number, a government identification number, a financial account or card number with its access code, medical or health insurance information, biometric data or geolocation information.

A user name or email address with the password or security question and answer for an online account is covered on its own.

An individual's first name or first initial and last name in combination with any one or more of the following data elements for that individual:

A user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The text says notice to individuals must be made as expeditiously as practicable and without unreasonable delay, and no later than 30 days after the determination of a breach or reason to believe one occurred.

No notice to individuals is due if, after an appropriate investigation and consultation with law enforcement, the entity reasonably determines the breach has not and will not likely result in identity theft or other financial harm.

Notice to individuals shall be made as expeditiously as practicable and without unreasonable delay, taking into account the time necessary to allow the covered entity to determine the scope of the breach of security, to identify individuals affected by the breach, and to restore the reasonable integrity of the data system that was breached, but no later than 30 days after the determination of a breach or reason to believe a breach occurred unless subject to a delay authorized under paragraph (b) or waiver under paragraph (c).

Notwithstanding paragraph (a), notice to the affected individuals is not required if, after an appropriate investigation and consultation with relevant federal, state, or local law enforcement agencies, the covered entity reasonably determines that the breach has not and will not likely result in identity theft or any other financial harm to the individuals whose personal information has been accessed.

Who else must be told?

If a breach affects 500 or more individuals in Florida, the entity must notify the Department of Legal Affairs no later than 30 days after the determination of the breach.

If more than 1,000 individuals must be notified at a single time, the nationwide consumer reporting agencies must be told as well.

A covered entity shall provide notice to the department of any breach of security affecting 500 or more individuals in this state. Such notice must be provided to the department as expeditiously as practicable, but no later than 30 days after the determination of the breach or reason to believe a breach occurred.

(e) "Department" means the Department of Legal Affairs.

If a covered entity discovers circumstances requiring notice pursuant to this section of more than 1,000 individuals at a single time, the covered entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis,

Is encrypted information treated differently?

Information that is encrypted, secured or otherwise made unusable is not personal information under this law.

The term also does not include information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable.

What if a vendor holds the data?

A third-party agent whose system is breached must tell the covered entity no later than 10 days after determining the breach or having reason to believe it occurred.

In the event of a breach of security of a system maintained by a third-party agent, such third-party agent shall notify the covered entity of the breach of security as expeditiously as practicable, but no later than 10 days following the determination of the breach of security or reason to believe the breach occurred.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.