Florida's data breach law: what a small firm must do, and by when

Most firm owners first read Florida's data breach law in the middle of an incident, with a deadline already running. It's a better read on a quiet afternoon. It takes ten minutes, and it changes what you'd want to have in place.

The law is section 501.171 of the Florida Statutes, the Florida Information Protection Act. This article is general information, not legal advice. If you think you've had a breach, call a lawyer and your insurer today.

Does it apply to your firm?

Almost certainly. It covers any commercial entity that acquires, maintains, stores or uses personal information, and it names sole proprietorships and partnerships alongside corporations. There's no minimum size and no exemption for professional firms.

What counts as personal information

A person's first name or initial and last name, together with any one of these:

• A Social Security number
• A driver license, passport, military ID or similar government ID number
• A financial account or card number, with the code or password needed to use it
• Medical history, a condition, or a diagnosis or treatment
• A health insurance policy or subscriber number
• Biometric data
• Geolocation information

And, on its own, a user name or email address with a password or security answer that would open an online account.

Read that list with your own files in mind. A tax return has the first item on every page. A client intake folder has the second. A personal injury or disability file has the fourth. Nearly every professional firm holds exactly the kind of data this law was written for.

Two things fall outside it: information a government body has already made public, and information that is encrypted or otherwise unusable to whoever got hold of it. That second exclusion is the best single reason to encrypt every laptop and phone at your firm.

What counts as a breach

Unauthorized access to data in electronic form that contains personal information.

Notice what the definition leaves out. It doesn't say the data was stolen, published or misused. Access is enough. For a professional firm that means:

• Someone signing in to a partner's mailbox
• Ransomware on the file server, where files are usually copied before they're locked
• A lost or stolen laptop that wasn't encrypted
• A former employee using a login nobody turned off

An employee who opens a file in good faith as part of their job hasn't caused a breach.

The deadlines

Who must be told	By when	When it applies
Each affected person	As quickly as practicable, and no later than 30 days after you determine there was a breach or have reason to believe there was	Always, subject to the exception below
The Florida Department of Legal Affairs	Within 30 days	500 or more people in Florida are affected
The consumer credit reporting agencies	Without unreasonable delay	More than 1,000 people are being notified at once
The firm you hold the data for	Within 10 days	You hold the data as a vendor for someone else

A few points owners miss:

• The clock starts at "reason to believe," not at the end of an investigation.
• You can ask for 15 more days to notify individuals, in writing to the Department, for good cause. You have to ask inside the original 30.
• Law enforcement can ask you to hold off if notice would interfere with a criminal investigation. Get that request in writing.
• The 10-day rule cuts both ways. Your payroll company or cloud provider owes you notice within 10 days. If you're a bookkeeper or consultant holding a client's staff or customer data, you owe the same to them.

What the notice has to say

At a minimum: the date or estimated date range of the breach, a description of the personal information that was accessed, and how the person can contact your firm to ask about it. It goes by mail or by email to the address you hold.

The Department gets more: a summary of what happened, the number of Floridians affected, any free services you're offering such as credit monitoring, a copy of the notice, and a named contact. On request, it can also ask for your incident or forensics report, a copy of the policies you had in place regarding breaches, and the steps you've taken to put things right.

That middle item is worth a pause. The state can ask to see your policy. "We didn't have one" is an answer you'd rather not give.

The exception, and its paperwork

You don't have to notify individuals if, after an appropriate investigation and consultation with law enforcement, you reasonably determine that the breach has not caused and is unlikely to cause identity theft or other financial harm.

It isn't a quiet way out. The decision has to be put in writing, kept for five years, and sent to the Department within 30 days. And you can only reach it if you have the evidence to investigate with.

The penalties

Failing to notify on time is treated as an unfair or deceptive trade practice, enforced by the Department:

• $1,000 a day for the first 30 days
• $50,000 for each further 30 days or part of it, up to 180 days
• Up to $500,000 in total if it runs past 180 days

The penalty is per breach, not per person. The section doesn't create a private right to sue. That doesn't stop an affected client bringing a claim on other grounds, such as negligence or breach of contract.

Two duties that apply before any breach

The notification rules get the attention, but the statute also makes two demands of every covered firm, every day:

1. Take reasonable measures to protect and secure electronic data containing personal information.
2. Dispose of customer records properly when you no longer need to keep them, by shredding, erasing or otherwise making them unreadable. That includes the old laptop in the storeroom and the hard drive inside the leased copier.

Why 30 days is harder than it sounds

To send a notice you need four answers: which accounts or devices were accessed, what was in them, whose information that was, and where those people live.

A firm that kept sign-in records and had its systems monitored can answer the first question precisely. The attacker was in one mailbox for six hours and opened these messages. That firm might write to thirty people.

A firm with no records can't narrow anything down. It has to assume everything the account could reach was accessed, and it might write to three thousand. Same breach, same law, a very different month.

How many letters you send is decided by evidence you either collected before the breach or didn't.

A checklist for this month

1. List where personal information lives: email, shared drives, your practice software, the client portal, old laptops, the scanner.
2. Encrypt every laptop and phone. Encrypted data falls outside the definition.
3. Turn on multi-factor authentication everywhere. See why MFA comes first.
4. Keep sign-in and activity records, and have someone watching them. See SIEM and managed detection and response.
5. Write a one-page incident plan: who decides, the insurer's number, a breach lawyer's number. Our ransomware first-hour plan is a starting point.
6. Delete what you no longer need. Data you don't hold can't be breached.
7. Check your vendor contracts for the 10-day notice.
8. Read your cyber policy for what it pays toward lawyers, investigation and notification, and what it requires of you first.

What being ready costs, against what it saves

	What it comes to
Our Business plan for ten people: protection, monitoring, backup and training	$1,490 a month
Our Secure plan for ten people: adds SIEM monitoring, compliance reporting and a written security plan kept current	$2,340 a month
Late notice	Up to $500,000 in civil penalties
A breach you can't scope	A lawyer, an investigator, and a letter to every person whose data the account could reach
A breach you can scope	The same lawyer, and letters to the people actually affected

None of this makes a breach impossible. It makes a breach smaller, provable and answerable inside the deadline, with someone beside you who knows your systems. Most owners would rather pay for that every month than discover its value on day twenty-nine.

Other rules that may apply alongside

• Other states. If affected clients live outside Florida, their own state's law applies to them.
• Tax and accounting practices also fall under the FTC Safeguards Rule.
• Law firms have duties under the Rules of Professional Conduct. See what the Florida Bar expects.
• Health information may bring in HIPAA.

You can read the statute on the Florida Legislature's website. If you'd like to know where your firm stands before you need to, book a free review, or see how we help with compliance.