Sends faxes, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).

Rule 2-3.002, Fla. Admin. Code · Read the law's page

• Applies to a controller under the Florida Digital Bill of Rights, which you declare by stating that you are a controller: a for-profit entity that conducts business in Florida, collects personal data about consumers, determines the purposes and means of processing it and makes more than $1 billion in global gross annual revenues, and that also derives 50 percent or more of those revenues from online advertising, operates a consumer smart speaker and voice command component service, or operates an app store or digital distribution platform offering at least 250,000 applications, together with any entity that controls or is controlled by such a controller.
• Protect the confidentiality, integrity and accessibility of the personal data you create, receive, process, archive, maintain or transmit from unauthorized access, use, disclosure, deletion or modification, with data security practices that comply with the risk management framework and standards of the National Institute of Standards and Technology that the rule adopts.
• Apply the security practices for the most sensitive type of data to a data set of mixed sensitivity, and establish, implement and maintain procedures for the secure disposal of personal data.
• Designate a qualified individual to oversee and implement the data security practices, and regularly test and monitor compliance with them, including key controls, systems and procedures.
• Manage access permissions on the principles of least privilege and separation of duties, and maintain effective technical controls including encryption, audit controls that record and examine activity, time synchronization, and safeguards against unauthorized access or modification.
• Limit and protect any storage of personal data on mobile electronic devices and passive storage media, and do not store personal data unencrypted on them.