Ships a mobile app, in Florida

Fla. Stat. § 501.171(2), (8) · Read the law's page

• This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
• Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
• A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).