Law / United States / 
Florida
Florida Information Protection Act, data security and disposal duty
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Retention
What it requires
- This binds each covered entity (a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information), each governmental entity, and each third-party agent, for the data-security duty; the disposal duty binds a covered entity or third-party agent, and its own text does not separately name a governmental entity.
- Take reasonable measures to protect and secure data in electronic form containing personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.NIST CSF 2.0PR.DS-01
- Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.NIST CSF 2.0ID.AM-08
- A violation of either duty is enforced only by the Department of Legal Affairs, as an unfair or deceptive trade practice under Fla. Stat. 501.207; there is no private right of action. A willful violation draws a civil penalty of up to $10,000 under the Florida Deceptive and Unfair Trade Practices Act's general penalty provision, Fla. Stat. 501.2075; the $500,000-capped penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the separate breach-notification duty in subsection (3) or (4).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- 3.5Destroying data in a way that fits its sensitivity and storage type.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Fla. Stat. 501.171 sets no penalty schedule of its own for a violation of the data-security duty (subsection (2)) or the disposal duty (subsection (8)); subsection (9)(a) deems any violation of the section an unfair or deceptive trade practice actionable under Fla. Stat. 501.207, and the Florida Deceptive and Unfair Trade Practices Act's own general civil penalty, Fla. Stat. 501.2075, caps a willful violation at $10,000, with no stated aggregate cap. This is distinct from the $500,000-capped, per-day-accruing penalty Fla. Stat. 501.171(9)(b) sets, which by its own terms reaches only a violation of the notice duty in subsection (3) or (4) and is recorded on this jurisdiction's privacy-topic row for that duty.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Department of Legal Affairs (the Florida Attorney General's office) is the sole enforcing authority. Under Fla. Stat. 501.171(9)(a), a violation of section 501.171 is treated as an unfair or deceptive trade practice actionable by the department under Fla. Stat. 501.207, which may bring a declaratory-judgment action, an action to enjoin the violation, or an action for actual damages on behalf of affected consumers or governmental entities.
What this law does
Fla. Stat. 501.171(2) requires each covered entity, governmental entity, or third-party agent to take reasonable measures to protect and secure data in electronic form containing personal information; this duty explicitly names a governmental entity as a bound party in its own text.
Fla. Stat. 501.171(8) separately requires each covered entity or third-party agent, without naming a governmental entity, to take all reasonable measures to dispose of customer records containing personal information, by shredding, erasing, or otherwise rendering the information unreadable or undecipherable, once the records are no longer to be retained.
A covered entity is defined as a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information; that definition reaches a governmental entity only for the notice duty in subsections (3) through (6). Neither subsection states further content for what 'reasonable' requires beyond the general standard.
A violation of either duty is deemed an unfair or deceptive trade practice actionable only by the Department of Legal Affairs under Fla. Stat. 501.207; the section creates no private cause of action.
The $500,000-capped civil penalty Fla. Stat. 501.171(9)(b) sets applies only to a violation of the notice duty in subsection (3) or (4), so a willful violation of the data-security or disposal duty instead draws the Florida Deceptive and Unfair Trade Practices Act's general civil penalty of up to $10,000 per violation under Fla. Stat. 501.2075.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .