On June 20, 2014 Governor Rick Scott approved the Florida
Information Protection Act of 2014, overhauling the requirements
and steps companies must follow when faced with a potential or
actual security breach resulting in the unauthorized disclosure of
personal information. The text of the law can be found here. The law becomes effective July 1,
2014.
This action in Florida continues a line of recent data breach
proposals and laws in a number of states, including California, New
Mexico, Iowa, and Kentucky. Among other things, the law changes the
definition of personal information that can trigger a notification
requirement by adding health insurance, medical information,
financial information and online account information, such as
security questions and answers, email addresses, and passwords.
Current law covers an individual's first name or initial and
last name, in combination with: (i) a social security number; (ii)
drivers' license or identification card number;
