CS/HB 7085 - Florida Information Protection Act of 2014

• Creates comprehensive data security requirements for covered entities and governmental entities to take reasonable measures to protect electronic personal information and establishes a breach notification framework.

• Requires covered entities to notify the Department of Legal Affairs within 30 days of any breach affecting 500 or more Florida residents, with option for 15-day extension upon written request.

• Mandates notification to affected individuals within 30 days of breach discovery, with exceptions for law enforcement requests or determinations that no identity theft or financial harm will result; requires notification to credit reporting agencies if 1,000+ individuals affected.

• Establishes civil penalties up to $500,000 for failure to provide timely notice, calculated at $1,000 per day for up to 30 days, then $50,000 per subsequent 30-day period up to 180 days.

• Repeals prior breach statute (s. 817.5681) and requires proper disposal of customer records; specifies that no private cause of action is created; effective July 1, 2014.