USA – FLORIDA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
Fintech and financial services Financial services firms generally remain outside the FDBR’s scope but face sectoral regulations under the Gramm-Leach-Bliley Act. However, fintech com - panies with foreign investment and those collecting health or biometric data for insurance or lending deci - sions should assess CHINA Prevention Unit expo - sure. Foreign-owned fintech companies should also note that, effective 1 July 2025, Florida law prohibits governmental entities from contracting with compa - nies owned or controlled by countries of concern if such contracts involve access to personal identify - ing information. The intersection of financial services and healthcare data creates potential vulnerability. Companies processing payment data internationally should evaluate whether their ownership structures and data flows create compliance risks. Education technology Educational technology companies must consider how SB 482’s parental control requirements would affect learning platforms using AI tutoring or assess - ment tools. Ed tech companies should monitor inter - actions with student privacy law and AI transparency requirements, particularly regarding algorithmic deci - sion-making in admissions, placement or disciplinary contexts. Telecommunications Telecommunications providers typically fall outside the FDBR’s scope but remain subject to data breach notification and security requirements. However, tel - ecoms companies with foreign ownership or those offering health-related services through their platforms should evaluate CHINA Prevention Unit implications. As 5G networks enable more healthcare applications, the line between telecommunications and healthcare
breach will not cause financial harm to affected indi - viduals, notification may be avoided. However, this determination must be reasonable, documented in writing, maintained for five years and provided to the Department within 30 days of the determination. For breaches affecting 500 or more Florida residents, entities must notify the Department within 30 days of determining that a breach has occurred. If more than 1,000 residents are affected, entities must also noti - fy all nationwide consumer reporting agencies. The notification to the Department must include specific information about the breach, the number of individu - als affected and steps taken to address the incident. Third-party agents that maintain personal informa - tion on behalf of another entity must notify that entity as expeditiously as practicable but no later than ten days following determination of a breach or reason to believe a breach occurred. Penalties can reach USD500,000 per breach, assessed at USD1,000 daily for the first 30 days, then USD50,000 per 30-day period up to 180 days. Nota - bly, penalties apply per breach rather than per individ - ual, creating more predictable liability than per-record penalty structures. The statute requires reasonable security measures to protect personal information and mandates secure disposal of records no longer needed for business purposes. The CHINA Prevention Unit’s focus on foreign-owned healthcare companies suggests security practices will face particular scru - tiny where cross-border data transfers occur. Florida’s State Cybersecurity Act requires state agen - cies to implement cybersecurity measures aligned with the National Institute of Standards and Tech - nology (NIST) Cybersecurity Framework, including risk assessments, incident response protocols and mandatory reporting of cybersecurity incidents and ransomware attacks. While these requirements apply to government entities rather than private business - es, they signal the state’s overall approach to data security and may influence expectations for reason - able security measures under the breach notification statute.
data collection becomes more blurred. Data Breach Notification and Security Requirements
FIPA continues to impose notification obligations when breaches create a risk of financial harm. The statute’s risk-based approach requires covered enti - ties to investigate breaches and consult with relevant law enforcement agencies before determining wheth - er notification is necessary. If after investigation and consultation the entity reasonably determines that the
579 CHAMBERS.COM
Powered by FlippingBook