Florida has enacted an Information Protection Act that aims to ward off identity theft by requiring organizations to protect personal data and report data breaches in a shorter period.
The law also includes a provision that now defines covered personal information to include a username or email address in combination with a password or security question and answer that would permit access to an online account. Only California and Puerto Rico's laws have similar provisions, Under the new law, companies must take reasonable measures to protect and secure data containing personal information in electronic form and requires notice to individuals of data security breaches under certain circumstances.
The law also allows the Florida attorney general to require a copy of an incident or forensic report, along with copies of companies' policies and procedures at the time of the data breach.
