Florida’s Digital Bill of Rights Joins the Regulatory Framework

The Federal Trade Commission 2023 Privacy and Data Security Update publication released on March 28, 2024, demonstrated that the FTC filed 89 data security cases through 2023. In one of its enforcement actions for 2024, the FTC required a smaller company to reimburse consumers more than $370,000 stemming from inadequate data security measures that led to multiple data breaches over the course of several years. The corresponding orders for data security breaches levied by the FTC uniformly require organizations to perform data minimization, delete personal data that is no longer has a business justification to maintain; and develop a comprehensive information security program while certifying compliance to the agency for a set period of time, along with ongoing compliance review. The FTC’s data minimization requirements dictate companies must implement policies to retain personal information for only as long as is reasonably necessary to fulfill the business purpose for which the information was collected and specify the specific business need for retaining it. In addition, many of states with comprehensive privacy laws going into effect in 2025 have similar data minimization processes that should be in place.

The obligations companies have for data security was best expressed by the FTC’s Bureau of Consumer Protection, “ … shoddy security and data retention practices allowed a hacker to obtain sensitive personal data about millions of consumers,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Companies have a responsibility to secure data they maintain and to delete data they no longer need.”