On June 20, 2014, Florida Governor Rick Scott signed into law a package of bills (S.B. 1524 and 1526) repealing the state’s security breach law and putting in its place arguably the broadest and most encompassing breach law in this country. These bills also established a requirement for companies to safeguard personal information relating to consumers.

In response to significant and highly publicized breach incidents occurring over the past year, at least 19 state legislatures have introduced or considered security breach legislation in 2014. This year, Kentucky enacted a new breach law (leaving Alabama, New Mexico, and South Dakota as the only states in the country without breach laws). In addition, Iowa amended its breach law to require, among other things, notice to the Iowa Attorney General (AG) of breach incidents. Nonetheless, the new Florida law, effective July 1, 2014, is groundbreaking in its breadth and scope. As discussed below, the Florida law includes new requirements unseen in similar laws throughout the country, as well as some of the most stringent requirements shared by a handful of states. About the only good news for businesses is the fact that the Florida law does not create a private right of action.