Florida has a specific statutory requirement about disposing of records that contain personal information, and it applies to the hard drives in your old computers as much as to paper files. It is short, it is quotable, and most businesses have never read it.
Subsection (8), headed Requirements for Disposal of Customer Records, reads:
“Each covered entity or third-party agent shall take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within its custody or control when the records are no longer to be retained. Such disposal shall involve shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.”
Three phrases carry the weight. “All reasonable measures” is a standard of care, not a named technology — the law does not tell you to use a particular method, which is why NIST SP 800-88 gets used as the practical yardstick. “Arrange for the disposal” is what brings hiring a vendor inside the rule, and it does not transfer the obligation away from you. And “unreadable or undecipherable through any means” is a higher bar than a deleted file or a quick format, both of which leave data recoverable with free tools.
Personal information is defined in the same statute, broadly: a name together with a Social Security number, a driver licence or ID number, a financial account or card number with any access code, medical information, health insurance details, biometric data or geolocation data. It also covers a username or email address together with a password or security answer that would allow access to an online account. For most businesses, that is the HR folder, the payroll file, the customer database and a good deal of ordinary email.
Florida's statute is the floor. Depending on your sector, other rules sit on top and are often stricter:
HIPAA if you hold health information — medical and dental practices, billing companies, and their business associates.
The FTC Disposal Rule under FACTA if you use consumer reports or credit information, which reaches further than people assume: landlords, employers running background checks, and anyone pulling credit.
GLBA for financial institutions, a category defined broadly enough to include many businesses that do not think of themselves that way.
PCI DSS if you handle card data — a contractual obligation rather than a statute, but one with real teeth through your acquirer.
And if you serve customers outside Florida, their state's law may apply to their data. Most states now have something comparable, and several are stricter.
Florida does not flatly ban computers from commercial waste, but for a business the data is the problem. Florida Statute 501.171(8) requires businesses to take all reasonable measures to dispose of customer records containing personal information so the information is unreadable or undecipherable. A hard drive in a dumpster fails that test. Erase or destroy the drives first and keep a record that it was done.
Section 501.171(8) of the Florida Statutes requires each covered entity or third-party agent to take all reasonable measures to dispose of customer records containing personal information when the records are no longer to be retained. The disposal must involve shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.
No. The statute applies to covered entities and to third-party agents, so hiring a vendor does not remove your obligation to take reasonable measures. In practice this means choosing a vendor carefully, understanding what they do to the drives, and keeping the documentation showing it was done. If the vendor is careless, the exposure is still partly yours.
The statute defines it as a person's first name or initial and last name combined with items such as a Social Security number, a driver licence or ID number, a financial account or payment card number with any required access code, medical information, health insurance information, biometric data or geolocation data. It also covers a username or email address together with a password or security question answer that would permit access to an online account.
Violations of the statute are treated as unfair or deceptive trade practices in actions brought by the Department of Legal Affairs. The specific civil penalties written into the statute attach to failures to give required breach notifications, and run to $1,000 per day for the first 30 days and $50,000 for each subsequent 30-day period, capped at $500,000 for violations continuing more than 180 days. The larger practical risk for most businesses is the breach itself, plus the contractual and reputational consequences.
Send us your asset list and get a clear offer within one business day. Free pickup across South Florida, statewide for larger jobs.