Bill > H1183

This bill creates a new section of Florida law that addresses liability for cybersecurity incidents, establishing protections for counties, municipalities, political subdivisions, covered entities, and third-party agents. The bill defines key terms such as "covered entity" (which includes various types of commercial entities) and "cybersecurity standards or frameworks" (referencing multiple established security frameworks like NIST and ISO standards). It provides a liability shield for organizations that implement comprehensive cybersecurity measures, including specific policies, multi-factor authentication, and disaster recovery plans. Entities can obtain a presumption against liability in class action lawsuits by substantially complying with existing cybersecurity regulations or implementing approved security frameworks. The bill requires organizations to update their cybersecurity programs within one year of any relevant framework or regulatory revisions to maintain liability protection. Importantly, the bill does not create a private right of action, meaning individuals cannot sue directly under this law. If a civil action is filed, the fact that an organization could have obtained liability protection cannot be used as evidence of negligence. In such actions, the defendant bears the burden of proving substantial compliance with the bill's requirements. The law applies retroactively to class action lawsuits filed before, on, or after its effective date.

Budget and Finance, Government Affairs, Justice

Civil Justice & Claims Subcommittee (H), Information Technology Budget & Policy Subcommittee (H)

https://www.flsenate.gov/Session/Bill/2025/1183