Effective Now: Increased Prohibitions on Unauthorized Possession of Personal Identification Information
Under a new Florida law, a person’s use or possession of personal identification information (PII) of five or more individuals gives rise to an inference that the action was intentionally performed knowingly and without authorization, unless the person can provide a satisfactory explanation for the conduct. On October 1, 2013, Florida Statute Section 817.5685, made it a crime to intentionally or knowingly possess, without authorization, the PII of another person in any form (including hard copy or electronic). Prior to this statute, Florida already had a law on the books criminalizing the fraudulent use, or possession with intent to fraudulently use PII concerning an individual without authorization or that individual’s consent, and that law remains effective.
The statute defines PII to include medical records, financial information (including bank account numbers, credit or debit card numbers), and government identification information (including Social Security numbers, driver license numbers, government-issued identification numbers, alien registration numbers, passport numbers, employer or tax identification numbers, and Medicaid or food assistance account numbers).
The statute exempts the following:
(1) "the parent or legal guardian of a child and who possesses the personal identification information of that child";
(2) a guardian of another person for the possession of PII of that other person, if the guardian is authorized to possess the PII and make decisions regarding that PII;
(3) a government agency employee who possesses the PII of another person in the ordinary course of business;
(4) a person engaged in a lawful business and possesses PII of another person in the ordinary course of business; and
(5) a person who finds government-issued documentation containing PII "of another person and who takes reasonably prompt action to return that" document to "its owner, to the governmental agency that issued the card or document, or to a law enforcement agency."
In the early stages of this statute’s effectiveness, it is unclear whether the possession of legally-acquired PII for a temporal period longer than needed by a financial services institution would be considered "the ordinary course of business" or a violation of the new statute.
However, the statute creates two affirmative defenses to alleged violations of the statute for cases where the person possessing the PII of another person (1) "did so under the reasonable belief that such possession was authorized by law or by the consent of the other person," or (2) obtained the PII from a public record, or other "forum or resource that is open or available to the general public."
Violations of the statute are punishable as a first degree misdemeanor, in the case of a person possessing PII of four people or less, and as a third degree felony, in the case of a person possessing the PII of five or more people.
