Florida Statutes Title XXXIII. Regulation of Trade, Commerce, Investments, and Solicitations § 501.719. Processing of certain personal data by controller or other person

(1) Personal data processed by a controller pursuant to ss. 501.716-501.718 may not be processed for any purpose other than those specified in those sections. Personal data processed by a controller pursuant to ss. 501.716-501.718 may be processed to the extent that the processing of the data is:

(2) A controller or processor that collects, uses, or retains personal data for the purposes specified in s. 501.717(1) must take into account the nature and purpose of such collection, use, or retention. Such personal data is subject to reasonable administrative, technical, and physical measures to protect its confidentiality, integrity, and accessibility and to reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal data.

(3) A controller or processor shall adopt and implement a retention schedule that prohibits the use or retention of personal data not subject to an exemption by the controller or processor after the satisfaction of the initial purpose for which such information was collected or obtained, after the expiration or termination of the contract pursuant to which the information was collected or obtained, or 2 years after the consumer's last interaction with the controller or processor. This subsection does not apply to personal data reasonably used or retained to do any of the following:

(4) A controller or processor that processes personal data pursuant to ss. 501.716-501.718 bears the burden of demonstrating that the processing of the personal data qualifies for the exemption and complies with the requirements of this section.