Compliance Program Charter - Florida

COMPLIANCE PROGRAM CHARTER — FLORIDA SUPPLEMENT

Company: [________________________________]
Effective Date: [__/__/____]
Approved by: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Purpose and Authorization
2. Florida Regulatory Landscape
3. Scope — Florida Compliance Domains
4. Governance Enhancements
5. Core Program Elements — Florida Focus
6. Florida Regulatory Change Management
7. Florida-Specific Reporting and Metrics
8. Resources
9. Review and Approval
10. Annexes

1. PURPOSE AND AUTHORIZATION

This supplement addresses Florida-specific regulatory requirements including the Florida Information Protection Act (FIPA), the Florida Digital Bill of Rights (FDBR, effective July 1, 2024), the Florida Deceptive and Unfair Trade Practices Act (FDUTPA), and the Florida Civil Rights Act (FCRA).

2. FLORIDA REGULATORY LANDSCAPE

3. SCOPE — FLORIDA COMPLIANCE DOMAINS

3.1 Privacy and Data Security

☐ FIPA compliance: reasonable security measures (§ 501.171(2)); Department notice for 500 or more affected Florida individuals (§ 501.171(3)); affected-individual notice (§ 501.171(4)); third-party-agent notice (§ 501.171(6))
☐ FDBR compliance (if applicable): consumer rights, sensitive data consent, data protection assessments, universal opt-out mechanisms, processor obligations
☐ FDBR applicability analysis: >$1B global revenue + data processing thresholds

3.2 Consumer Protection

☐ FDUTPA (§ 501.201): prohibition of unfair or deceptive acts or practices
☐ Marketing and advertising review for FDUTPA compliance
☐ Price transparency and disclosure requirements

3.3 Employment

☐ FCRA (§ 760.01): discrimination and harassment protections
☐ Florida minimum wage compliance (current constitutional schedule and annual official notice)
☐ Florida Workers' Compensation (Ch. 440)
☐ E-Verify requirements for public employers, contractors, and private employers with 25 or more employees (§ 448.095)

3.4 Sector-Specific

☐ Financial services: OFR regulatory requirements (if applicable)
☐ Healthcare: AHCA requirements, Patient's Bill of Rights
☐ Insurance: OIR regulatory requirements

4. GOVERNANCE ENHANCEMENTS

5. CORE PROGRAM ELEMENTS — FLORIDA FOCUS

5.1 Risk Assessment — FL Additions

5.2 Policies — FL-Specific

☐ FIPA breach notification procedures (30-day timeline)
☐ FDBR privacy notice and consumer rights procedures (if applicable)
☐ FDUTPA marketing/advertising review procedures
☐ FCRA anti-discrimination policy
☐ Florida-specific data retention and disposal policy

5.3 Training — FL-Specific

5.4 Monitoring and Testing — FL Additions

☐ FIPA reasonable security measures verification
☐ Breach notification tabletop exercise (30-day timeline)
☐ FDBR consumer rights request handling (if applicable)
☐ FDUTPA marketing review
☐ FCRA complaint tracking and analysis

5.5 Third-Party Risk — FL Additions

☐ Vendor FIPA compliance verification
☐ FDBR processor agreements (if applicable)
☐ Vendor breach notification SLA alignment with 30-day timeline
☐ Data protection assessment support for high-risk vendor processing

6. FLORIDA REGULATORY CHANGE MANAGEMENT

7. FLORIDA-SPECIFIC REPORTING AND METRICS

8. RESOURCES

☐ Privacy/data security resources for FIPA/FDBR
☐ Consumer protection review for FDUTPA
☐ Employment counsel for FCRA
☐ External FL regulatory counsel

9. REVIEW AND APPROVAL

Review annually or upon material Florida regulatory change.

10. ANNEXES

Annex A: FIPA Breach Notification Checklist

☐ Breach determination made (date: [__/__/____])
☐ Role-specific 30-day Department and affected-individual clocks calendared (Fla. Stat. § 501.171(3)-(4))
☐ Affected individuals identified by Florida residency
☐ Notification content prepared per § 501.171(4)(e):

• Date or estimated date of breach
• Description of personal information compromised

• Contact information for the entity providing notice
  ☐ If 500 or more Florida individuals are affected: FL Dept. of Legal Affairs notified (§ 501.171(3))
  ☐ If >1,000 FL residents: consumer reporting agencies notified (§ 501.171(5))
  ☐ Substitute notice procedures (if direct notice not feasible) (§ 501.171(4)(f)):

• Email notice (if email address available)

• Conspicuous posting on entity's website
• Notification to statewide media
  ☐ Records retained for AG inspection
  ☐ Third-party vendors notified of breach responsibilities
  ☐ Documentation of all notification efforts and timelines preserved

Annex B: FDBR Consumer Rights Compliance Checklist

☐ Privacy notice updated to include FDBR disclosures (if applicable)
☐ Consumer rights request intake mechanism operational
☐ Processes for the following rights verified:

• Right to confirm processing and access personal data
• Right to correct inaccurate personal data
• Right to delete personal data
• Right to obtain copy in portable format
• Right to opt out of targeted advertising
• Right to opt out of sale of personal data
• Right to opt out of profiling for decisions with legal/significant effects
  ☐ Response timeline: 45 days (one additional 15-day extension when § 501.706 permits it)
  ☐ Two or more secure, reliable, conspicuous request methods maintained (§ 501.709)
  ☐ Sensitive data consent mechanisms in place (§ 501.71(2)(d)); sensitive-data sale gate separately checked (§ 501.715)
  ☐ Data protection assessments completed for covered processing (§ 501.713)
  ☐ Vendor/processor agreements updated with FDBR terms

Annex C: FDUTPA Compliance Checklist

☐ Marketing materials reviewed for deceptive or unfair claims
☐ Pricing disclosures accurate and complete
☐ Product/service descriptions truthful and substantiated
☐ Refund and return policies clearly disclosed
☐ Advertising claims supported by documentation
☐ Customer complaint tracking for FDUTPA-related issues operational

Annex D: Florida Regulatory Calendar

SOURCES AND REFERENCES

• FIPA, Fla. Stat. § 501.171
• FDBR, Fla. Stat. § 501.701 et seq. (eff. July 1, 2024)
• FDUTPA, Fla. Stat. § 501.201 et seq.
• FCRA, Fla. Stat. § 760.01 et seq.
• DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
• U.S. Sentencing Guidelines § 8B2.1

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.