(1) As used in this section, the term “personal identification information” means a person’s social security number, official state-issued or United States-issued driver license or identification number, alien registration number, government passport number, employer or taxpayer identification number, Medicaid or food assistance account number, bank account number, credit or debit card number, and medical records.
(2) It is unlawful for a person to intentionally or knowingly possess, without authorization, the personal identification information of another person in any form, including, but not limited to, mail, physical documents, identification cards, or information stored in digital form.
(3)(a) A person who violates subsection (2) and in doing so possesses the personal identification information of four or fewer persons commits a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083. (b)1. Proof that a person used or was in possession of the personal identification information of five or more individuals, unless satisfactorily explained, gives rise to an inference that the person who used or was in possession of the personal identification information did so knowingly and intentionally without authorization.
2. A person who violates subsection (2) and in doing so possesses the personal identification information of five or more persons commits a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084. (4) Subsection (2) does not apply to:(a) A person who is the parent or legal guardian of a child and who possesses the personal identification information of that child.
(b) A person who is the guardian of another person under chapter 744 and who is authorized to possess the personal identification information of that other person and make decisions regarding access to that personal identification information.
(c) An employee of a governmental agency who possesses the personal identification information of another person in the ordinary course of business.
(d) A person who is engaged in a lawful business and possesses the personal identification information of another person in the ordinary course of business.
(e) A person who finds a card or document issued by a governmental agency that contains the personal identification information of another person and who takes reasonably prompt action to return that card or document to its owner, to the governmental agency that issued the card or document, or to a law enforcement agency.
(5) It is an affirmative defense to an alleged violation of subsection (2) if the person who possesses the personal identification information of another person:(a) Did so under the reasonable belief that such possession was authorized by law or by the consent of the other person; or
(b) Obtained that personal identification information from a forum or resource that is open or available to the general public or from a public record.
(6) This section does not preclude prosecution for the unlawful possession of personal identification information pursuant to s. 817.568 or any other law. 