ENROLLED
2023 Legislature CS for CS for SB 1648, 1st Engrossed
20231648er
1
2 An act relating to public records; amending ss.
3 501.1735 and 501.722, F.S.; providing exemptions from
4 public records requirements for information relating
5 to investigations by the Department of Legal Affairs
6 and law enforcement agencies of certain data privacy
7 violations; providing for future legislative review
8 and repeal of the exemptions; providing statements of
9 public necessity; providing a contingent effective
10 date.
11
12 Be It Enacted by the Legislature of the State of Florida:
13
14 Section 1. Subsection (6) is added to section 501.1735,
15 Florida Statutes, as created by SB 262 or similar legislation,
16 2023 Regular Session, to read:
17 501.1735 Protection of children in online spaces.—
18 (6) PUBLIC RECORDS EXEMPTION.—
19 (a) All information received by the department pursuant to
20 a notification of a violation under this section, or received by
21 the department pursuant to an investigation by the department or
22 a law enforcement agency of a violation of this section, is
23 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
24 of the State Constitution, until such time as the investigation
25 is completed or ceases to be active. This exemption shall be
26 construed in conformity with s. 119.071(2)(c).
27 (b) During an active investigation, information made
28 confidential and exempt pursuant to paragraph (a) may be
29 disclosed by the department:
30 1. In the furtherance of its official duties and
31 responsibilities;
32 2. For print, publication, or broadcast if the department
33 determines that such release would assist in notifying the
34 public or locating or identifying a person that the department
35 believes to be a victim of a data breach or an improper use or
36 disposal of customer records, except that information made
37 confidential and exempt by paragraph (c) may not be released
38 pursuant to this subparagraph; or
39 3. To another governmental entity in the furtherance of its
40 official duties and responsibilities.
41 (c) Upon completion of an investigation or once an
42 investigation ceases to be active, the following information
43 received by the department shall remain confidential and exempt
44 from s. 119.07(1) and s. 24(a), Art. I of the State
45 Constitution:
46 1. All information to which another public records
47 exemption applies.
48 2. Personal information.
49 3. A computer forensic report.
50 4. Information that would otherwise reveal weaknesses in
51 the data security of an online platform.
52 5. Information that would disclose the proprietary
53 information of an online platform.
54 (d) For purposes of this section, the term “proprietary
55 information” means information that:
56 1. Is owned or controlled by the online platform.
57 2. Is intended to be private and is treated by the online
58 platform as private because disclosure would harm the online
59 platform or its business operations.
60 3. Has not been disclosed except as required by law or a
61 private agreement that provides that the information will not be
62 released to the public.
63 4. Is not publicly available or otherwise readily
64 ascertainable through proper means from another source in the
65 same configuration as received by the department.
66 5. Includes:
67 a. Trade secrets as defined in s. 688.002.
68 b. Competitive interests, the disclosure of which would
69 impair the competitive advantage of the online platform who is
70 the subject of the information.
71 (e) This section is subject to the Open Government Sunset
72 Review Act in accordance with s. 119.15 and shall stand repealed
73 on October 2, 2028, unless reviewed and saved from repeal
74 through reenactment by the Legislature.
75 Section 2. The Legislature finds that it is a public
76 necessity that all information received by the Department of
77 Legal Affairs pursuant to a notification of a violation of s.
78 501.1735, Florida Statutes, or received by the department
79 pursuant to an investigation by the department or a law
80 enforcement agency of a violation of that section, be made
81 confidential and exempt from s. 119.07(1), Florida Statutes, and
82 s. 24(a), Article I of the State Constitution for the following
83 reasons:
84 (1) A notification of a violation of s. 501.1735, Florida
85 Statutes, may result in an investigation of such violation. The
86 premature release of such information could frustrate or thwart
87 the investigation and impair the ability of the department to
88 effectively and efficiently administer s. 501.1735, Florida
89 Statutes. In addition, release of such information before
90 completion of an active investigation could jeopardize the
91 ongoing investigation.
92 (2) Release of information to which another public records
93 exemption applies once an investigation is completed or ceases
94 to be active would undo the specific statutory exemption
95 protecting that information.
96 (3) An investigation of a violation of s. 501.1735, Florida
97 Statutes, is likely to result in the gathering of sensitive
98 personal information, including identification numbers, unique
99 identifiers, professional or employment-related information, and
100 personal financial information. Such information could be used
101 for the purpose of identity theft. The release of such
102 information could subject possible victims of data privacy
103 violations to further harm.
104 (4) Notices received by the department and information
105 received during an investigation of a violation of s. 501.1735,
106 Florida Statutes, are likely to contain proprietary information.
107 Such information, including trade secrets, derives independent,
108 economic value, actual or potential, from being generally
109 unknown to, and not readily ascertainable by, other persons who
110 might obtain economic value from its disclosure or use. Allowing
111 public access to proprietary information, including a trade
112 secret, through a public records request could destroy the value
113 of the proprietary information and cause a financial loss to the
114 online platform. Release of such information could give business
115 competitors an unfair advantage.
116 (5) Information received by the department may contain a
117 computer forensic report or information that could reveal
118 weaknesses in the data security of an online platform. The
119 release of this information could result in the identification
120 of vulnerabilities in the cybersecurity system of the online
121 platform and be used to harm the online platform and clients.
122 (6) The harm that may result from the release of
123 information received by the department pursuant to a
124 notification or investigation by the department or a law
125 enforcement agency of a violation of s. 501.1735, Florida
126 Statutes, could impair the effective and efficient
127 administration of the investigation and thus, outweighs the
128 public benefit that may be derived from the disclosure of the
129 information.
130 Section 3. Section 501.722, Florida Statutes, is created
131 and incorporated into part V of chapter 501, Florida Statutes,
132 as created by SB 262 or similar legislation, 2023 Regular
133 Session, to read:
134 501.722 Public records exemption.—
135 (1) All information received by the department pursuant to
136 a notification of a violation under this part, or received by
137 the department pursuant to an investigation by the department or
138 a law enforcement agency of a violation of this part, is
139 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
140 of the State Constitution, until such time as the investigation
141 is completed or ceases to be active. This exemption shall be
142 construed in conformity with s. 119.071(2)(c).
143 (2) During an active investigation, information made
144 confidential and exempt pursuant to subsection (1) may be
145 disclosed by the department:
146 (a) In the furtherance of its official duties and
147 responsibilities;
148 (b) For print, publication, or broadcast if the department
149 determines that such release would assist in notifying the
150 public or locating or identifying a person that the department
151 believes to be a victim of a data breach or an improper use or
152 disposal of customer records, except that information made
153 confidential and exempt by subsection (3) may not be released
154 pursuant to this paragraph; or
155 (c) To another governmental entity in the furtherance of
156 its official duties and responsibilities.
157 (3) Upon completion of an investigation or once an
158 investigation ceases to be active, the following information
159 received by the department shall remain confidential and exempt
160 from s. 119.07(1) and s. 24(a), Art. I of the State
161 Constitution:
162 (a) All information to which another public records
163 exemption applies.
164 (b) Personal information.
165 (c) A computer forensic report.
166 (d) Information that would otherwise reveal weaknesses in
167 the data security of a controller, processor, or third party.
168 (e) Information that would disclose the proprietary
169 information of a controller, processor, or third party.
170 (4) For purposes of this section, the term “proprietary
171 information” means information that:
172 (a) Is owned or controlled by the controller, processor, or
173 third party.
174 (b) Is intended to be private and is treated by the
175 controller, processor, or third party as private because
176 disclosure would harm the controller, processor, or third party
177 or its business operations.
178 (c) Has not been disclosed except as required by law or a
179 private agreement that provides that the information will not be
180 released to the public.
181 (d) Is not publicly available or otherwise readily
182 ascertainable through proper means from another source in the
183 same configuration as received by the department.
184 (e) Includes:
185 1. Trade secrets as defined in s. 688.002.
186 2. Competitive interests, the disclosure of which would
187 impair the competitive advantage of the controller, processor,
188 or third party who is the subject of the information.
189 (5) This section is subject to the Open Government Sunset
190 Review Act in accordance with s. 119.15 and shall stand repealed
191 on October 2, 2028, unless reviewed and saved from repeal
192 through reenactment by the Legislature.
193 Section 4. The Legislature finds that it is a public
194 necessity that all information received by the Department of
195 Legal Affairs pursuant to a notification of a violation of part
196 V of chapter 501, Florida Statutes, or received by the
197 department pursuant to an investigation by the department or a
198 law enforcement agency of a violation of that part, be made
199 confidential and exempt from s. 119.07(1), Florida Statutes, and
200 s. 24(a), Article I of the State Constitution for the following
201 reasons:
202 (1) A notification of a violation of part V of chapter 501,
203 Florida Statutes, may result in an investigation of such
204 violation. The premature release of such information could
205 frustrate or thwart the investigation and impair the ability of
206 the department to effectively and efficiently administer part V
207 of chapter 501, Florida Statutes. In addition, release of such
208 information before completion of an active investigation could
209 jeopardize the ongoing investigation.
210 (2) Release of information to which another public records
211 exemption applies once an investigation is completed or ceases
212 to be active would undo the specific statutory exemption
213 protecting that information.
214 (3) An investigation of a violation of part V of chapter
215 501, Florida Statutes, is likely to result in the gathering of
216 sensitive personal information, including identification
217 numbers, unique identifiers, professional or employment-related
218 information, and personal financial information. Such
219 information could be used for the purpose of identity theft. The
220 release of such information could subject possible victims of
221 data privacy violations to further harm.
222 (4) Notices received by the department and information
223 received during an investigation of a violation of part V of
224 chapter 501, Florida Statutes, are likely to contain proprietary
225 information. Such information, including trade secrets, derives
226 independent, economic value, actual or potential, from being
227 generally unknown to, and not readily ascertainable by, other
228 persons who might obtain economic value from its disclosure or
229 use. Allowing public access to proprietary information,
230 including a trade secret, through a public records request could
231 destroy the value of the proprietary information and cause a
232 financial loss to the controller, processor, or third party.
233 Release of such information could give business competitors an
234 unfair advantage.
235 (5) Information received by the department may contain a
236 computer forensic report or information that could reveal
237 weaknesses in the data security of a controller, processor, or
238 third party. The release of this information could result in the
239 identification of vulnerabilities in the cybersecurity system of
240 the controller, processor, or third party and be used to harm
241 the controller, processor, or third party and clients.
242 (6) The harm that may result from the release of
243 information received by the department pursuant to a
244 notification or investigation by the department or a law
245 enforcement agency of a violation of part V of chapter 501,
246 Florida Statutes, could impair the effective and efficient
247 administration of the investigation and thus, outweighs the
248 public benefit that may be derived from the disclosure of the
249 information.
250 Section 5. This act shall take effect on the same date that
251 SB 262 or similar legislation takes effect, if such legislation
252 is adopted in the same legislative session or an extension
253 thereof and becomes a law.