HB 759

A bill to be entitled
2An act relating to a public records exemption; amending s.
3119.071, F.S.; creating an additional general exemption
4from requirements governing the inspection and copying of
5public records; providing legislative findings; defining
6"personal identification information" for purposes of the
7act; providing that any portion of a public record held by
8an agency that contains personal identification
9information of an individual is confidential and exempt
10from public records requirements; providing for
11retroactive application of the exemption; providing for
12nonapplicability; providing for the release of personal
13identification information upon specific written
14authorization; providing options for limiting or
15qualifying the authorized release of such information;
16providing exceptions; providing restrictions; providing
17for review and repeal; providing a statement of public
18necessity; providing an effective date.
20Be It Enacted by the Legislature of the State of Florida:
22     Section 1.  Subsection (6) is added to section 119.071,
23Florida Statutes, to read:
24     119.071  General exemptions from inspection or copying of
25public records.--
28     (a)  The Legislature finds that personal identification
29information pertaining to an individual should always remain
30private, even when collected legally. The Legislature also finds
31that it is in the public interest of the citizens of the state
32to protect individuals from misuse of their personal
33identification information and from identity theft. The
34enactment into law of a requirement that would give individuals
35the option of choosing whether or not to have personal
36identification information released when requested by a state
37agency to supply such information would help to increase
38consumer security by giving consumers control over access to
39their personal identification information. Such an option should
40provide for variable forms of the release of personal
41identification information that would allow the consumer to
42limit or qualify his or her release to certain types of
43information, specify particular agencies that are authorized to
44release his or her personal identification information, and
45limit a release to either a single release of information or a
46continuing release of information, with the authority to
47terminate a continuing release of information at the consumer's
48discretion. It is the finding of the Legislature that providing
49this option would allow individuals to define the extent to
50which their personal information is protected.
51     (b)  For purposes of this subsection, the term "personal
52identification information" means any name or number that may be
53used, either alone or in conjunction with any other information,
54to identify an individual, including any:
55     1.  Name, postal or electronic mail address, telephone
56number, social security number, date of birth, mother's maiden
57name, official state-issued or federally issued driver's license
58or identification number, alien registration number, government
59passport number, employer or taxpayer identification number,
60Medicaid or food stamp account number, bank account number,
61credit or debit card number, or personal identification number
62or code assigned to the holder of a debit card by the issuer to
63permit authorized electronic use of such card.
64     2.  Unique biometric data, such as fingerprint, voice
65print, retina or iris image, or other unique physical
67     3.  Unique electronic identification number, address, or
68routing code.
69     4.  Medical records.
70     5.  Telecommunication identifying information or access
72     6.  Other number or information that can be used to access
73a person's financial resources.
74     (c)  Any portion of a public record held by an agency that
75contains personal identification information of an individual as
76defined in paragraph (b) is confidential and exempt from the
77provisions of s. 119.07(1) and s. 24(a), Art. I of the State
78Constitution. This exemption applies to personal identification
79information held by an agency before, on, or after the effective
80date of this act. This exemption does not apply to personal
81identification information contained in:
82     1.  A record when the subject of the personal
83identification information contained in the record has elected
84in writing to authorize the release of his or her personal
85identification information for public disclosure.
86     2.  Records shared between agencies.
87     3.  Records distributed pursuant to chapter 943.
88     4.  Official records as defined in s. 28.001.
89     (d)  An individual authorizing the release of information
90pursuant to subparagraph (c)1. shall have the option of limiting
91or qualifying the release of information so that the release:
92     1.  Applies only to specific types of information as
93identified by the individual.
94     2.  Authorizes the release of information only to a
95specific agency or agencies.
96     3.  Authorizes a single release of information.
97     4.  Authorizes multiple releases of information but does
98not authorize a continuing release of information. Any
99authorization for multiple releases of information may be
100rescinded at any time by the person making the authorization.
101     5.  Authorizes a continuing release of information. Any
102authorization for a continuing release of information may be
103rescinded at any time by the person making the authorization.
104     (e)1.  Nothing in this subsection shall prevent the release
105of specific information related to an individual when the
106individual or the individual's natural or legal guardian has
107directed an agency to release the specific information to a
108specified person.
109     2.  Nothing in this subsection shall prevent the release by
110an agency of personal identification information to a law
111enforcement agency or pursuant to a lawful subpoena.
112     3.  A release executed by an individual under this
113subsection may not be assigned or transferred by the person
114receiving the release.
115     4.  A person receiving personal identification information
116from an agency pursuant to a release under this subsection may
117not share or distribute such personal identification information
118with any other person unless the relevant individual authorizes
119release of the information to such other person.
120     (f)  This subsection is subject to the Open Government
121Sunset Review Act in accordance with s. 119.15 and shall stand
122repealed on October 2, 2013, unless reviewed and saved from
123repeal through reenactment by the Legislature.
124     Section 2.  The Legislature finds that it is a public
125necessity that any portion of a public record held by an agency
126that contains personal identification information of an
127individual as defined in this act be made confidential and
128exempt from public disclosure. The Legislature also finds that
129there is no necessity to allow commercial entities access to
130such personal identification information held by any agency.
131Commercial entities have stated that access to such information
132held by a public agency is a necessity for the operation of
133their businesses. Commercial entities also have cited a number
134of reasons for needing access to personal identification
135information held by public agencies. The prevailing needs are
136for verification by commercial entities of the accuracy of
137personal information received by such entities and for their use
138in matching, verifying, or retrieving information. However, a
139number of businesses already provide verification and matching
140services. A commercial entity seeking to verify a person's
141identity may utilize another business providing such services
142instead of relying upon state government. In addition,
143government records are not the only source of information a
144commercial entity can utilize for matching, verifying, or
145retrieving information. As such, a commercial entity's
146performance will not be hampered if it no longer has access to
147personal identification information held by a public agency. In
148the recent past, commercial entity databases have been
149compromised, in some cases by unauthorized persons gaining
150access to computer databases by "hacking" into them and, in
151other cases, through the creation of corporate entities that
152were created to gain fraudulent access. As a result, the
153identities of hundreds of thousands of citizens have been
154jeopardized and over 10,000 Florida citizens have had their
155identities compromised. Further, personal identification
156information is information of a sensitive personal nature and is
157often the link to an individual's personal, financial, medical,
158or familial records. Access of commercial entities to such
159information is likely to lead to misuse of that information.
160Such misuse could lead to increased opportunities for fraud and
161identity theft. It is the finding of the Legislature that the
162harm from disclosing to commercial entities personal
163identification information held by an agency outweighs any
164public benefit that can be derived from the access of a
165commercial entity to such information. However, the Legislature
166recognizes that, in limited circumstances, access to personal
167identification information in public records may be necessary or
168advantageous to the individual or to society, and thus limited
169exceptions should be enacted into law whereby the relevant
170individual may grant commercial entities limited access to
171personal identification information contained in public records.
172The Legislature further finds that such limited access satisfies
173the need of commercial entities to access personal
174identification information in public records.
175     Section 3.  This act shall take effect July 1, 2008.

CODING: Words stricken are deletions; words underlined are additions.