| 1 | A bill to be entitled |
| 2 | An act relating to a public records exemption; amending s. |
| 3 | 119.071, F.S.; creating an additional general exemption |
| 4 | from requirements governing the inspection and copying of |
| 5 | public records; providing legislative findings; defining |
| 6 | "personal identification information" for purposes of the |
| 7 | act; providing that any portion of a public record held by |
| 8 | an agency that contains personal identification |
| 9 | information of an individual is confidential and exempt |
| 10 | from public records requirements; providing for |
| 11 | retroactive application of the exemption; providing for |
| 12 | nonapplicability; providing for the release of personal |
| 13 | identification information upon specific written |
| 14 | authorization; providing options for limiting or |
| 15 | qualifying the authorized release of such information; |
| 16 | providing exceptions; providing restrictions; providing |
| 17 | for review and repeal; providing a statement of public |
| 18 | necessity; providing an effective date. |
| 19 |
|
| 20 | Be It Enacted by the Legislature of the State of Florida: |
| 21 |
|
| 22 | Section 1. Subsection (6) is added to section 119.071, |
| 23 | Florida Statutes, to read: |
| 24 | 119.071 General exemptions from inspection or copying of |
| 25 | public records.-- |
| 26 | (6) PERSONAL IDENTIFICATION INFORMATION; OPTION TO |
| 27 | RELEASE.-- |
| 28 | (a) The Legislature finds that personal identification |
| 29 | information pertaining to an individual should always remain |
| 30 | private, even when collected legally. The Legislature also finds |
| 31 | that it is in the public interest of the citizens of the state |
| 32 | to protect individuals from misuse of their personal |
| 33 | identification information and from identity theft. The |
| 34 | enactment into law of a requirement that would give individuals |
| 35 | the option of choosing whether or not to have personal |
| 36 | identification information released when requested by a state |
| 37 | agency to supply such information would help to increase |
| 38 | consumer security by giving consumers control over access to |
| 39 | their personal identification information. Such an option should |
| 40 | provide for variable forms of the release of personal |
| 41 | identification information that would allow the consumer to |
| 42 | limit or qualify his or her release to certain types of |
| 43 | information, specify particular agencies that are authorized to |
| 44 | release his or her personal identification information, and |
| 45 | limit a release to either a single release of information or a |
| 46 | continuing release of information, with the authority to |
| 47 | terminate a continuing release of information at the consumer's |
| 48 | discretion. It is the finding of the Legislature that providing |
| 49 | this option would allow individuals to define the extent to |
| 50 | which their personal information is protected. |
| 51 | (b) For purposes of this subsection, the term "personal |
| 52 | identification information" means any name or number that may be |
| 53 | used, either alone or in conjunction with any other information, |
| 54 | to identify an individual, including any: |
| 55 | 1. Name, postal or electronic mail address, telephone |
| 56 | number, social security number, date of birth, mother's maiden |
| 57 | name, official state-issued or federally issued driver's license |
| 58 | or identification number, alien registration number, government |
| 59 | passport number, employer or taxpayer identification number, |
| 60 | Medicaid or food stamp account number, bank account number, |
| 61 | credit or debit card number, or personal identification number |
| 62 | or code assigned to the holder of a debit card by the issuer to |
| 63 | permit authorized electronic use of such card. |
| 64 | 2. Unique biometric data, such as fingerprint, voice |
| 65 | print, retina or iris image, or other unique physical |
| 66 | representation. |
| 67 | 3. Unique electronic identification number, address, or |
| 68 | routing code. |
| 69 | 4. Medical records. |
| 70 | 5. Telecommunication identifying information or access |
| 71 | device. |
| 72 | 6. Other number or information that can be used to access |
| 73 | a person's financial resources. |
| 74 | (c) Any portion of a public record held by an agency that |
| 75 | contains personal identification information of an individual as |
| 76 | defined in paragraph (b) is confidential and exempt from the |
| 77 | provisions of s. 119.07(1) and s. 24(a), Art. I of the State |
| 78 | Constitution. This exemption applies to personal identification |
| 79 | information held by an agency before, on, or after the effective |
| 80 | date of this act. This exemption does not apply to personal |
| 81 | identification information contained in: |
| 82 | 1. A record when the subject of the personal |
| 83 | identification information contained in the record has elected |
| 84 | in writing to authorize the release of his or her personal |
| 85 | identification information for public disclosure. |
| 86 | 2. Records shared between agencies. |
| 87 | 3. Records distributed pursuant to chapter 943. |
| 88 | 4. Official records as defined in s. 28.001. |
| 89 | (d) An individual authorizing the release of information |
| 90 | pursuant to subparagraph (c)1. shall have the option of limiting |
| 91 | or qualifying the release of information so that the release: |
| 92 | 1. Applies only to specific types of information as |
| 93 | identified by the individual. |
| 94 | 2. Authorizes the release of information only to a |
| 95 | specific agency or agencies. |
| 96 | 3. Authorizes a single release of information. |
| 97 | 4. Authorizes multiple releases of information but does |
| 98 | not authorize a continuing release of information. Any |
| 99 | authorization for multiple releases of information may be |
| 100 | rescinded at any time by the person making the authorization. |
| 101 | 5. Authorizes a continuing release of information. Any |
| 102 | authorization for a continuing release of information may be |
| 103 | rescinded at any time by the person making the authorization. |
| 104 | (e)1. Nothing in this subsection shall prevent the release |
| 105 | of specific information related to an individual when the |
| 106 | individual or the individual's natural or legal guardian has |
| 107 | directed an agency to release the specific information to a |
| 108 | specified person. |
| 109 | 2. Nothing in this subsection shall prevent the release by |
| 110 | an agency of personal identification information to a law |
| 111 | enforcement agency or pursuant to a lawful subpoena. |
| 112 | 3. A release executed by an individual under this |
| 113 | subsection may not be assigned or transferred by the person |
| 114 | receiving the release. |
| 115 | 4. A person receiving personal identification information |
| 116 | from an agency pursuant to a release under this subsection may |
| 117 | not share or distribute such personal identification information |
| 118 | with any other person unless the relevant individual authorizes |
| 119 | release of the information to such other person. |
| 120 | (f) This subsection is subject to the Open Government |
| 121 | Sunset Review Act in accordance with s. 119.15 and shall stand |
| 122 | repealed on October 2, 2013, unless reviewed and saved from |
| 123 | repeal through reenactment by the Legislature. |
| 124 | Section 2. The Legislature finds that it is a public |
| 125 | necessity that any portion of a public record held by an agency |
| 126 | that contains personal identification information of an |
| 127 | individual as defined in this act be made confidential and |
| 128 | exempt from public disclosure. The Legislature also finds that |
| 129 | there is no necessity to allow commercial entities access to |
| 130 | such personal identification information held by any agency. |
| 131 | Commercial entities have stated that access to such information |
| 132 | held by a public agency is a necessity for the operation of |
| 133 | their businesses. Commercial entities also have cited a number |
| 134 | of reasons for needing access to personal identification |
| 135 | information held by public agencies. The prevailing needs are |
| 136 | for verification by commercial entities of the accuracy of |
| 137 | personal information received by such entities and for their use |
| 138 | in matching, verifying, or retrieving information. However, a |
| 139 | number of businesses already provide verification and matching |
| 140 | services. A commercial entity seeking to verify a person's |
| 141 | identity may utilize another business providing such services |
| 142 | instead of relying upon state government. In addition, |
| 143 | government records are not the only source of information a |
| 144 | commercial entity can utilize for matching, verifying, or |
| 145 | retrieving information. As such, a commercial entity's |
| 146 | performance will not be hampered if it no longer has access to |
| 147 | personal identification information held by a public agency. In |
| 148 | the recent past, commercial entity databases have been |
| 149 | compromised, in some cases by unauthorized persons gaining |
| 150 | access to computer databases by "hacking" into them and, in |
| 151 | other cases, through the creation of corporate entities that |
| 152 | were created to gain fraudulent access. As a result, the |
| 153 | identities of hundreds of thousands of citizens have been |
| 154 | jeopardized and over 10,000 Florida citizens have had their |
| 155 | identities compromised. Further, personal identification |
| 156 | information is information of a sensitive personal nature and is |
| 157 | often the link to an individual's personal, financial, medical, |
| 158 | or familial records. Access of commercial entities to such |
| 159 | information is likely to lead to misuse of that information. |
| 160 | Such misuse could lead to increased opportunities for fraud and |
| 161 | identity theft. It is the finding of the Legislature that the |
| 162 | harm from disclosing to commercial entities personal |
| 163 | identification information held by an agency outweighs any |
| 164 | public benefit that can be derived from the access of a |
| 165 | commercial entity to such information. However, the Legislature |
| 166 | recognizes that, in limited circumstances, access to personal |
| 167 | identification information in public records may be necessary or |
| 168 | advantageous to the individual or to society, and thus limited |
| 169 | exceptions should be enacted into law whereby the relevant |
| 170 | individual may grant commercial entities limited access to |
| 171 | personal identification information contained in public records. |
| 172 | The Legislature further finds that such limited access satisfies |
| 173 | the need of commercial entities to access personal |
| 174 | identification information in public records. |
| 175 | Section 3. This act shall take effect July 1, 2008. |