Florida Senate - 2014 SB 1526 By Senator Thrasher 6-01034A-14 20141526__ 1 A bill to be entitled 2 An act relating to public records; amending s. 3 501.171, F.S.; providing exemptions from public 4 records requirements for the notice of a data breach 5 and information held by the Department of Legal 6 Affairs pursuant to certain investigations; 7 authorizing disclosure under certain circumstances; 8 providing for future review and repeal of the 9 exemption under the Open Government Sunset Review Act; 10 providing a statement of public necessity; providing a 11 contingent effective date. 12 13 Be It Enacted by the Legislature of the State of Florida: 14 15 Section 1. Subsection (11) is added to section 501.171, 16 Florida Statutes, as created by SB ____, 2014 Regular Session, 17 to read: 18 501.171 Security of confidential personal information.— 19 (11) PUBLIC RECORDS EXEMPTION.— 20 (a) All information received by the department pursuant to 21 notifications required by this section, or received pursuant to 22 a subsequent investigation by the department or another federal 23 or state law enforcement agency, is confidential and exempt from 24 s. 119.07(1) and s. 24(a), Art. I of the State Constitution, so 25 long as the investigation is considered an active investigation. 26 This exemption shall be construed in conformity with s. 27 119.071(2)(c). However, during an active investigation, such 28 information may be disclosed by the department in the 29 furtherance of its official duties and responsibilities; for 30 print, publication, or broadcast if the department determines 31 that such release would assist in notifying the public or 32 locating or identifying a person that the department believes to 33 have been a victim of the breach; or to another governmental 34 agency in the furtherance of its official duties and 35 responsibilities. 36 (b) Notwithstanding subsection (a), the following 37 information received by the department shall remain confidential 38 and exempt from s. 119.07(1) and s. 24(a), Art. I of the State 39 Constitution after completion of an investigation: 40 1. All information to which another public records 41 exemption applies. 42 2. Personal information as such term is defined in this 43 section. 44 3. A computer forensic report. 45 4. Information that would otherwise reveal weaknesses in a 46 covered entity’s data security. 47 5. Information that would disclose a covered entity’s trade 48 secrets or proprietary information. 49 Section 2. The Legislature finds that it is a public 50 necessity that information held by the Department of Legal 51 Affairs pursuant to an investigation of a violation of s. 52 501.171, Florida Statutes, relating to information security, be 53 confidential and exempt from public records requirements for the 54 following reasons: 55 (1) A data breach is likely the result of criminal activity 56 that will likely lead to further criminal activity. Notices 57 provided to the department and materials obtained during 58 investigations of a violation of s. 501.171, Florida Statutes, 59 are likely to contain proprietary information about the security 60 of the breached system. The release of the proprietary 61 information could result in the identification of 62 vulnerabilities and further breaches of that system. This 63 exemption protects the security of the breached systems, thus 64 protecting the personal information of Floridians stored within 65 the systems. 66 (2) Notices provided to the Department of Legal Affairs and 67 materials obtained during investigations of a violation of s. 68 501.171, Florida Statutes, may contain personal information that 69 could be used for the purpose of identity theft or some other 70 financial harm. The release of this information by the 71 department in response to a public records request could be just 72 as problematic as the breach or improper disposal of customer 73 records. This exemption protects the security of the personal 74 information by excluding it from public records requirements. 75 Section 3. This act shall take effect on the same date that 76 SB ___ or similar legislation takes effect, if such legislation 77 is adopted in the same legislative session or an extension 78 thereof and becomes a law.