Florida Senate - 2015 CS for SB 222
By the Committee on Commerce and Tourism; and Senator Hukill
577-01631-15 2015222c1
1 A bill to be entitled
2 An act relating to electronic commerce; providing a
3 directive to the Division of Law Revision and
4 Information; creating the “Computer Abuse and Data
5 Recovery Act”; creating s. 668.801, F.S.; providing a
6 statement of purpose; creating s. 668.802, F.S.;
7 defining terms; creating s. 668.803, F.S.; prohibiting
8 a person from intentionally committing specified acts
9 without authorization with respect to a protected
10 computer; providing penalties for a violation;
11 creating s. 668.804, F.S.; specifying remedies for
12 civil actions brought by persons affected by a
13 violation; providing that specified criminal judgments
14 or decrees against a defendant act as estoppel as to
15 certain matters in specified civil actions; providing
16 that specified civil actions must be filed within
17 certain periods of time; creating s. 668.805, F.S.;
18 providing that the act does not prohibit specified
19 activity by certain state, federal, and foreign law
20 enforcement agencies, regulatory agencies, and
21 political subdivisions; providing an effective date.
22
23 Be It Enacted by the Legislature of the State of Florida:
24
25 Section 1. The Division of Law Revision and Information is
26 directed to create part V of chapter 668, Florida Statutes,
27 consisting of ss. 668.801-668.805, Florida Statutes, to be
28 entitled the “Computer Abuse and Data Recovery Act.”
29 Section 2. Section 668.801, Florida Statutes, is created to
30 read:
31 668.801 Purpose.—This part shall be construed liberally to:
32 (1) Safeguard an owner, operator, or lessee of a protected
33 computer used in the operation of a business from harm or loss
34 caused by unauthorized access to such computer.
35 (2) Safeguard an owner of information stored in a
36 protected computer used in the operation of a business from harm
37 or loss caused by unauthorized access to such computer.
38 Section 3. Section 668.802, Florida Statutes, is created to
39 read:
40 668.802 Definitions.—As used in this part, the term:
41 (1) “Business” means any trade or business regardless of
42 its for-profit or not-for-profit status.
43 (2) “Computer” means an electronic, magnetic, optical,
44 electrochemical, or other high-speed data processing device that
45 performs logical, arithmetic, or storage functions and includes
46 any data storage facility, data storage device, or
47 communications facility directly related to or which operates in
48 conjunction with the device.
49 (3) “Harm” means any impairment to the integrity, access,
50 or availability of data, programs, systems, or information.
51 (4) “Loss” means any of the following:
52 (a) Any reasonable cost incurred by the owner, operator, or
53 lessee of a protected computer or the owner of stored
54 information, including the reasonable cost of conducting a
55 damage assessment for harm associated with the violation and the
56 reasonable cost for remediation efforts, such as restoring the
57 data, programs, systems, or information to the condition it was
58 in before the violation.
59 (b) Economic damages.
60 (c) Lost profits.
61 (d) Consequential damages including the interruption of
62 service.
63 (e) Profits earned by a violator as a result of the
64 violation.
65 (5) “Protected computer” means a computer that is used in
66 connection with the operation of a business and stores
67 information, programs, or code in connection with the operation
68 of the business in which the stored information, programs, or
69 code can only be accessed by employing a technological access
70 barrier.
71 (6) “Technological access barrier” means a password,
72 security code, token, key fob, access device, or similar
73 measure.
74 (7) “Traffic” means to sell, purchase, or deliver.
75 (8) “Without authorization” means circumvention of a
76 technological access barrier on a protected computer without the
77 express or implied permission of the owner, operator, or lessee
78 of the computer or the express or implied permission of the
79 owner of information stored in the protected computer, but the
80 term does not include circumventing a technological measure that
81 does not effectively control access to the protected computer or
82 the information stored in the protected computer.
83 Section 4. Section 668.803, Florida Statutes, is created to
84 read:
85 668.803 Prohibited acts.—A person who knowingly and with
86 intent to cause harm or loss:
87 (1) Obtains information from a protected computer without
88 authorization and, as a result, causes harm or loss;
89 (2) Causes the transmission of a program, code, or command
90 from a protected computer without authorization and, as a result
91 of the transmission, causes harm or loss; or
92 (3) Traffics in any technological access barrier through
93 which access to a protected computer may be obtained without
94 authorization,
95
96 is liable to the extent provided in s. 668.804 in a civil action
97 to the owner, operator, or lessee of the protected computer, or
98 the owner of information stored in the protected computer who
99 uses the information in connection with the operation of a
100 business.
101 Section 5. Section 668.804, Florida Statutes, is created to
102 read:
103 668.804 Remedies.—
104 (1) A person who brings a civil action for a violation
105 under s. 668.803 may:
106 (a) Recover actual damages, including the person’s lost
107 profits and economic damages.
108 (b) Recover the violator’s profits that are not included in
109 the computation of actual damages under paragraph (a).
110 (c) Obtain injunctive or other equitable relief from the
111 court to prevent a future violation of s. 668.803.
112 (d) Recover the misappropriated information, program, or
113 code, and all copies thereof, that are subject to the violation.
114 (2) A court shall award reasonable attorney fees to the
115 prevailing party in any action arising under this part.
116 (3) The remedies available for a violation of s. 668.803
117 are in addition to remedies otherwise available for the same
118 conduct under federal or state law.
119 (4) A final judgment or decree in favor of the state in any
120 criminal proceeding under chapter 815 shall estop the defendant
121 in any subsequent action brought pursuant to s. 668.803 as to
122 all matters as to which the judgment or decree would be an
123 estoppel as if the plaintiff had been a party in the previous
124 criminal action.
125 (5) A civil action filed under s. 668.803 must be commenced
126 within 3 years after the violation occurred or within 3 years
127 after the violation was discovered or should have been
128 discovered with due diligence.
129 Section 6. Section 668.805, Florida Statutes, is created to
130 read:
131 668.805 Exclusions.—This part does not prohibit any
132 lawfully authorized investigative, protective, or intelligence
133 activity of any law enforcement agency, regulatory agency, or
134 political subdivision of this state, any other state, the United
135 States, or any foreign country.
136 Section 7. This act shall take effect October 1, 2015.