Florida Senate - 2015                              CS for SB 222
       
       
        
       By the Committee on Commerce and Tourism; and Senator Hukill
       
       
       
       
       
       577-01631-15                                           2015222c1
    1                        A bill to be entitled                      
    2         An act relating to electronic commerce; providing a
    3         directive to the Division of Law Revision and
    4         Information; creating the “Computer Abuse and Data
    5         Recovery Act”; creating s. 668.801, F.S.; providing a
    6         statement of purpose; creating s. 668.802, F.S.;
    7         defining terms; creating s. 668.803, F.S.; prohibiting
    8         a person from intentionally committing specified acts
    9         without authorization with respect to a protected
   10         computer; providing penalties for a violation;
   11         creating s. 668.804, F.S.; specifying remedies for
   12         civil actions brought by persons affected by a
   13         violation; providing that specified criminal judgments
   14         or decrees against a defendant act as estoppel as to
   15         certain matters in specified civil actions; providing
   16         that specified civil actions must be filed within
   17         certain periods of time; creating s. 668.805, F.S.;
   18         providing that the act does not prohibit specified
   19         activity by certain state, federal, and foreign law
   20         enforcement agencies, regulatory agencies, and
   21         political subdivisions; providing an effective date.
   22          
   23  Be It Enacted by the Legislature of the State of Florida:
   24  
   25         Section 1. The Division of Law Revision and Information is
   26  directed to create part V of chapter 668, Florida Statutes,
   27  consisting of ss. 668.801-668.805, Florida Statutes, to be
   28  entitled the “Computer Abuse and Data Recovery Act.”
   29         Section 2. Section 668.801, Florida Statutes, is created to
   30  read:
   31         668.801Purpose.—This part shall be construed liberally to:
   32         (1) Safeguard an owner, operator, or lessee of a protected
   33  computer used in the operation of a business from harm or loss
   34  caused by unauthorized access to such computer.
   35         (2) Safeguard an owner of information stored in a
   36  protected computer used in the operation of a business from harm
   37  or loss caused by unauthorized access to such computer.
   38         Section 3. Section 668.802, Florida Statutes, is created to
   39  read:
   40         668.802Definitions.—As used in this part, the term:
   41         (1)“Business” means any trade or business regardless of
   42  its for-profit or not-for-profit status.
   43         (2)“Computer” means an electronic, magnetic, optical,
   44  electrochemical, or other high-speed data processing device that
   45  performs logical, arithmetic, or storage functions and includes
   46  any data storage facility, data storage device, or
   47  communications facility directly related to or which operates in
   48  conjunction with the device.
   49         (3)“Harm” means any impairment to the integrity, access,
   50  or availability of data, programs, systems, or information.
   51         (4)“Loss” means any of the following:
   52         (a)Any reasonable cost incurred by the owner, operator, or
   53  lessee of a protected computer or the owner of stored
   54  information, including the reasonable cost of conducting a
   55  damage assessment for harm associated with the violation and the
   56  reasonable cost for remediation efforts, such as restoring the
   57  data, programs, systems, or information to the condition it was
   58  in before the violation.
   59         (b)Economic damages.
   60         (c)Lost profits.
   61         (d)Consequential damages including the interruption of
   62  service.
   63         (e)Profits earned by a violator as a result of the
   64  violation.
   65         (5)“Protected computer” means a computer that is used in
   66  connection with the operation of a business and stores
   67  information, programs, or code in connection with the operation
   68  of the business in which the stored information, programs, or
   69  code can only be accessed by employing a technological access
   70  barrier.
   71         (6) “Technological access barrier” means a password,
   72  security code, token, key fob, access device, or similar
   73  measure.
   74         (7)“Traffic” means to sell, purchase, or deliver.
   75         (8)“Without authorization” means circumvention of a
   76  technological access barrier on a protected computer without the
   77  express or implied permission of the owner, operator, or lessee
   78  of the computer or the express or implied permission of the
   79  owner of information stored in the protected computer, but the
   80  term does not include circumventing a technological measure that
   81  does not effectively control access to the protected computer or
   82  the information stored in the protected computer.
   83         Section 4. Section 668.803, Florida Statutes, is created to
   84  read:
   85         668.803 Prohibited acts.—A person who knowingly and with
   86  intent to cause harm or loss:
   87         (1) Obtains information from a protected computer without
   88  authorization and, as a result, causes harm or loss;
   89         (2)Causes the transmission of a program, code, or command
   90  from a protected computer without authorization and, as a result
   91  of the transmission, causes harm or loss; or
   92         (3)Traffics in any technological access barrier through
   93  which access to a protected computer may be obtained without
   94  authorization,
   95  
   96  is liable to the extent provided in s. 668.804 in a civil action
   97  to the owner, operator, or lessee of the protected computer, or
   98  the owner of information stored in the protected computer who
   99  uses the information in connection with the operation of a
  100  business.
  101         Section 5. Section 668.804, Florida Statutes, is created to
  102  read:
  103         668.804 Remedies.
  104         (1) A person who brings a civil action for a violation
  105  under s. 668.803 may:
  106         (a)Recover actual damages, including the person’s lost
  107  profits and economic damages.
  108         (b) Recover the violator’s profits that are not included in
  109  the computation of actual damages under paragraph (a).
  110         (c)Obtain injunctive or other equitable relief from the
  111  court to prevent a future violation of s. 668.803.
  112         (d)Recover the misappropriated information, program, or
  113  code, and all copies thereof, that are subject to the violation.
  114         (2) A court shall award reasonable attorney fees to the
  115  prevailing party in any action arising under this part.
  116         (3) The remedies available for a violation of s. 668.803
  117  are in addition to remedies otherwise available for the same
  118  conduct under federal or state law.
  119         (4) A final judgment or decree in favor of the state in any
  120  criminal proceeding under chapter 815 shall estop the defendant
  121  in any subsequent action brought pursuant to s. 668.803 as to
  122  all matters as to which the judgment or decree would be an
  123  estoppel as if the plaintiff had been a party in the previous
  124  criminal action.
  125         (5) A civil action filed under s. 668.803 must be commenced
  126  within 3 years after the violation occurred or within 3 years
  127  after the violation was discovered or should have been
  128  discovered with due diligence.
  129         Section 6. Section 668.805, Florida Statutes, is created to
  130  read:
  131         668.805 Exclusions.—This part does not prohibit any
  132  lawfully authorized investigative, protective, or intelligence
  133  activity of any law enforcement agency, regulatory agency, or
  134  political subdivision of this state, any other state, the United
  135  States, or any foreign country.
  136         Section 7. This act shall take effect October 1, 2015.