Florida Senate - 2015 CS for CS for SB 222
By the Committees on Communications, Energy, and Public
Utilities; and Commerce and Tourism; and Senator Hukill
579-02142-15 2015222c2
1 A bill to be entitled
2 An act relating to electronic commerce; providing a
3 directive to the Division of Law Revision and
4 Information; creating the “Computer Abuse and Data
5 Recovery Act”; creating s. 668.801, F.S.; providing a
6 statement of purpose; creating s. 668.802, F.S.;
7 defining terms; creating s. 668.803, F.S.; prohibiting
8 a person from intentionally committing specified acts
9 without authorization with respect to a protected
10 computer; providing penalties for a violation;
11 creating s. 668.804, F.S.; specifying remedies for
12 civil actions brought by persons affected by a
13 violation; providing that specified criminal judgments
14 or decrees against a defendant act as estoppel as to
15 certain matters in specified civil actions; providing
16 that specified civil actions must be filed within
17 certain periods of time; creating s. 668.805, F.S.;
18 providing that the act does not prohibit specified
19 activity by certain state, federal, and foreign law
20 enforcement agencies, regulatory agencies, and
21 political subdivisions; providing that the act does
22 not impose liability on specified providers in certain
23 circumstances; providing an effective date.
24
25 Be It Enacted by the Legislature of the State of Florida:
26
27 Section 1. The Division of Law Revision and Information is
28 directed to create part V of chapter 668, Florida Statutes,
29 consisting of ss. 668.801-668.805, Florida Statutes, to be
30 entitled the “Computer Abuse and Data Recovery Act.”
31 Section 2. Section 668.801, Florida Statutes, is created to
32 read:
33 668.801 Purpose.—This part shall be construed liberally to:
34 (1) Safeguard an owner, operator, or lessee of a protected
35 computer used in the operation of a business from harm or loss
36 caused by unauthorized access to such computer.
37 (2) Safeguard an owner of information stored in a
38 protected computer used in the operation of a business from harm
39 or loss caused by unauthorized access to such computer.
40 Section 3. Section 668.802, Florida Statutes, is created to
41 read:
42 668.802 Definitions.—As used in this part, the term:
43 (1) “Authorized user” means, with respect to a protected
44 computer:
45 (a) A director, officer, or employee of the owner,
46 operator, or lessee of the computer or the owner of information
47 stored in the protected computer.
48 (b) A third-party agent, contractor, consultant, or
49 employee of the owner, operator, or lessee of the computer or
50 the owner of information stored in the protected computer if the
51 third-party agent, contractor, consultant, or employee is
52 granted access to the protected computer by the owner, operator,
53 or lessee of the protected computer or by the owner of
54 information stored in such protected computer in the form of a
55 technological access barrier.
56
57 If the owner, operator, or lessee of the computer or the owner
58 of information stored in the protected computer provides a
59 third-party agent, contractor, consultant, or employee with a
60 technological access barrier within the scope of his or her
61 employment, the owner, operator, or lessee of the computer or
62 the owner of information stored in the protected computer gives
63 explicit permission to the third-party agent, contractor,
64 consultant, or employee to use the technological access barrier
65 and establishes the third-party agent, contractor, consultant,
66 or employee as an authorized user. Such permission, however, is
67 terminated upon cessation of his or her employment.
68 (2) “Business” means any trade or business regardless of
69 its for-profit or not-for-profit status.
70 (3) “Computer” means an electronic, magnetic, optical,
71 electrochemical, or other high-speed data processing device that
72 performs logical, arithmetic, or storage functions and includes
73 any data storage facility, data storage device, or
74 communications facility directly related to, or operating in
75 conjunction with, the device.
76 (4) “Harm” means any impairment to the integrity, access,
77 or availability of data, programs, systems, or information.
78 (5) “Loss” means any of the following:
79 (a) Any reasonable cost incurred by the owner, operator, or
80 lessee of a protected computer or the owner of stored
81 information, including the reasonable cost of conducting a
82 damage assessment for harm associated with the violation and the
83 reasonable cost for remediation efforts, such as restoring the
84 data, programs, systems, or information to the condition it was
85 in before the violation.
86 (b) Economic damages.
87 (c) Lost profits.
88 (d) Consequential damages, including the interruption of
89 service.
90 (e) Profits earned by a violator as a result of the
91 violation.
92 (6) “Protected computer” means a computer that is used in
93 connection with the operation of a business and stores
94 information, programs, or code in connection with the operation
95 of the business in which the stored information, programs, or
96 code can be accessed only by employing a technological access
97 barrier.
98 (7) “Technological access barrier” means a password,
99 security code, token, key fob, access device, or similar
100 measure.
101 (8) “Traffic” means to sell, purchase, or deliver.
102 (9) “Without authorization” means access to a protected
103 computer by a person who:
104 (a) Is not an authorized user;
105 (b) Has stolen a technological access barrier of an
106 authorized user; or
107 (c) Circumvents a technological access barrier on a
108 protected computer without the express or implied permission of
109 the owner, operator, or lessee of the computer or the express or
110 implied permission of the owner of information stored in the
111 protected computer. The term does not include circumventing a
112 technological measure that does not effectively control access
113 to the protected computer or the information stored in the
114 protected computer.
115 Section 4. Section 668.803, Florida Statutes, is created to
116 read:
117 668.803 Prohibited acts.—A person who knowingly and with
118 intent to cause harm or loss:
119 (1) Obtains information from a protected computer without
120 authorization and, as a result, causes harm or loss;
121 (2) Causes the transmission of a program, code, or command
122 to a protected computer without authorization and, as a result
123 of the transmission, causes harm or loss; or
124 (3) Traffics in any technological access barrier through
125 which access to a protected computer may be obtained without
126 authorization,
127
128 is liable to the extent provided in s. 668.804 in a civil action
129 to the owner, operator, or lessee of the protected computer, or
130 the owner of information stored in the protected computer who
131 uses the information in connection with the operation of a
132 business.
133 Section 5. Section 668.804, Florida Statutes, is created to
134 read:
135 668.804 Remedies.—
136 (1) A person who brings a civil action for a violation
137 under s. 668.803 may:
138 (a) Recover actual damages, including the person’s lost
139 profits and economic damages.
140 (b) Recover the violator’s profits that are not included in
141 the computation of actual damages under paragraph (a).
142 (c) Obtain injunctive or other equitable relief from the
143 court to prevent a future violation of s. 668.803.
144 (d) Recover the misappropriated information, program, or
145 code, and all copies thereof, that are subject to the violation.
146 (2) A court shall award reasonable attorney fees to the
147 prevailing party in any action arising under this part.
148 (3) The remedies available for a violation of s. 668.803
149 are in addition to remedies otherwise available for the same
150 conduct under federal or state law.
151 (4) A final judgment or decree in favor of the state in any
152 criminal proceeding under chapter 815 shall estop the defendant
153 in any subsequent action brought pursuant to s. 668.803 as to
154 all matters as to which the judgment or decree would be an
155 estoppel as if the plaintiff had been a party in the previous
156 criminal action.
157 (5) A civil action filed under s. 668.803 must be commenced
158 within 3 years after the violation occurred or within 3 years
159 after the violation was discovered or should have been
160 discovered with due diligence.
161 Section 6. Section 668.805, Florida Statutes, is created to
162 read:
163 668.805 Exclusions.—This part does not prohibit any
164 lawfully authorized investigative, protective, or intelligence
165 activity of any law enforcement agency, regulatory agency, or
166 political subdivision of this state, any other state, the United
167 States, or any foreign country. This part may not be construed
168 to impose liability on any provider of an interactive computer
169 service as defined in 47 U.S.C. 230(f), of an information
170 service as defined in 47 U.S.C. 153, or of a communications
171 service as defined in s. 202.11, if the provider provides the
172 transmission, storage, or caching of electronic communications
173 or messages of a person other than the provider, related
174 telecommunications or commercial mobile radio services, or
175 content provided by a person other than the provider.
176 Section 7. This act shall take effect October 1, 2015.