Florida Senate - 2021 (PROPOSED BILL) SPB 7064
FOR CONSIDERATION By the Committee on Commerce and Tourism
577-02811-21 20217064pb
1 A bill to be entitled
2 An act relating to public records; amending s.
3 501.177, F.S.; providing an exemption from public
4 records requirements for information relating to
5 investigations by the Department of Legal Affairs and
6 law enforcement agencies of certain data privacy
7 violations; defining the term “proprietary
8 information”; providing for future legislative review
9 and repeal of the exemption; providing a statement of
10 public necessity; providing a contingent effective
11 date.
12
13 Be It Enacted by the Legislature of the State of Florida:
14
15 Section 1. Subsection (3) is added to section 501.177,
16 Florida Statutes, as created by SB 1734, 2021 Regular Session,
17 to read:
18 501.177 Civil actions; private right of action; Attorney
19 General; rules.—
20 (3)(a) All information received by the department pursuant
21 to a notification of a violation under this act, or received by
22 the department pursuant to an investigation by the department or
23 a law enforcement agency, is confidential and exempt from s.
24 119.07(1) and s. 24(a), Art. I of the State Constitution until
25 such time as the investigation is completed or ceases to be
26 active. This exemption shall be construed in conformity with s.
27 119.071(2)(c).
28 (b) During an active investigation, information made
29 confidential and exempt pursuant to paragraph (a) may be
30 disclosed by the department:
31 1. In the furtherance of official duties and
32 responsibilities;
33 2. For print, publication, or broadcast if the department
34 determines that such release would assist in notifying the
35 public or locating or identifying a person the department
36 believes to be a victim of improper use or disposal of customer
37 records, except that information made confidential and exempt by
38 paragraph (c) may not be released pursuant to this subparagraph;
39 or
40 3. To another governmental entity in the furtherance of its
41 official duties and responsibilities.
42 (c) Upon completion of an investigation or once an
43 investigation ceases to be active, all of the following
44 information received by the department remains confidential and
45 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
46 Constitution:
47 1. All information to which another public records
48 exemption applies.
49 2. Personal information.
50 3. A computer forensic report.
51 4. Information that would otherwise reveal weaknesses in a
52 business’ data security.
53 5. Information that would disclose a business’ proprietary
54 information.
55 (d) For purposes of this subsection, the term “proprietary
56 information”:
57 1. Means information that:
58 a. Is owned or controlled by the business.
59 b. Is intended to be private and is treated by the business
60 as private because disclosure would harm the business or its
61 business operations.
62 c. Has not been disclosed except as required by law or a
63 private agreement that provides that the information will not be
64 released to the public.
65 d. Is not publicly available or otherwise readily
66 ascertainable through proper means from another source in the
67 same configuration as received by the department.
68 2. Includes:
69 a. Trade secrets as defined in s. 688.002.
70 b. Competitive interests, the disclosure of which would
71 impair the competitive business of the business who is the
72 subject of the information.
73 (e) This subsection is subject to the Open Government
74 Sunset Review Act in accordance with s. 119.15 and shall stand
75 repealed on October 2, 2026, unless reviewed and saved from
76 repeal through reenactment by the Legislature.
77 Section 2. The Legislature finds that it is a public
78 necessity that all information received by the Department of
79 Legal Affairs pursuant to a notification of a violation of this
80 act, or received by the department pursuant to an investigation
81 by the department or a law enforcement agency, be made
82 confidential and exempt from s. 119.07(1), Florida Statutes, and
83 s. 24(a), Article I of the State Constitution for the following
84 reasons:
85 (1) A notification of a violation of this act may result in
86 an investigation of such violation. The premature release of
87 such information could frustrate or thwart the investigation and
88 impair the ability of the department to effectively and
89 efficiently administer its duties pursuant to s. 501.177,
90 Florida Statutes. In addition, release of such information
91 before completion of an active investigation could jeopardize
92 the ongoing investigation.
93 (2) The Legislature finds that it is a public necessity to
94 continue to protect from public disclosure all information to
95 which another public record exemption applies once an
96 investigation is completed or ceases to be active. Release of
97 such information by the department would undo the specific
98 statutory exemption protecting that information.
99 (3) An investigation of a data privacy violation is likely
100 to result in the gathering of sensitive personal information,
101 including social security numbers, identification numbers, and
102 personal financial information. Such information could be used
103 for the purpose of identity theft. In addition, release of such
104 information could subject possible victims of data privacy
105 violations to further harm.
106 (4) Notices received by the department and information
107 received during an investigation of a covered business’
108 violations of this act are likely to contain proprietary
109 information, including trade secrets, about the security of the
110 system. The release of the proprietary information could result
111 in the identification of the system’s vulnerabilities, which
112 could ultimately lead to the improper access of personal
113 information held by the covered business. In addition, a trade
114 secret derives independent, economic value, actual or potential,
115 from being generally unknown to, and not readily ascertainable
116 by, other persons who might obtain economic value from its
117 disclosure or use. Allowing public access to proprietary
118 information, including a trade secret, through a public records
119 request could destroy the value of the proprietary information
120 and cause a financial loss to the business submitting the
121 information. Release of such information could weaken the
122 position of the entity supplying the proprietary information in
123 the marketplace.
124 Section 3. This act shall take effect on the same date that
125 SB 1734 or similar legislation takes effect, if such legislation
126 is adopted in the same legislative session or an extension
127 thereof and becomes a law.