Florida Senate - 2022 CS for SB 1694
By the Committee on Military and Veterans Affairs, Space, and
Domestic Security; and Senator Hutson
583-02824-22 20221694c1
1 A bill to be entitled
2 An act relating to public records and public meetings;
3 amending s. 282.3185, F.S.; providing an exemption
4 from public records requirements for certain
5 information related to a cybersecurity incident or
6 ransomware incident held by a political subdivision or
7 state agency; authorizing the disclosure of the
8 confidential and exempt information under certain
9 circumstances; providing an exemption from public
10 meetings requirements for portions of a meeting that
11 would reveal certain information related to a
12 cybersecurity incident or ransomware incident held by
13 a political subdivision or state agency; requiring the
14 recording and transcribing of exempt portions of such
15 meetings; providing an exemption from public records
16 requirements for such recordings and transcripts;
17 providing for future legislative review and repeal of
18 the exemptions; providing a statement of public
19 necessity; providing a contingent effective date.
20
21 Be It Enacted by the Legislature of the State of Florida:
22
23 Section 1. Subsection (3) is added to section 282.3185,
24 Florida Statutes, as created by SB 1670, 2022 Regular Session,
25 to read:
26 282.3185 Local government cybersecurity.—
27 (3)(a) Information related to a cybersecurity incident or
28 ransomware incident held by a political subdivision or state
29 agency is confidential and exempt from s. 119.07(1) and s.
30 24(a), Art. I of the State Constitution to the extent that
31 disclosure of such information would facilitate unauthorized
32 access to or the unauthorized modification, disclosure, or
33 destruction of:
34 1. Data or information, whether physical or virtual; or
35 2. Information technology resources, including, but not
36 limited to, the following:
37 a. Information relating to the security of the local
38 government’s technologies, processes, and practices designed to
39 protect networks, computers, data processing software, and data
40 from attack, damage, or unauthorized access.
41 b. Security information, whether physical or virtual, which
42 relates to the local government’s existing or proposed
43 information technology systems.
44 (b) Information made confidential and exempt under
45 paragraph (a) may be disclosed by a political subdivision or
46 state agency:
47 1. In the furtherance of its official duties and
48 responsibilities.
49 2. To another governmental entity in the furtherance of its
50 statutory duties and responsibilities.
51 (c) Any portion of a meeting that would reveal information
52 made confidential and exempt under paragraph (a) is exempt from
53 s. 286.011 and s. 24(b), Art. I of the State Constitution. An
54 exempt portion of a meeting may not be off the record and must
55 be recorded and transcribed. The recording and transcript are
56 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
57 of the State Constitution.
58 (d) This subsection is subject to the Open Government
59 Sunset Review Act in accordance with s. 119.15 and shall stand
60 repealed on October 2, 2027, unless reviewed and saved from
61 repeal through reenactment by the Legislature.
62 Section 2. The Legislature finds that it is a public
63 necessity that information related to a cybersecurity incident
64 or ransomware incident held by a political subdivision or state
65 agency be made confidential and exempt from s. 119.07(1),
66 Florida Statutes, and s. 24(a), Article I of the State
67 Constitution to the extent that disclosure of such information
68 would facilitate unauthorized access to or the unauthorized
69 modification, disclosure, or destruction of data or information,
70 whether physical or virtual, or information technology
71 resources. Such information includes proprietary information
72 about the security of a government system, and disclosure of
73 that information could result in the identification of
74 vulnerabilities and further breaches of the government system.
75 In addition, the disclosure of such information could compromise
76 the integrity of a government’s data, information, or
77 information technology resources, which would significantly
78 impair the administration of vital programs. Therefore, this
79 information should be made confidential and exempt in order to
80 protect the government’s data, information, and information
81 technology resources. The Legislature also finds that it is a
82 public necessity that any portion of a meeting in which the
83 confidential and exempt information is discussed be made exempt
84 from s. 286.011, Florida Statutes, and s. 24(b), Article I of
85 the State Constitution, and that any recordings and transcripts
86 of those portions of a meeting in which the confidential and
87 exempt information is discussed be made confidential and exempt
88 from s. 119.07(1), Florida Statutes, and s. 24(a), Article I of
89 the State Constitution. The failure to close that portion of a
90 meeting at which confidential and exempt information is
91 discussed, and prevent the disclosure of the recordings and
92 transcripts of those portions of a meeting, would defeat the
93 purpose of the underlying public records exemption and could
94 result in the release of highly sensitive information related to
95 the cybersecurity of a government system. For these reasons, the
96 Legislature finds that these public records and public meetings
97 exemptions are of the utmost importance and are a public
98 necessity.
99 Section 3. This act shall take effect on the same date that
100 SB 1670 or similar legislation takes effect, if such legislation
101 is adopted in the same legislative session or an extension
102 thereof and becomes a law.