Florida Senate - 2023 CS for CS for SB 1648
By the Committees on Rules; and Commerce and Tourism; and
Senator Bradley
595-04200A-23 20231648c2
1 A bill to be entitled
2 An act relating to public records; amending s.
3 501.722, F.S.; providing an exemption from public
4 records requirements for information relating to
5 investigations by the Department of Legal Affairs and
6 law enforcement agencies of certain data privacy
7 violations; providing for future legislative review
8 and repeal of the exemption; providing a statement of
9 public necessity; providing a contingent effective
10 date.
11
12 Be It Enacted by the Legislature of the State of Florida:
13
14 Section 1. Section 501.722, Florida Statutes, is created
15 and incorporated into part V of chapter 501, Florida Statutes,
16 as created by SB 262 or similar legislation, 2023 Regular
17 Session, to read:
18 501.722 Public records exemption.—
19 (1) All information received by the department pursuant to
20 a notification of a violation under this part, or received by
21 the department pursuant to an investigation by the department or
22 a law enforcement agency of a violation of this part, is
23 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
24 of the State Constitution, until such time as the investigation
25 is completed or ceases to be active. This exemption shall be
26 construed in conformity with s. 119.071(2)(c).
27 (2) During an active investigation, information made
28 confidential and exempt pursuant to subsection (1) may be
29 disclosed by the department:
30 (a) In the furtherance of its official duties and
31 responsibilities;
32 (b) For print, publication, or broadcast if the department
33 determines that such release would assist in notifying the
34 public or locating or identifying a person that the department
35 believes to be a victim of a data breach or an improper use or
36 disposal of customer records, except that information made
37 confidential and exempt by subsection (3) may not be released
38 pursuant to this paragraph; or
39 (c) To another governmental entity in the furtherance of
40 its official duties and responsibilities.
41 (3) Upon completion of an investigation or once an
42 investigation ceases to be active, the following information
43 received by the department shall remain confidential and exempt
44 from s. 119.07(1) and s. 24(a), Art. I of the State
45 Constitution:
46 (a) All information to which another public records
47 exemption applies.
48 (b) Personal information.
49 (c) A computer forensic report.
50 (d) Information that would otherwise reveal weaknesses in
51 the data security of a controller, processor, or third party.
52 (e) Information that would disclose the proprietary
53 information of a controller, processor, or third party.
54 (4) For purposes of this section, the term “proprietary
55 information” means information that:
56 (a) Is owned or controlled by the controller, processor, or
57 third party.
58 (b) Is intended to be private and is treated by the
59 controller, processor, or third party as private because
60 disclosure would harm the controller, processor, or third party
61 or its business operations.
62 (c) Has not been disclosed except as required by law or a
63 private agreement that provides that the information will not be
64 released to the public.
65 (d) Is not publicly available or otherwise readily
66 ascertainable through proper means from another source in the
67 same configuration as received by the department.
68 (e) Includes:
69 1. Trade secrets as defined in s. 688.002.
70 2. Competitive interests, the disclosure of which would
71 impair the competitive advantage of the controller, processor,
72 or third party who is the subject of the information.
73 (5) This section is subject to the Open Government Sunset
74 Review Act in accordance with s. 119.15 and shall stand repealed
75 on October 2, 2028, unless reviewed and saved from repeal
76 through reenactment by the Legislature.
77 Section 2. The Legislature finds that it is a public
78 necessity that all information received by the Department of
79 Legal Affairs pursuant to a notification of a violation of part
80 V of chapter 501, Florida Statutes, or received by the
81 department pursuant to an investigation by the department or a
82 law enforcement agency of a violation of that part, be made
83 confidential and exempt from s. 119.07(1), Florida Statutes, and
84 s. 24(a), Article I of the State Constitution for the following
85 reasons:
86 (1) A notification of a violation of part V of chapter 501,
87 Florida Statutes, may result in an investigation of such
88 violation. The premature release of such information could
89 frustrate or thwart the investigation and impair the ability of
90 the department to effectively and efficiently administer part V
91 of chapter 501, Florida Statutes. In addition, release of such
92 information before completion of an active investigation could
93 jeopardize the ongoing investigation.
94 (2) Release of information to which another public record
95 exemption applies once an investigation is completed or ceases
96 to be active would undo the specific statutory exemption
97 protecting that information.
98 (3) An investigation of a violation of part V of chapter
99 501, Florida Statutes, is likely to result in the gathering of
100 sensitive personal information, including identification
101 numbers, unique identifiers, professional or employment-related
102 information, and personal financial information. Such
103 information could be used for the purpose of identity theft. The
104 release of such information could subject possible victims of
105 data privacy violations to further harm.
106 (4) Notices received by the department and information
107 received during an investigation of a violation of part V of
108 chapter 501, Florida Statutes, are likely to contain proprietary
109 information. Such information, including trade secrets, derives
110 independent, economic value, actual or potential, from being
111 generally unknown to, and not readily ascertainable by, other
112 persons who might obtain economic value from its disclosure or
113 use. Allowing public access to proprietary information,
114 including a trade secret, through a public records request could
115 destroy the value of the proprietary information and cause a
116 financial loss to the controller, processor, or third party.
117 Release of such information could give business competitors an
118 unfair advantage.
119 (5) Information received by the department may contain a
120 computer forensic report or information that could reveal
121 weaknesses in the data security of a controller, processor, or
122 third party. The release of this information could result in the
123 identification of vulnerabilities in the cybersecurity system of
124 the controller, processor, or third party and be used to harm
125 the controller, processor, or third party and clients.
126 (6) The harm that may result from the release of
127 information received by the department pursuant to a
128 notification or investigation by the department or a law
129 enforcement agency of a violation of part V of chapter 501,
130 Florida Statutes, could impair the effective and efficient
131 administration of the investigation and thus, outweighs the
132 public benefit that may be derived from the disclosure of the
133 information.
134 Section 3. This act shall take effect on the same date that
135 SB 262 or similar legislation takes effect, if such legislation
136 is adopted in the same legislative session or an extension
137 thereof and becomes a law.