Florida Senate - 2024 SB 1794 By Senator Grall 29-01313B-24 20241794__ 1 A bill to be entitled 2 An act relating to public records; amending s. 3 501.1737, F.S.; providing an exemption from public 4 records requirements for information relating to 5 investigations by the Department of Legal Affairs and 6 law enforcement agencies of certain data privacy 7 violations; providing a definition; providing for 8 future legislative review and repeal of the exemption; 9 providing a statement of public necessity; providing a 10 contingent effective date. 11 12 Be It Enacted by the Legislature of the State of Florida: 13 14 Section 1. Present subsection (8) of section 501.1737, 15 Florida Statutes, as created by SB 1792 or similar legislation, 16 2024 Regular Session, is redesignated as subsection (9), and a 17 new subsection (8) is added to that section, to read: 18 501.1737 Age verification for online access to materials 19 harmful to minors.— 20 (8)(a) All information received by the department pursuant 21 to a notification of a violation under this section, or received 22 by the department pursuant to an investigation by the department 23 or a law enforcement agency of a violation of this section, is 24 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I 25 of the State Constitution, until such time as the investigation 26 is completed or ceases to be active. This exemption shall be 27 construed in conformity with s. 119.071(2)(c). 28 (b) During an active investigation, information made 29 confidential and exempt pursuant to paragraph (a) may be 30 disclosed by the department: 31 1. In the furtherance of its official duties and 32 responsibilities; 33 2. For print, publication, or broadcast if the department 34 determines that such release would assist in notifying the 35 public or locating or identifying a person who the department 36 believes to be a victim of a data breach or an improper use or 37 disposal of customer records, except that information made 38 confidential and exempt by paragraph (c) may not be released 39 pursuant to this subparagraph; or 40 3. To another governmental entity in the furtherance of its 41 official duties and responsibilities. 42 (c) Upon completion of an investigation or once an 43 investigation ceases to be active, the following information 44 received by the department shall remain confidential and exempt 45 from s. 119.07(1) and s. 24(a), Art. I of the State 46 Constitution: 47 1. All information to which another public records 48 exemption applies. 49 2. Personal information. 50 3. A computer forensic report. 51 4. Information that would otherwise reveal weaknesses in 52 the data security of a commercial entity. 53 5. Information that would disclose the proprietary 54 information of a commercial entity. 55 (d) For purposes of this subsection, the term “proprietary 56 information” means information that: 57 1. Is owned or controlled by the commercial entity. 58 2. Is intended to be private and is treated by the 59 commercial entity as private because disclosure would harm the 60 commercial entity or its business operations. 61 3. Has not been disclosed except as required by law or a 62 private agreement that provides that the information will not be 63 released to the public. 64 4. Is not publicly available or otherwise readily 65 ascertainable through proper means from another source in the 66 same configuration as received by the department. 67 5. Includes: 68 a. Trade secrets as defined in s. 688.002. 69 b. Competitive interests, the disclosure of which would 70 impair the competitive advantage of the commercial entity who is 71 the subject of the information. 72 (e) This subsection is subject to the Open Government 73 Sunset Review Act in accordance with s. 119.15 and shall stand 74 repealed on October 2, 2029, unless reviewed and saved from 75 repeal through reenactment by the Legislature. 76 Section 2. The Legislature finds that it is a public 77 necessity that all information received by the Department of 78 Legal Affairs pursuant to a notification of a violation of s. 79 501.1737, Florida Statutes, or received by the department 80 pursuant to an investigation by the department or a law 81 enforcement agency of a violation of that section, be made 82 confidential and exempt from s. 119.07(1), Florida Statutes, and 83 s. 24(a), Article I of the State Constitution for the following 84 reasons: 85 (1) A notification of a violation of s. 501.1737, Florida 86 Statutes, may result in an investigation of such violation. The 87 premature release of such information could frustrate or thwart 88 the investigation and impair the ability of the department to 89 effectively and efficiently administer s. 501.1737, Florida 90 Statutes. In addition, release of such information before 91 completion of an active investigation could jeopardize the 92 ongoing investigation. 93 (2) Release of information to which another public records 94 exemption applies once an investigation is completed or ceases 95 to be active would undo the specific statutory exemption 96 protecting that information. 97 (3) An investigation of a violation of s. 501.1737, Florida 98 Statutes, is likely to result in the gathering of sensitive 99 personal information, including identification numbers, unique 100 identifiers, professional or employment-related information, and 101 personal financial information. Such information could be used 102 for the purpose of identity theft. The release of such 103 information could subject possible victims of data privacy 104 violations to further harm. 105 (4) Notices received by the department and information 106 received during an investigation of a violation of s. 501.1737, 107 Florida Statutes, are likely to contain proprietary information. 108 Such information, including trade secrets, derives independent, 109 economic value, actual or potential, from being generally 110 unknown to, and not readily ascertainable by, other persons who 111 might obtain economic value from its disclosure or use. Allowing 112 public access to proprietary information, including a trade 113 secret, through a public records request could destroy the value 114 of the proprietary information and cause a financial loss to the 115 commercial entity. Release of such information could give 116 business competitors an unfair advantage. 117 (5) Information received by the department may contain a 118 computer forensic report or information that could reveal 119 weaknesses in the data security of a commercial entity. The 120 release of this information could result in the identification 121 of vulnerabilities in the cybersecurity system of the commercial 122 entity and be used to harm the commercial entity and clients. 123 (6) The harm that may result from the release of 124 information received by the department pursuant to a 125 notification or investigation by the department or a law 126 enforcement agency of a violation of s. 501.1737, Florida 127 Statutes, could impair the effective and efficient 128 administration of the investigation and, thus, outweighs the 129 public benefit that may be derived from the disclosure of the 130 information. 131 Section 3. This act shall take effect on the same date that 132 SB 1792 or similar legislation takes effect, if such legislation 133 is adopted in the same legislative session or an extension 134 thereof and becomes a law.