Florida Senate - 2015 CS for CS for CS for SB 222 By the Committees on Judiciary; Communications, Energy, and Public Utilities; and Commerce and Tourism; and Senator Hukill 590-03273-15 2015222c3 1 A bill to be entitled 2 An act relating to electronic commerce; providing a 3 directive to the Division of Law Revision and 4 Information; creating the “Computer Abuse and Data 5 Recovery Act”; creating s. 668.801, F.S.; providing a 6 statement of purpose; creating s. 668.802, F.S.; 7 defining terms; creating s. 668.803, F.S.; prohibiting 8 a person from intentionally committing specified acts 9 without authorization with respect to a protected 10 computer; providing penalties for a violation; 11 creating s. 668.804, F.S.; specifying remedies for 12 civil actions brought by persons affected by a 13 violation; providing that specified criminal judgments 14 or decrees against a defendant act as estoppel as to 15 certain matters in specified civil actions; providing 16 that specified civil actions must be filed within 17 certain periods of time; creating s. 668.805, F.S.; 18 providing that the act does not prohibit specified 19 activity by certain state, federal, and foreign law 20 enforcement agencies, regulatory agencies, and 21 political subdivisions; providing that the act does 22 not impose liability on specified providers in certain 23 circumstances; providing an effective date. 24 25 Be It Enacted by the Legislature of the State of Florida: 26 27 Section 1. The Division of Law Revision and Information is 28 directed to create part V of chapter 668, Florida Statutes, 29 consisting of ss. 668.801-668.805, Florida Statutes, to be 30 entitled the “Computer Abuse and Data Recovery Act.” 31 Section 2. Section 668.801, Florida Statutes, is created to 32 read: 33 668.801 Purpose.—This part shall be construed liberally to: 34 (1) Safeguard an owner, operator, or lessee of a protected 35 computer used in the operation of a business from harm or loss 36 caused by unauthorized access to such computer. 37 (2) Safeguard an owner of information stored in a protected 38 computer used in the operation of a business from harm or loss 39 caused by unauthorized access to such computer. 40 Section 3. Section 668.802, Florida Statutes, is created to 41 read: 42 668.802 Definitions.—As used in this part, the term: 43 (1) “Authorized user” means, with respect to a protected 44 computer: a director, officer, employee, third-party agent, 45 contractor, or consultant of the owner, operator, or lessee of 46 the computer or the owner of information stored in the protected 47 computer if the director, officer, employee, third-party agent, 48 contractor, or consultant is granted access to the protected 49 computer by the owner, operator, or lessee of the protected 50 computer or by the owner of information stored in such protected 51 computer through a technological access barrier. 52 53 If the owner, operator, or lessee of the protected computer or 54 the owner of information stored in the protected computer 55 provides a director, officer, employee, third-party agent, 56 contractor, or consultant with a technological access barrier 57 within the scope of his or her employment, the owner, operator, 58 or lessee of the computer or the owner of information stored in 59 the protected computer gives explicit permission to the 60 director, officer, employee, third-party agent, contractor, or 61 consultant to use the technological access barrier and 62 establishes the director, officer, employee, third-party agent, 63 contractor, or consultant as an authorized user. Such 64 permission, however, is terminated upon cessation of his or her 65 employment. 66 (2) “Business” means any trade or business regardless of 67 its for-profit or not-for-profit status. 68 (3) “Computer” means an electronic, magnetic, optical, 69 electrochemical, or other high-speed data processing device that 70 performs logical, arithmetic, or storage functions and includes 71 any data storage facility, data storage device, or 72 communications facility directly related to, or operating in 73 conjunction with, the device. 74 (4) “Harm” means any impairment to the integrity, access, 75 or availability of data, programs, systems, or information. 76 (5) “Loss” means any of the following: 77 (a) Any reasonable cost incurred by the owner, operator, or 78 lessee of a protected computer or the owner of stored 79 information, including the reasonable cost of conducting a 80 damage assessment for harm associated with the violation and the 81 reasonable cost for remediation efforts, such as restoring the 82 data, programs, systems, or information to the condition it was 83 in before the violation. 84 (b) Economic damages. 85 (c) Lost profits. 86 (d) Consequential damages, including the interruption of 87 service. 88 (e) Profits earned by a violator as a result of the 89 violation. 90 (6) “Protected computer” means a computer that is used in 91 connection with the operation of a business and stores 92 information, programs, or code in connection with the operation 93 of the business in which the stored information, programs, or 94 code can be accessed only by employing a technological access 95 barrier. 96 (7) “Technological access barrier” means a password, 97 security code, token, key fob, access device, or similar 98 measure. 99 (8) “Traffic” means to sell, purchase, or deliver. 100 (9) “Without authorization” means access to a protected 101 computer by a person who: 102 (a) Is not an authorized user; 103 (b) Has stolen a technological access barrier of an 104 authorized user; or 105 (c) Circumvents a technological access barrier on a 106 protected computer without the express or implied permission of 107 the owner, operator, or lessee of the computer or the express or 108 implied permission of the owner of information stored in the 109 protected computer. The term does not include circumventing a 110 technological measure that does not effectively control access 111 to the protected computer or the information stored in the 112 protected computer. 113 Section 4. Section 668.803, Florida Statutes, is created to 114 read: 115 668.803 Prohibited acts.—A person who knowingly and with 116 intent to cause harm or loss: 117 (1) Obtains information from a protected computer without 118 authorization and, as a result, causes harm or loss; 119 (2) Causes the transmission of a program, code, or command 120 to a protected computer without authorization and, as a result 121 of the transmission, causes harm or loss; or 122 (3) Traffics in any technological access barrier through 123 which access to a protected computer may be obtained without 124 authorization, 125 126 is liable to the extent provided in s. 668.804 in a civil action 127 to the owner, operator, or lessee of the protected computer, or 128 the owner of information stored in the protected computer who 129 uses the information in connection with the operation of a 130 business. 131 Section 5. Section 668.804, Florida Statutes, is created to 132 read: 133 668.804 Remedies.— 134 (1) A person who brings a civil action for a violation 135 under s. 668.803 may: 136 (a) Recover actual damages, including the person’s lost 137 profits and economic damages. 138 (b) Recover the violator’s profits that are not included in 139 the computation of actual damages under paragraph (a). 140 (c) Obtain injunctive or other equitable relief from the 141 court to prevent a future violation of s. 668.803. 142 (d) Recover the misappropriated information, program, or 143 code, and all copies thereof, that are subject to the violation. 144 (2) A court shall award reasonable attorney fees to the 145 prevailing party in any action arising under this part. 146 (3) The remedies available for a violation of s. 668.803 147 are in addition to remedies otherwise available for the same 148 conduct under federal or state law. 149 (4) A final judgment or decree in favor of the state in any 150 criminal proceeding under chapter 815 shall estop the defendant 151 in any subsequent action brought pursuant to s. 668.803 as to 152 all matters as to which the judgment or decree would be an 153 estoppel as if the plaintiff had been a party in the previous 154 criminal action. 155 (5) A civil action filed under s. 668.803 must be commenced 156 within 3 years after the violation occurred or within 3 years 157 after the violation was discovered or should have been 158 discovered with due diligence. 159 Section 6. Section 668.805, Florida Statutes, is created to 160 read: 161 668.805 Exclusions.—This part does not prohibit any 162 lawfully authorized investigative, protective, or intelligence 163 activity of any law enforcement agency, regulatory agency, or 164 political subdivision of this state, any other state, the United 165 States, or any foreign country. This part may not be construed 166 to impose liability on any provider of an interactive computer 167 service as defined in 47 U.S.C. 230(f), of an information 168 service as defined in 47 U.S.C. 153, or of a communications 169 service as defined in s. 202.11, if the provider provides the 170 transmission, storage, or caching of electronic communications 171 or messages of a person other than the provider, related 172 telecommunications or commercial mobile radio services, or 173 content provided by a person other than the provider. 174 Section 7. This act shall take effect October 1, 2015.