Florida Senate - 2014                                    SB 1526
       
       
        
       By Senator Thrasher
       
       
       
       
       
       6-01034A-14                                           20141526__
    1                        A bill to be entitled                      
    2         An act relating to public records; amending s.
    3         501.171, F.S.; providing exemptions from public
    4         records requirements for the notice of a data breach
    5         and information held by the Department of Legal
    6         Affairs pursuant to certain investigations;
    7         authorizing disclosure under certain circumstances;
    8         providing for future review and repeal of the
    9         exemption under the Open Government Sunset Review Act;
   10         providing a statement of public necessity; providing a
   11         contingent effective date.
   12          
   13  Be It Enacted by the Legislature of the State of Florida:
   14  
   15         Section 1. Subsection (11) is added to section 501.171,
   16  Florida Statutes, as created by SB ____, 2014 Regular Session,
   17  to read:
   18         501.171 Security of confidential personal information.—
   19         (11) PUBLIC RECORDS EXEMPTION.—
   20         (a) All information received by the department pursuant to
   21  notifications required by this section, or received pursuant to
   22  a subsequent investigation by the department or another federal
   23  or state law enforcement agency, is confidential and exempt from
   24  s. 119.07(1) and s. 24(a), Art. I of the State Constitution, so
   25  long as the investigation is considered an active investigation.
   26  This exemption shall be construed in conformity with s.
   27  119.071(2)(c). However, during an active investigation, such
   28  information may be disclosed by the department in the
   29  furtherance of its official duties and responsibilities; for
   30  print, publication, or broadcast if the department determines
   31  that such release would assist in notifying the public or
   32  locating or identifying a person that the department believes to
   33  have been a victim of the breach; or to another governmental
   34  agency in the furtherance of its official duties and
   35  responsibilities.
   36         (b) Notwithstanding subsection (a), the following
   37  information received by the department shall remain confidential
   38  and exempt from s. 119.07(1) and s. 24(a), Art. I of the State
   39  Constitution after completion of an investigation:
   40         1. All information to which another public records
   41  exemption applies.
   42         2. Personal information as such term is defined in this
   43  section.
   44         3. A computer forensic report.
   45         4. Information that would otherwise reveal weaknesses in a
   46  covered entity’s data security.
   47         5. Information that would disclose a covered entity’s trade
   48  secrets or proprietary information.
   49         Section 2. The Legislature finds that it is a public
   50  necessity that information held by the Department of Legal
   51  Affairs pursuant to an investigation of a violation of s.
   52  501.171, Florida Statutes, relating to information security, be
   53  confidential and exempt from public records requirements for the
   54  following reasons:
   55         (1) A data breach is likely the result of criminal activity
   56  that will likely lead to further criminal activity. Notices
   57  provided to the department and materials obtained during
   58  investigations of a violation of s. 501.171, Florida Statutes,
   59  are likely to contain proprietary information about the security
   60  of the breached system. The release of the proprietary
   61  information could result in the identification of
   62  vulnerabilities and further breaches of that system. This
   63  exemption protects the security of the breached systems, thus
   64  protecting the personal information of Floridians stored within
   65  the systems.
   66         (2) Notices provided to the Department of Legal Affairs and
   67  materials obtained during investigations of a violation of s.
   68  501.171, Florida Statutes, may contain personal information that
   69  could be used for the purpose of identity theft or some other
   70  financial harm. The release of this information by the
   71  department in response to a public records request could be just
   72  as problematic as the breach or improper disposal of customer
   73  records. This exemption protects the security of the personal
   74  information by excluding it from public records requirements.
   75         Section 3. This act shall take effect on the same date that
   76  SB ___ or similar legislation takes effect, if such legislation
   77  is adopted in the same legislative session or an extension
   78  thereof and becomes a law.