Florida Senate - 2016                       CS for CS for SB 776
       
       
        
       By the Committees on Governmental Oversight and Accountability;
       and Communications, Energy, and Public Utilities; and Senator
       Bradley
       
       585-03648-16                                           2016776c2
    1                        A bill to be entitled                      
    2         An act relating to public records; amending s.
    3         119.011, F.S.; defining the term “utility”; amending
    4         s. 119.0713, F.S.; providing an exemption from public
    5         records requirements for information related to the
    6         security of information technology systems or
    7         industrial control technology systems of a utility
    8         owned or operated by a unit of local government;
    9         providing for retroactive application; providing for
   10         future legislative review and repeal of the exemption;
   11         providing a statement of public necessity; providing
   12         an effective date.
   13          
   14  Be It Enacted by the Legislature of the State of Florida:
   15  
   16         Section 1. Subsection (15) is added to section 119.011,
   17  Florida Statutes, to read:
   18         119.011 Definitions.—As used in this chapter, the term:
   19         (15) “Utility” means a person or entity that provides
   20  electricity, natural gas, telecommunications, water, chilled
   21  water, reuse water, or wastewater.
   22         Section 2. Subsection (5) is added to section 119.0713,
   23  Florida Statutes, to read:
   24         119.0713 Local government agency exemptions from inspection
   25  or copying of public records.—
   26         (5)(a) The following information held by a utility owned or
   27  operated by a unit of local government is exempt from s.
   28  119.07(1) and s. 24(a), Art. I of the State Constitution:
   29         1. Information related to the security of the technology,
   30  processes, or practices of a utility owned or operated by a unit
   31  of local government that are designed to protect the utility’s
   32  networks, computers, programs, and data from attack, damage, or
   33  unauthorized access, which information, if disclosed, would
   34  facilitate the alteration, disclosure, or destruction of such
   35  data or information technology resources.
   36         2. Information related to the security of existing or
   37  proposed information technology systems or industrial control
   38  technology systems of a utility owned or operated by a unit of
   39  local government, which, if disclosed, would facilitate
   40  unauthorized access to, and alteration or destruction of, such
   41  systems in a manner that would adversely impact the safe and
   42  reliable operation of the systems and the utility.
   43         (b) This exemption applies to such information held by a
   44  utility owned or operated by a unit of local government before,
   45  on, or after the effective date of this exemption.
   46         (c) This subsection is subject to the Open Government
   47  Sunset Review Act in accordance with s. 119.15 and shall stand
   48  repealed on October 2, 2021, unless reviewed and saved from
   49  repeal through reenactment by the Legislature.
   50         Section 3. (1) The Legislature finds that it is a public
   51  necessity that the following information held by a utility owned
   52  or operated by a unit of local government be exempt from s.
   53  119.07(1), Florida Statutes, and s. 24(a), Article I of the
   54  State Constitution:
   55         (a) Information related to the security of the technology,
   56  processes, or practices of a utility owned or operated by a unit
   57  of local government that are designed to protect the utility’s
   58  networks, computers, programs, and data from attack, damage, or
   59  unauthorized access, which information, if disclosed, would
   60  facilitate the alteration, disclosure, or destruction of such
   61  data or information technology resources.
   62         (b) Information related to the security of existing or
   63  proposed information technology systems or industrial control
   64  technology systems of a utility owned or operated by a unit of
   65  local government, which, if disclosed, would facilitate
   66  unauthorized access to, and alteration or destruction of, such
   67  systems in a manner that would adversely impact the safe and
   68  reliable operation of the systems and the utility.
   69         (2) The Legislature finds that, as utility system
   70  infrastructure becomes more connected and integrated through
   71  information and communications technology, the exposure to
   72  damage from attacks through such technology continues to grow.
   73  These attacks may result in the disruption of utility services
   74  and damage to utility systems. Maintaining safe and reliable
   75  utility systems is vital to protecting the public health and
   76  safety and ensuring the economic well-being of the state.
   77  Accordingly, many utilities have adopted technologies,
   78  processes, and practices designed to secure data, information
   79  technology systems, and industrial control technology systems.
   80  Disclosure of sensitive information related to these security
   81  measures could result in the identification of vulnerabilities
   82  that allow a security breach that damages utility systems and
   83  disrupts the safe and reliable operation of such systems,
   84  adversely impacting the public health and safety and the
   85  economic well-being of the state. Because of the interconnected
   86  nature of utility systems, a security breach may also impact
   87  national security concerns. As a result, the Legislature finds
   88  that the public and private harm in disclosing the information
   89  made exempt by this act outweighs any public benefit derived
   90  from disclosure of such information. The protection of
   91  information made exempt by this act will ensure that utilities
   92  have greater safeguards to protect against security threats and
   93  will bolster efforts to develop more resilient information
   94  technology systems and industrial control technology systems.
   95  For these reasons, the Legislature finds that is a public
   96  necessity to make such information exempt from public records
   97  requirements, and to provide for retroactive application of the
   98  public records exemption.
   99         Section 4. This act shall take effect upon becoming a law.