Florida Senate - 2021                                    SB 7064
       By the Committee on Commerce and Tourism
       577-03191-21                                          20217064__
    1                        A bill to be entitled                      
    2         An act relating to public records; amending s.
    3         501.177, F.S.; providing an exemption from public
    4         records requirements for information relating to
    5         investigations by the Department of Legal Affairs and
    6         law enforcement agencies of certain data privacy
    7         violations; defining the term “proprietary
    8         information”; providing for future legislative review
    9         and repeal of the exemption; providing a statement of
   10         public necessity; providing a contingent effective
   11         date.
   13  Be It Enacted by the Legislature of the State of Florida:
   15         Section 1. Subsection (4) is added to section 501.177,
   16  Florida Statutes, as created by SB 1734, 2021 Regular Session,
   17  to read:
   18         501.177 Civil actions; private right of action; Attorney
   19  General; rules.—
   20         (4)(a)All information received by the department pursuant
   21  to a notification of a violation under this act, or received by
   22  the department pursuant to an investigation by the department or
   23  a law enforcement agency, is confidential and exempt from s.
   24  119.07(1) and s. 24(a), Art. I of the State Constitution until
   25  such time as the investigation is completed or ceases to be
   26  active. This exemption shall be construed in conformity with s.
   27  119.071(2)(c).
   28         (b)During an active investigation, information made
   29  confidential and exempt pursuant to paragraph (a) may be
   30  disclosed by the department:
   31         1.In the furtherance of official duties and
   32  responsibilities;
   33         2.For print, publication, or broadcast if the department
   34  determines that such release would assist in notifying the
   35  public or locating or identifying a person the department
   36  believes to be a victim of improper use or disposal of customer
   37  records, except that information made confidential and exempt by
   38  paragraph (c) may not be released pursuant to this subparagraph;
   39  or
   40         3.To another governmental entity in the furtherance of its
   41  official duties and responsibilities.
   42         (c)Upon completion of an investigation or once an
   43  investigation ceases to be active, all of the following
   44  information received by the department remains confidential and
   45  exempt from s. 119.07(1) and s. 24(a), Art. I of the State
   46  Constitution:
   47         1.All information to which another public records
   48  exemption applies.
   49         2.Personal information.
   50         3.A computer forensic report.
   51         4.Information that would otherwise reveal weaknesses in a
   52  business’ data security.
   53         5.Information that would disclose a business’ proprietary
   54  information.
   55         (d)For purposes of this subsection, the term “proprietary
   56  information”:
   57         1.Means information that:
   58         a.Is owned or controlled by the business.
   59         b.Is intended to be private and is treated by the business
   60  as private because disclosure would harm the business or its
   61  business operations.
   62         c.Has not been disclosed except as required by law or a
   63  private agreement that provides that the information will not be
   64  released to the public.
   65         d.Is not publicly available or otherwise readily
   66  ascertainable through proper means from another source in the
   67  same configuration as received by the department.
   68         2.Includes:
   69         a.Trade secrets as defined in s. 688.002.
   70         b.Competitive interests, the disclosure of which would
   71  impair the competitive business of the business who is the
   72  subject of the information.
   73         (e)This subsection is subject to the Open Government
   74  Sunset Review Act in accordance with s. 119.15 and shall stand
   75  repealed on October 2, 2026, unless reviewed and saved from
   76  repeal through reenactment by the Legislature.
   77         Section 2. The Legislature finds that it is a public
   78  necessity that all information received by the Department of
   79  Legal Affairs pursuant to a notification of a violation of this
   80  act, or received by the department pursuant to an investigation
   81  by the department or a law enforcement agency, be made
   82  confidential and exempt from s. 119.07(1), Florida Statutes, and
   83  s. 24(a), Article I of the State Constitution for the following
   84  reasons:
   85         (1)A notification of a violation of this act may result in
   86  an investigation of such violation. The premature release of
   87  such information could frustrate or thwart the investigation and
   88  impair the ability of the department to effectively and
   89  efficiently administer its duties pursuant to s. 501.177,
   90  Florida Statutes. In addition, release of such information
   91  before completion of an active investigation could jeopardize
   92  the ongoing investigation.
   93         (2)The Legislature finds that it is a public necessity to
   94  continue to protect from public disclosure all information to
   95  which another public record exemption applies once an
   96  investigation is completed or ceases to be active. Release of
   97  such information by the department would undo the specific
   98  statutory exemption protecting that information.
   99         (3)An investigation of a data privacy violation is likely
  100  to result in the gathering of sensitive personal information,
  101  including social security numbers, identification numbers, and
  102  personal financial information. Such information could be used
  103  for the purpose of identity theft. In addition, release of such
  104  information could subject possible victims of data privacy
  105  violations to further harm.
  106         (4)Notices received by the department and information
  107  received during an investigation of a covered business’
  108  violations of this act are likely to contain proprietary
  109  information, including trade secrets, about the security of the
  110  system. The release of the proprietary information could result
  111  in the identification of the system’s vulnerabilities, which
  112  could ultimately lead to the improper access of personal
  113  information held by the covered business. In addition, a trade
  114  secret derives independent, economic value, actual or potential,
  115  from being generally unknown to, and not readily ascertainable
  116  by, other persons who might obtain economic value from its
  117  disclosure or use. Allowing public access to proprietary
  118  information, including a trade secret, through a public records
  119  request could destroy the value of the proprietary information
  120  and cause a financial loss to the business submitting the
  121  information. Release of such information could weaken the
  122  position of the entity supplying the proprietary information in
  123  the marketplace.
  124         Section 3. This act shall take effect on the same date that
  125  SB 1734 or similar legislation takes effect, if such legislation
  126  is adopted in the same legislative session or an extension
  127  thereof and becomes a law.