Florida Senate - 2023 COMMITTEE AMENDMENT
Bill No. CS for SB 1648
Ì204514{Î204514
LEGISLATIVE ACTION
Senate . House
Comm: RCS .
04/24/2023 .
.
.
.
—————————————————————————————————————————————————————————————————
—————————————————————————————————————————————————————————————————
The Committee on Rules (Bradley) recommended the following:
1 Senate Amendment (with title amendment)
2
3 Delete everything after the enacting clause
4 and insert:
5 Section 1. Section 501.722, Florida Statutes, is created to
6 read:
7 501.722 Public records exemption.—
8 (1) All information received by the department pursuant to
9 a notification of a violation under this part, or received by
10 the department pursuant to an investigation by the department or
11 a law enforcement agency of a violation of this part, is
12 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
13 of the State Constitution, until such time as the investigation
14 is completed or ceases to be active. This exemption shall be
15 construed in conformity with s. 119.071(2)(c).
16 (2) During an active investigation, information made
17 confidential and exempt pursuant to subsection (1) may be
18 disclosed by the department:
19 (a) In the furtherance of its official duties and
20 responsibilities;
21 (b) For print, publication, or broadcast if the department
22 determines that such release would assist in notifying the
23 public or locating or identifying a person that the department
24 believes to be a victim of a data breach or improper use or
25 disposal of customer records, except that information made
26 confidential and exempt by subsection (3) may not be released
27 pursuant to this paragraph; or
28 (c) To another governmental entity in the furtherance of
29 its official duties and responsibilities.
30 (3) Upon completion of an investigation or once an
31 investigation ceases to be active, the following information
32 received by the department shall remain confidential and exempt
33 from s. 119.07(1) and s. 24(a), Art. I of the State
34 Constitution:
35 (a) All information to which another public records
36 exemption applies.
37 (b) Personal information.
38 (c) A computer forensic report.
39 (d) Information that would otherwise reveal weaknesses in
40 the data security of a controller, processor, or third party.
41 (e) Information that would disclose the proprietary
42 information of a controller, processor, or third party.
43 (4) For purposes of this section, the term “proprietary
44 information” means information that:
45 (a) Is owned or controlled by the controller, processor, or
46 third party.
47 (b) Is intended to be private and is treated by the
48 controller, processor, or third party as private because
49 disclosure would harm the controller, processor, or third party
50 or its business operations.
51 (c) Has not been disclosed except as required by law or a
52 private agreement that provides that the information will not be
53 released to the public.
54 (d) Is not publicly available or otherwise readily
55 ascertainable through proper means from another source in the
56 same configuration as received by the department.
57 (e) Includes:
58 1. Trade secrets as defined in s. 688.002.
59 2. Competitive interests, the disclosure of which would
60 impair the competitive advantage of the controller, processor,
61 or third party who is the subject of the information.
62 (5) This section is subject to the Open Government Sunset
63 Review Act in accordance with s. 119.15 and shall stand repealed
64 on October 2, 2028, unless reviewed and saved from repeal
65 through reenactment by the Legislature.
66 Section 2. The Legislature finds that it is a public
67 necessity that all information received by the Department of
68 Legal Affairs pursuant to a notification of a violation of part
69 V of chapter 501, Florida Statutes, or received by the
70 department pursuant to an investigation by the department or a
71 law enforcement agency of a violation of that part, be made
72 confidential and exempt from s. 119.07(1), Florida Statutes, and
73 s. 24(a), Article I of the State Constitution for the following
74 reasons:
75 (1) A notification of a violation of part V of chapter 501,
76 Florida Statutes, may result in an investigation of such
77 violation. The premature release of such information could
78 frustrate or thwart the investigation and impair the ability of
79 the department to effectively and efficiently administer part V
80 of chapter 501, Florida Statutes. In addition, release of such
81 information before completion of an active investigation could
82 jeopardize the ongoing investigation.
83 (2) Release of information to which another public record
84 exemption applies once an investigation is completed or ceases
85 to be active would undo the specific statutory exemption
86 protecting that information.
87 (3) An investigation of a violation of part V of chapter
88 501, Florida Statutes, is likely to result in the gathering of
89 sensitive personal information, including identification
90 numbers, unique identifiers, professional or employment-related
91 information, and personal financial information. Such
92 information could be used for the purpose of identity theft. The
93 release of such information could subject possible victims of
94 data privacy violations to further harm.
95 (4) Notices received by the department and information
96 received during an investigation of a violation of part V of
97 chapter 501, Florida Statutes, are likely to contain proprietary
98 information. Such information, including trade secrets, derives
99 independent, economic value, actual or potential, from being
100 generally unknown to, and not readily ascertainable by, other
101 persons who might obtain economic value from its disclosure or
102 use. Allowing public access to proprietary information,
103 including a trade secret, through a public records request could
104 destroy the value of the proprietary information and cause a
105 financial loss to the controller, processor, or third party.
106 Release of such information could give business competitors an
107 unfair advantage.
108 (5) Information received by the department may contain a
109 computer forensic report or information that could reveal
110 weaknesses in the data security of a controller, processor, or
111 third party. The release of this information could result in the
112 identification of vulnerabilities in the cybersecurity system of
113 the controller, processor, or third party and be used to harm
114 the controller, processor, or third party and clients.
115 (6) The harm that may result from the release of
116 information received by the department pursuant to a
117 notification or investigation by the department or a law
118 enforcement agency of a violation of part V of chapter 501,
119 Florida Statutes, could impair the effective and efficient
120 administration of the investigation and thus, outweighs the
121 public benefit that may be derived from the disclosure of the
122 information.
123 Section 3. This act shall take effect on the same date that
124 SB 262 or similar legislation takes effect, if such legislation
125 is adopted in the same legislative session or an extension
126 thereof and becomes a law.
127
128 ================= T I T L E A M E N D M E N T ================
129 And the title is amended as follows:
130 Delete everything before the enacting clause
131 and insert:
132 A bill to be entitled
133 An act relating to public records; amending s.
134 501.722, F.S.; providing an exemption from public
135 records requirements for information relating to
136 investigations by the Department of Legal Affairs and
137 law enforcement agencies of certain data privacy
138 violations; providing for future legislative review
139 and repeal of the exemption; providing a statement of
140 public necessity; providing a contingent effective
141 date.