Florida Senate - 2026 CS for CS for SB 1440
By the Committees on Rules; and Banking and Insurance; and
Senator Martin
595-03186-26 20261440c2
1 A bill to be entitled
2 An act relating to public records; amending s.
3 494.00125, F.S.; providing an exemption from public
4 records requirements for information received by the
5 Office of Financial Regulation pursuant to certain
6 cybersecurity event provisions relating to information
7 systems and customer information of loan originators,
8 mortgage brokers, and mortgage lenders and for
9 information received by the office as a result of
10 investigations and examinations of such cybersecurity
11 events; providing for future legislative review and
12 repeal of the exemption; providing a statement of
13 public necessity; amending s. 517.2015, F.S.;
14 providing a public records exemption for certain
15 information in reports of financial exploitation;
16 providing for future legislative review and repeal of
17 the exemption; providing a statement of public
18 necessity; reenacting and amending s. 560.129, F.S.;
19 expanding a public records exemption for certain
20 information obtained by the Office of Financial
21 Regulation concerning or during the course of an
22 investigation or examination conducted by the office,
23 including customer and consumer complaints, to
24 incorporate the inclusion of documents relating to
25 cybersecurity incidents, data breaches, and
26 information security programs; providing an exemption
27 from public records requirements for information
28 received by the office pursuant to certain
29 cybersecurity events, documents relating to
30 information systems, and customer information of money
31 services businesses and for information received by
32 the office as a result of investigations and
33 examinations of such cybersecurity events; providing
34 for future legislative review and repeal of the
35 exemptions; providing a statement of public necessity;
36 amending s. 560.129, F.S.; expanding a public records
37 exemption for certain information obtained by the
38 Office of Financial Regulation concerning or during
39 the course of an investigation or examination
40 conducted by the office, including customer and
41 consumer complaints, to incorporate the inclusion of
42 documents relating to virtual currency businesses and
43 qualified payment stablecoin issuers; providing for
44 future legislative review and repeal of the
45 exemptions; specifying that certain provisions do not
46 become effective under certain circumstances;
47 providing statements of public necessity; amending s.
48 655.0171, F.S.; providing an exemption from public
49 records requirements for customer personal information
50 received by the office relating to breaches of
51 security of financial institutions or received by the
52 office as a result of investigations of such breaches
53 under certain circumstances; providing exceptions;
54 providing definitions; providing for future
55 legislative review and repeal of the exemption;
56 providing a statement of public necessity; amending s.
57 655.057, F.S.; providing an exemption from public
58 records requirements for certain information received
59 by the office pursuant to applications for authority
60 to organize new state credit unions and for certain
61 information relating to specified persons; providing
62 exceptions; defining the term “personal identifying
63 information”; revising the date for future legislative
64 review and repeal of the exemption; providing a
65 statement of public necessity; reenacting and amending
66 s. 655.057, F.S.; expanding a public records exemption
67 for certain information obtained by the office
68 concerning an investigation or examination conducted
69 by the office, including reports or papers of
70 examinations, operations, or condition, and trade
71 secrets to incorporate the inclusion of trust
72 companies that are qualified payment stablecoin
73 issuers; providing for future legislative review and
74 repeal of the exemption; providing a statement of
75 public necessity; reenacting and amending s. 655.50,
76 F.S.; expanding a public records exemption for reports
77 and records filed with the office to incorporate the
78 inclusion of financial institutions that are trust
79 companies that are qualified payment stablecoin
80 issuers; providing a statement of public necessity;
81 providing contingent effective dates.
82
83 Be It Enacted by the Legislature of the State of Florida:
84
85 Section 1. Subsection (4) is added to section 494.00125,
86 Florida Statutes, to read:
87 494.00125 Public records exemptions.—
88 (4) INFORMATION SECURITY; CYBERSECURITY.—All information
89 received by the office pursuant to s. 494.00123, or received by
90 the office as result of an investigation by the office or a law
91 enforcement agency of a cybersecurity event pursuant to s.
92 494.00123, is confidential and exempt from s. 119.07(1) and s.
93 24(a), Art. I of the State Constitution, until such time as the
94 investigation is completed or ceases to be active. The public
95 records exemption of the information received by the office
96 under this subsection shall be construed in conformity with s.
97 119.071(2)(c). This subsection is subject to the Open Government
98 Sunset Review Act in accordance with s. 119.15 and shall stand
99 repealed on October 2, 2031, unless reviewed and saved from
100 repeal through reenactment by the Legislature.
101 Section 2. (1) The Legislature finds that it is a public
102 necessity that information on cybersecurity events submitted to
103 or obtained by the Office of Financial Regulation pursuant to s.
104 494.00123, Florida Statutes, or as a result of an investigation
105 by the office which involve information security programs of
106 loan originators, mortgage brokers, and mortgage lenders and
107 nonpublic personal data of customers of such loan originators,
108 mortgage brokers, and mortgage lenders be made confidential and
109 exempt from public disclosure.
110 (2)(a) Premature or unrestricted release of information on
111 cybersecurity events, as defined in s. 494.00123(1), Florida
112 Statutes, could compromise ongoing investigations, expose system
113 vulnerabilities, and hinder the office’s ability to protect
114 consumers and regulate financial institutions effectively.
115 Disclosure of such information could also place affected
116 individuals at heightened risk of identity theft and financial
117 fraud while revealing trade secrets, proprietary data, and
118 technical safeguards that could be exploited by malicious
119 actors.
120 (b) Protecting information on cybersecurity events ensures
121 that entities cooperate fully with regulators, encourages
122 accurate reporting of security incidents, and maintains the
123 overall integrity of the financial and cybersecurity
124 infrastructure of this state.
125 (3) It is therefore a public necessity that all information
126 received by the office pursuant to s. 494.00123, Florida
127 Statutes, or through an investigation by the office or a law
128 enforcement agency of a cybersecurity event pursuant to s.
129 494.00123, Florida Statutes, be made confidential and exempt
130 from s. 119.07(1), Florida Statutes, and s. 24(a), Article I of
131 the State Constitution.
132 Section 3. Paragraph (b) of subsection (1) of section
133 517.2015, Florida Statutes, is amended, and subsection (4) is
134 added to that section, to read:
135 517.2015 Confidentiality of information relating to
136 investigations and examinations.—
137 (1)
138 (b) Except as necessary for the office to enforce the
139 provisions of this chapter, a consumer complaint, a report of
140 financial exploitation, and other information relative to an
141 investigation or examination shall remain confidential and
142 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
143 Constitution after the investigation or examination is completed
144 or ceases to be active to the extent disclosure would:
145 1. Jeopardize the integrity of another active investigation
146 or examination.
147 2. Reveal the name, address, telephone number, social
148 security number, or any other identifying number or information
149 of any complainant, customer, specified adult as defined in s.
150 517.34(1), or account holder.
151 3. Disclose the identity of a confidential source.
152 4. Disclose investigative techniques or procedures.
153 5. Reveal a trade secret as defined in s. 688.002.
154 6. Disclose financial information or personal health or
155 medical conditions of a complainant, customer, or specified
156 adult as defined in s. 517.34(1).
157 (4) Paragraph (1)(b) is subject to the Open Government
158 Sunset Review Act in accordance with s. 119.15 and is repealed
159 October 2, 2031, unless reviewed and saved from repeal through
160 reenactment by the Legislature.
161 Section 4. The Legislature finds that it is a public
162 necessity that information in the possession of the Office of
163 Financial Regulation arising from a report of financial
164 exploitation under s. 517.34, Florida Statutes, concerning the
165 financial exploitation of specified adults be made confidential
166 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
167 Article I of the State Constitution. The exemptions from public
168 records requirements provided under s. 517.2015 (1)(b), Florida
169 Statutes, are necessary to ensure the office’s ability to
170 administer its regulatory duties while preventing unwarranted
171 damage to the good name or reputation of a specified adult or
172 jeopardizing his or her safety. Such disclosure could also
173 result in the spread of inaccurate information, which could harm
174 the specified adult. The Legislature finds that the release of
175 information in a report of financial exploitation under s.
176 517.34, Florida Statutes, which contains sensitive personal
177 nonfinancial information related to the physical and mental
178 health or condition of the exploited person could result in the
179 disclosure of personal health and medical conditions, as well as
180 the further targeting and exploitation of the specified adult.
181 Section 5. Present subsection (7) of section 560.129,
182 Florida Statutes, is redesignated as subsection (9), new
183 subsections (7) and (8) are added to that section, and
184 subsections (1), (2), and (4) of that section are reenacted, to
185 read:
186 560.129 Confidentiality.—
187 (1) Except as otherwise provided in this section, all
188 information concerning an investigation or examination conducted
189 by the office pursuant to this chapter, including any customer
190 complaint received by the office or the Department of Financial
191 Services, is confidential and exempt from s. 119.07(1) and s.
192 24(a), Art. I of the State Constitution until the investigation
193 or examination ceases to be active. For purposes of this
194 section, an investigation or examination is considered “active”
195 so long as the office or any other administrative, regulatory,
196 or law enforcement agency of any jurisdiction is proceeding with
197 reasonable dispatch and has a reasonable good faith belief that
198 action may be initiated by the office or other administrative,
199 regulatory, or law enforcement agency.
200 (2) All information obtained by the office in the course of
201 its investigation or examination which is a trade secret, as
202 defined in s. 688.002, or which is personal financial
203 information shall remain confidential and exempt from s.
204 119.07(1) and s. 24(a), Art. I of the State Constitution. If any
205 administrative, civil, or criminal proceeding against a money
206 services business, its authorized vendor, or an affiliated party
207 is initiated and the office seeks to use matter that a licensee
208 believes to be a trade secret or personal financial information,
209 such records shall be subject to an in camera review by the
210 administrative law judge, if the matter is before the Division
211 of Administrative Hearings, or a judge of any court of this
212 state, any other state, or the United States, as appropriate,
213 for the purpose of determining if the matter is a trade secret
214 or is personal financial information. If it is determined that
215 the matter is a trade secret, the matter shall remain
216 confidential. If it is determined that the matter is personal
217 financial information, the matter shall remain confidential
218 unless the administrative law judge or judge determines that, in
219 the interests of justice, the matter should become public.
220 (4) Except as necessary for the office or any other
221 administrative, regulatory, or law enforcement agency of any
222 jurisdiction to enforce the provisions of this chapter or the
223 law of any other state or the United States, a consumer
224 complaint and other information concerning an investigation or
225 examination shall remain confidential and exempt from s.
226 119.07(1) and s. 24(a), Art. I of the State Constitution after
227 the investigation or examination ceases to be active to the
228 extent that disclosure would:
229 (a) Jeopardize the integrity of another active
230 investigation;
231 (b) Reveal personal financial information;
232 (c) Reveal the identity of a confidential source; or
233 (d) Reveal investigative techniques or procedures.
234 (7) All information received by the office related to
235 cybersecurity incidents, security breaches, or an information
236 security program notification or required submission pursuant to
237 s. 560.1311 or as a result of an investigation by the office or
238 a law enforcement agency is confidential and exempt from s.
239 119.07(1) and s. 24(a), Art. I of the State Constitution.
240 Information received as a result of an investigation by the
241 office or a law enforcement agency shall remain confidential and
242 exempt until such time as the investigation is completed or
243 ceases to be active. Information that is exempt as a result of
244 an investigation shall be construed in conformity with s.
245 119.071(2)(c). This subsection is subject to the Open Government
246 Sunset Review Act in accordance with s. 119.15 and shall stand
247 repealed on October 2, 2031, unless reviewed and saved from
248 repeal through reenactment by the Legislature.
249 (8) Subsections (1), (2), and (4) are subject to the Open
250 Government Sunset Review Act in accordance with s. 119.15 and
251 shall stand repealed on October 2, 2031, unless reviewed and
252 saved from repeal through reenactment by the Legislature.
253 Section 6. (1) The Legislature finds all of the following:
254 (a) It is a public necessity that all information
255 concerning an investigation or examination of a money services
256 business conducted by the Office of Financial Regulation
257 pursuant to chapter 560, Florida Statutes, including a consumer
258 complaint, be made confidential and exempt from s. 119.07(1),
259 Florida Statutes, and s. 24(a), Article I of the State
260 Constitution until the investigation or examination ceases to be
261 active. The Legislature further finds that such information
262 should remain confidential and exempt from s. 119.07(1), Florida
263 Statutes, and s. 24(a), Article I of the State Constitution
264 after the investigation or examination ceases to be active if
265 its disclosure would jeopardize the office’s investigations by
266 revealing techniques or procedures or otherwise reveal
267 information that is being used in another investigation, or if
268 disclosure would reveal personal financial information or a
269 confidential source.
270 (b) It is a public necessity that trade secrets or personal
271 financial information obtained by the office in the course of an
272 investigation or examination pursuant to chapter 560, Florida
273 Statutes, be made confidential and exempt from s. 119.07(1),
274 Florida Statutes, and s. 24(a), Article I of the State
275 Constitution, unless an administrative law judge or circuit
276 judge determines that the release of personal financial
277 information to the public is in the interest of justice.
278 (c) It is a public necessity that information related to
279 cybersecurity incidents, data breaches, and information security
280 programs submitted to or obtained by the Office of Financial
281 Regulation be made confidential and exempt from public
282 disclosure.
283 (2) Information specified in subsection (1) is held by the
284 office in conjunction with its investigations and examinations
285 of money services businesses, which includes documents relating
286 to cybersecurity incidents, data breaches, and information
287 security programs. Premature or unrestricted release of such
288 information could compromise ongoing investigations, expose
289 system vulnerabilities, and hinder the office’s ability to
290 protect consumers and regulate money services businesses
291 effectively. Disclosure could also place affected individuals at
292 heightened risk of identity theft and financial fraud while
293 revealing trade secrets, proprietary data, and technical
294 safeguards that could be exploited by malicious actors.
295 Protecting this information ensures that entities cooperate
296 fully with regulators, encourages accurate reporting of security
297 incidents, and maintains the overall integrity of this state’s
298 financial and cybersecurity infrastructure.
299 Section 7. Present subsection (7) of section 560.129,
300 Florida Statutes, is redesignated as subsection (8), a new
301 subsection (7) is added to that section, and subsections (1),
302 (2), and (4) of that section are reenacted, to read:
303 560.129 Confidentiality.—
304 (1) Except as otherwise provided in this section, all
305 information concerning an investigation or examination conducted
306 by the office pursuant to this chapter, including any customer
307 complaint received by the office or the Department of Financial
308 Services, is confidential and exempt from s. 119.07(1) and s.
309 24(a), Art. I of the State Constitution until the investigation
310 or examination ceases to be active. For purposes of this
311 section, an investigation or examination is considered “active”
312 so long as the office or any other administrative, regulatory,
313 or law enforcement agency of any jurisdiction is proceeding with
314 reasonable dispatch and has a reasonable good faith belief that
315 action may be initiated by the office or other administrative,
316 regulatory, or law enforcement agency.
317 (2) All information obtained by the office in the course of
318 its investigation or examination which is a trade secret, as
319 defined in s. 688.002, or which is personal financial
320 information shall remain confidential and exempt from s.
321 119.07(1) and s. 24(a), Art. I of the State Constitution. If any
322 administrative, civil, or criminal proceeding against a money
323 services business, its authorized vendor, or an affiliated party
324 is initiated and the office seeks to use matter that a licensee
325 believes to be a trade secret or personal financial information,
326 such records shall be subject to an in camera review by the
327 administrative law judge, if the matter is before the Division
328 of Administrative Hearings, or a judge of any court of this
329 state, any other state, or the United States, as appropriate,
330 for the purpose of determining if the matter is a trade secret
331 or is personal financial information. If it is determined that
332 the matter is a trade secret, the matter shall remain
333 confidential. If it is determined that the matter is personal
334 financial information, the matter shall remain confidential
335 unless the administrative law judge or judge determines that, in
336 the interests of justice, the matter should become public.
337 (4) Except as necessary for the office or any other
338 administrative, regulatory, or law enforcement agency of any
339 jurisdiction to enforce the provisions of this chapter or the
340 law of any other state or the United States, a consumer
341 complaint and other information concerning an investigation or
342 examination shall remain confidential and exempt from s.
343 119.07(1) and s. 24(a), Art. I of the State Constitution after
344 the investigation or examination ceases to be active to the
345 extent that disclosure would:
346 (a) Jeopardize the integrity of another active
347 investigation;
348 (b) Reveal personal financial information;
349 (c) Reveal the identity of a confidential source; or
350 (d) Reveal investigative techniques or procedures.
351 (7) Subsections (1), (2), and (4) are subject to the Open
352 Government Sunset Review Act in accordance with s. 119.15 and
353 shall stand repealed on October 2, 2031, unless reviewed and
354 saved from repeal through reenactment by the Legislature.
355 Section 8. Effective upon becoming a law, notwithstanding
356 section 5 of this act, if section 3 of this act becomes law, the
357 amendment to s. 560.129(7), Florida Statutes, in section 5 of
358 this act may not take effect.
359 Section 9. (1) The Legislature finds all of the following:
360 (a) It is a public necessity that all information
361 concerning an investigation or examination of a money services
362 business conducted by the Office of Financial Regulation
363 pursuant to chapter 560, Florida Statutes, including a consumer
364 complaint, be made confidential and exempt from s. 119.07(1),
365 Florida Statutes, and s. 24(a), Article I of the State
366 Constitution until the investigation or examination ceases to be
367 active. The Legislature further finds that such information
368 should remain confidential and exempt from s. 119.07(1), Florida
369 Statutes, and s. 24(a), Article I of the State Constitution
370 after the investigation or examination ceases to be active if
371 its disclosure would jeopardize the office’s investigations by
372 revealing techniques or procedures or otherwise reveal
373 information that is being used in another investigation, or if
374 disclosure would reveal personal financial information or a
375 confidential source.
376 (b) It is a public necessity that trade secrets or personal
377 financial information obtained by the office in the course of an
378 investigation or examination pursuant to chapter 560, Florida
379 Statutes, be made confidential and exempt from s. 119.07(1),
380 Florida Statutes, and s. 24(a), Article I of the State
381 Constitution, unless an administrative law judge or circuit
382 judge determines that the release of personal financial
383 information to the public is in the interest of justice.
384 (2) Information specified in paragraphs (1)(a) and (b) is
385 held by the office in conjunction with its investigations and
386 examinations of money services businesses, which include virtual
387 currency kiosk businesses, as defined in s. 560.103, Florida
388 Statutes, as amended by chapter 2025-100, Laws of Florida.
389 Virtual currency kiosk businesses are thus subject to
390 investigation or examination by the office. As a result, the
391 office may receive sensitive personal and financial information
392 relating to such entities in conjunction with its duties under
393 chapter 560, Florida Statutes. An exemption from public records
394 requirements provides the same protections to virtual currency
395 kiosk businesses as are afforded to other money services
396 businesses, thereby preventing any disadvantage to these
397 similarly regulated entities in comparison to other entities
398 currently classified as money services businesses. An exemption
399 from public records requirements for reports of examinations,
400 operations, or condition, including working papers, is necessary
401 to ensure the office’s ability to effectively and efficiently
402 administer its examination and investigation duties. Examination
403 and investigation are essential components of financial
404 institutions regulation. They deter fraud and ensure the safety
405 and soundness of the financial system. Examinations and
406 investigations also provide a means of early detection of
407 violations, allowing for corrective action to be taken before
408 any harm can be done. Release of such information could
409 compromise the office’s examinations or investigations, reveal
410 investigative techniques, or result in the disclosure of an
411 individual’s personal financial information. Such disclosure
412 could also result in the release of inaccurate information,
413 which could harm the subject of the examination or
414 investigation, or otherwise impair commerce relating to money
415 services businesses. The Legislature finds that there is little
416 public benefit derived from access to such information during
417 the office’s examinations or investigations, and that the
418 exemption is narrowly tailored to allow for release except where
419 the public benefit is outweighed by harm to either the office’s
420 investigations or examinations or to individuals whose personal
421 financial information may be disclosed.
422 (3) This section shall take effect on the same date that SB
423 198 or similar legislation takes effect, if such legislation is
424 adopted in the same legislative session or an extension thereof
425 and becomes a law.
426 Section 10. (1) The Legislature finds all of the
427 following:
428 (a) It is a public necessity that all information
429 concerning an investigation or examination of a money services
430 business conducted by the Office of Financial Regulation
431 pursuant to chapter 560, Florida Statutes, including a consumer
432 complaint, be made confidential and exempt from s. 119.07(1),
433 Florida Statutes, and s. 24(a), Article I of the State
434 Constitution until the investigation or examination ceases to be
435 active. The Legislature further finds that such information
436 should remain confidential and exempt from s. 119.07(1), Florida
437 Statutes, and s. 24(a), Article I of the State Constitution
438 after the investigation or examination ceases to be active if
439 its disclosure would jeopardize the office’s investigations or
440 examinations by revealing techniques or procedures or otherwise
441 reveal information that is being used in another investigation
442 or examinations, or if disclosure would reveal personal
443 financial information or a confidential source.
444 (b) It is a public necessity that trade secrets or personal
445 financial information obtained by the office in the course of an
446 investigation or examination pursuant to chapter 560, Florida
447 Statutes, be made confidential and exempt from s. 119.07(1),
448 Florida Statutes, and s. 24(a), Article I of the State
449 Constitution, unless an administrative law judge or circuit
450 judge determines that the release of personal financial
451 information to the public is in the interest of justice.
452 (2) Information specified in paragraphs (1)(a) and (b) is
453 held by the office in conjunction with its investigations and
454 examinations of money services businesses, which include
455 qualified payment stablecoin issuers, as defined in s. 560.103,
456 Florida Statutes, as amended by chapter 2025-100, Laws of
457 Florida. Qualified payment stablecoin issuers are thus subject
458 to investigation or examination by the office. As a result, the
459 office may receive sensitive personal and financial information
460 relating to such entities in conjunction with its duties under
461 chapter 560, Florida Statutes. An exemption from public records
462 requirements provides the same protections to qualified payment
463 stablecoin issuers as are afforded to other money services
464 businesses, thereby preventing any disadvantage to these
465 similarly regulated entities in comparison to other entities
466 currently classified as money services businesses. An exemption
467 from public records requirements for reports of examinations,
468 operations, or condition, including working papers, is necessary
469 to ensure the office’s ability to effectively and efficiently
470 administer its examination and investigation duties. Examination
471 and investigation are essential components of financial
472 institutions regulation. They deter fraud and ensure the safety
473 and soundness of the financial system. Examinations and
474 investigations also provide a means of early detection of
475 violations, allowing for corrective action to be taken before
476 any harm can be done. Release of such information could
477 compromise the office’s examinations or investigations, reveal
478 investigative techniques, or result in the disclosure of an
479 individual’s personal financial information. Such disclosure
480 could also result in the release of inaccurate information,
481 which could harm the subject of the examination or
482 investigation, or otherwise impair commerce relating to money
483 services businesses. The Legislature finds that there is little
484 public benefit derived from access to such information during
485 the office’s examinations or investigations, and that the
486 exemption is narrowly tailored to allow for release except where
487 the public benefit is outweighed by harm to either the office’s
488 investigations or examinations or to individuals whose personal
489 financial information may be disclosed.
490 (3) This section shall take effect on the same date that SB
491 314 or similar legislation takes effect, if such legislation is
492 adopted in the same legislative session or an extension thereof
493 and becomes a law.
494 Section 11. Subsection (6) is added to section 655.0171,
495 Florida Statutes, as created by SB 540, 2026 Regular Session, to
496 read:
497 655.0171 Requirements for customer data security and for
498 notices of security breaches.—
499 (6) PUBLIC RECORDS EXEMPTION.—
500 (a) All information received by the office pursuant to a
501 notification required by this section, or received by the office
502 pursuant to an investigation by the office or a law enforcement
503 agency under this section, is confidential and exempt from s.
504 119.07(1) and s. 24(a), Art. I of the State Constitution.
505 Information received by the office pursuant to an investigation
506 by the office or a law enforcement agency under this section
507 shall remain confidential and exempt until such time as the
508 investigation is completed or ceases to be active. This
509 exemption shall be construed in conformity with s.
510 119.071(2)(c).
511 (b) During an active investigation, information made
512 confidential and exempt pursuant to paragraph (a) may be
513 disclosed by the office:
514 1. In the furtherance of its official duties and
515 responsibilities;
516 2. For print, publication, or broadcast if the office
517 determines that such release would assist in notifying the
518 public or locating or identifying a person that the office
519 believes to be a victim of a data breach or improper disposal of
520 customer records, except that information made confidential and
521 exempt by paragraph (c) may not be released pursuant to this
522 subparagraph; or
523 3. To another governmental entity in the furtherance of its
524 official duties and responsibilities.
525 (c) Upon completion of an investigation or once an
526 investigation ceases to be active, the following information
527 received by the office remains confidential and exempt from s.
528 119.07(1) and s. 24(a), Art. I of the State Constitution:
529 1. All information to which another public records
530 exemption applies.
531 2. Personal information.
532 3. A computer forensic report.
533 4. Information that would otherwise reveal weaknesses in a
534 financial institution’s data security.
535 5. Information that would disclose a financial
536 institution’s proprietary information.
537 a. As used in this subparagraph, the term “proprietary
538 information” means information that:
539 (I) Is owned or controlled by the financial institution.
540 (II) Is intended to be private and is treated by the
541 financial institution as private because disclosure would harm
542 the financial institution or its business operations.
543 (III) Has not been disclosed except as required by law or a
544 private agreement that provides that the information will not be
545 released to the public.
546 (IV) Is not publicly available or otherwise readily
547 ascertainable through proper means from another source in the
548 same configuration as received by the office.
549 b. The term “proprietary information” includes:
550 (I) Trade secrets as defined in s. 688.002.
551 (II) Competitive interests, the disclosure of which would
552 impair the competitive business of the financial institution
553 that is the subject of the information.
554 (d) As used in this subsection, the term “customer records”
555 means any material, regardless of the physical form, on which
556 personal information is recorded or preserved by any means,
557 including, but not limited to, written or spoken words,
558 graphically depicted, printed, or electromagnetically
559 transmitted, which is provided by an individual in this state to
560 a financial institution for the purpose of purchasing or leasing
561 a product or obtaining a service.
562 (e) This subsection is subject to the Open Government
563 Sunset Review Act in accordance with s. 119.15 and shall stand
564 repealed on October 2, 2031, unless reviewed and saved from
565 repeal through reenactment by the Legislature.
566 Section 12. The Legislature finds that it is a public
567 necessity that all information received by the Office of
568 Financial Regulation pursuant to a notification of a violation
569 of s. 655.0171, Florida Statutes, or received by the Department
570 of Legal Affairs pursuant to an investigation by the department
571 or a law enforcement agency relating to a violation of s.
572 655.0171, Florida Statutes, be made confidential and exempt from
573 s. 119.07(1), Florida Statutes, and s. 24(a), Article I of the
574 State Constitution for the following reasons:
575 (1) A notification of a violation of s. 655.0171, Florida
576 Statutes, is likely to result in an investigation. The premature
577 release of such information could frustrate or thwart the
578 investigation and impair the ability of the office to
579 effectively and efficiently administer s. 655.0171, Florida
580 Statutes. In addition, release of such information before
581 completion of an active investigation could jeopardize the
582 ongoing investigation.
583 (2) The Legislature finds that it is a public necessity to
584 continue to protect from public disclosure all information to
585 which another public record exemption applies once an
586 investigation is completed or ceases to be active. Release of
587 such information by the office would undo the specific statutory
588 exemption protecting that information.
589 (3) An investigation of a data breach or improper disposal
590 of customer records is likely to result in the gathering of
591 sensitive personal information, including social security
592 numbers, identification numbers, and personal financial
593 information of customers of financial institutions. Such
594 information could be used for the purpose of identity theft, and
595 release of such information could subject possible victims of
596 the data breach or improper disposal of customer records to
597 further financial harm.
598 (4) Release of a computer forensic report or other
599 information that would otherwise reveal weaknesses in a covered
600 financial institution’s data security could compromise the
601 future security of that financial institution, or other
602 financial institutions, if such information were available upon
603 conclusion of an investigation or once an investigation ceased
604 to be active. The release of such report or information could
605 compromise the security of current financial institutions and
606 make those financial institutions susceptible to future data
607 breaches. Release of such report or information could result in
608 the identification of vulnerabilities and further breaches of
609 that system.
610 (5) Notices received by the office and information received
611 during an investigation of a data breach are likely to contain
612 proprietary information, including trade secrets, about the
613 security of the breached system. The release of the proprietary
614 information could result in the identification of
615 vulnerabilities and further breaches of that system. In
616 addition, a trade secret derives independent, economic value,
617 actual or potential, from being generally unknown to, and not
618 readily ascertainable by, other persons. Allowing public access
619 to proprietary information, including a trade secret, through a
620 public records request could destroy the value of the
621 proprietary information and cause a financial loss to the
622 financial institution submitting the information. Release of
623 such information could give business competitors an unfair
624 advantage in the marketplace and weaken the position of the
625 financial institution supplying the proprietary information.
626 Section 13. Subsection (5) of section 655.057, Florida
627 Statutes, is amended to read:
628 655.057 Records; limited restrictions upon public access.—
629 (5)(a) The following information received by the office
630 pursuant to an application for authority to organize a new state
631 bank or new state trust company under chapter 658, or pursuant
632 to an application for authority to organize a new state credit
633 union under chapter 657, is confidential and exempt from s.
634 119.07(1) and s. 24(a), Art. I of the State Constitution:
635 1. Personal financial information.
636 2. A driver license number, a passport number, a military
637 identification number, or any other number or code issued on a
638 government document used to verify identity.
639 3. Books and records of a current or proposed financial
640 institution.
641 4. The proposed state bank’s, or proposed state trust
642 company’s, or proposed state credit union’s proposed business
643 plan.
644 (b) The personal identifying information of a proposed
645 officer or proposed director who is currently employed by, or
646 actively participates in the affairs of, another financial
647 institution received by the office pursuant to an application
648 for authority to organize a new state bank or new state trust
649 company under chapter 658, or pursuant to an application for
650 authority to organize a new state credit union under chapter
651 657, is exempt from s. 119.07(1) and s. 24(a), Art. I of the
652 State Constitution until the application is approved and the
653 charter is issued. As used in this paragraph, the term “personal
654 identifying information” means names, home addresses, e-mail
655 addresses, telephone numbers, names of relatives, work
656 experience, professional licensing and educational backgrounds,
657 and photographs.
658 (c) This subsection is subject to the Open Government
659 Sunset Review Act in accordance with s. 119.15 and is repealed
660 October 2, 2031 2029, unless reviewed and saved from repeal
661 through reenactment by the Legislature.
662 Section 14. (1)(a) The Legislature finds that it is a
663 public necessity that information received by the Office of
664 Financial Regulation pursuant to an application for authority to
665 organize a new state credit union under chapter 657, Florida
666 Statutes, be made confidential and exempt from s. 119.07(1),
667 Florida Statutes, and s. 24(a), Article I of the State
668 Constitution to the extent that disclosure would reveal:
669 1. Personal financial information;
670 2. A driver license number, a passport number, a military
671 identification number, or any other number or code issued on a
672 government document used to verify identity;
673 3. Books and records of a current or proposed financial
674 institution; or
675 4. A proposed new state credit union’s business plan and
676 any attached supporting documentation.
677 (b) The Legislature further finds that it is a public
678 necessity that the personal identifying information of a
679 proposed officer or proposed director who is currently employed
680 by, or actively participates in the affairs of, another
681 financial institution which is received by the office pursuant
682 to an application for authority to organize a new state credit
683 union under chapter 657, Florida Statutes, be made confidential
684 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
685 Article I of the State Constitution for the duration of the
686 application process, until the application is approved and a
687 charter is issued.
688 (2) The office may receive sensitive personal, financial,
689 and business information in conjunction with its duties related
690 to the review of applications for the organization or
691 establishment of new state credit unions. The exemptions from
692 public records requirements provided under subsection (1) are
693 necessary to ensure the office’s ability to administer its
694 regulatory duties while preventing unwarranted damage to the
695 proposed state credit unions or certain proposed officers or
696 proposed directors of new state credit unions in this state. The
697 release of information that could lead to the identification of
698 an individual involved in the potential establishment of a new
699 state credit union may subject such individual to retribution
700 and jeopardize his or her current employment with, or
701 participation in the affairs of, another financial institution.
702 Thus, the public availability of such information has a chilling
703 effect on the establishment of new state credit unions. Further,
704 the public availability of the books and financial records of a
705 current or proposed state credit union presents an unnecessary
706 risk of harm to the business operations of such credit union.
707 Finally, the public availability of a proposed state credit
708 union’s business plan may cause competitive harm to its future
709 business operations and presents an unfair competitive advantage
710 for existing state credit unions that are not required to
711 release such information.
712 Section 15. Effective on the same date that SB 314 or
713 similar legislation takes effect, if such legislation is adopted
714 in the same legislative session or an extension thereof and
715 becomes a law, subsection (15) is added to section 655.057,
716 Florida Statutes, and subsections (1) through (4), (6), and (10)
717 of that section are reenacted, to read:
718 655.057 Records; limited restrictions upon public access.—
719 (1) Except as otherwise provided in this section and except
720 for such portions thereof which are otherwise public record, all
721 records and information relating to an investigation by the
722 office are confidential and exempt from s. 119.07(1) and s.
723 24(a), Art. I of the State Constitution until such investigation
724 is completed or ceases to be active. For purposes of this
725 subsection, an investigation is considered “active” while such
726 investigation is being conducted by the office with a
727 reasonable, good faith belief that it may lead to the filing of
728 administrative, civil, or criminal proceedings. An investigation
729 does not cease to be active if the office is proceeding with
730 reasonable dispatch, and there is a good faith belief that
731 action may be initiated by the office or other administrative or
732 law enforcement agency. After an investigation is completed or
733 ceases to be active, portions of the records relating to the
734 investigation are confidential and exempt from s. 119.07(1) and
735 s. 24(a), Art. I of the State Constitution to the extent that
736 disclosure would:
737 (a) Jeopardize the integrity of another active
738 investigation;
739 (b) Impair the safety and soundness of the financial
740 institution;
741 (c) Reveal personal financial information;
742 (d) Reveal the identity of a confidential source;
743 (e) Defame or cause unwarranted damage to the good name or
744 reputation of an individual or jeopardize the safety of an
745 individual; or
746 (f) Reveal investigative techniques or procedures.
747 (2) Except as otherwise provided in this section and except
748 for such portions thereof which are public record, reports of
749 examinations, operations, or condition, including working
750 papers, or portions thereof, prepared by, or for the use of, the
751 office or any state or federal agency responsible for the
752 regulation or supervision of financial institutions in this
753 state are confidential and exempt from s. 119.07(1) and s.
754 24(a), Art. I of the State Constitution. However, such reports
755 or papers or portions thereof may be released to:
756 (a) The financial institution under examination;
757 (b) Any holding company of which the financial institution
758 is a subsidiary;
759 (c) Proposed purchasers if necessary to protect the
760 continued financial viability of the financial institution, upon
761 prior approval by the board of directors of such institution;
762 (d) Persons proposing in good faith to acquire a
763 controlling interest in or to merge with the financial
764 institution, upon prior approval by the board of directors of
765 such financial institution;
766 (e) Any officer, director, committee member, employee,
767 attorney, auditor, or independent auditor officially connected
768 with the financial institution, holding company, proposed
769 purchaser, or person seeking to acquire a controlling interest
770 in or merge with the financial institution; or
771 (f) A fidelity insurance company, upon approval of the
772 financial institution’s board of directors. However, a fidelity
773 insurance company may receive only that portion of an
774 examination report relating to a claim or investigation being
775 conducted by such fidelity insurance company.
776 (g) Examination, operation, or condition reports of a
777 financial institution shall be released by the office within 1
778 year after the appointment of a liquidator, receiver, or
779 conservator to the financial institution. However, any portion
780 of such reports which discloses the identities of depositors,
781 bondholders, members, borrowers, or stockholders, other than
782 directors, officers, or controlling stockholders of the
783 institution, shall remain confidential and exempt from s.
784 119.07(1) and s. 24(a), Art. I of the State Constitution.
785
786 Any confidential information or records obtained from the office
787 pursuant to this subsection shall be maintained as confidential
788 and exempt from s. 119.07(1) and s. 24(a), Art. I of the State
789 Constitution.
790 (3) Except as otherwise provided in this section and except
791 for those portions that are otherwise public record, after an
792 investigation relating to an informal enforcement action is
793 completed or ceases to be active, informal enforcement actions
794 are confidential and exempt from s. 119.07(1) and s. 24(a), Art.
795 I of the State Constitution to the extent that disclosure would:
796 (a) Jeopardize the integrity of another active
797 investigation.
798 (b) Impair the safety and soundness of the financial
799 institution.
800 (c) Reveal personal financial information.
801 (d) Reveal the identity of a confidential source.
802 (e) Defame or cause unwarranted damage to the good name or
803 reputation of an individual or jeopardize the safety of an
804 individual.
805 (f) Reveal investigative techniques or procedures.
806 (4) Except as otherwise provided in this section and except
807 for those portions that are otherwise public record, trade
808 secrets as defined in s. 688.002 which comply with s. 655.0591
809 and which are held by the office in accordance with its
810 statutory duties with respect to the financial institutions
811 codes are confidential and exempt from s. 119.07(1) and s.
812 24(a), Art. I of the State Constitution.
813 (6) This section does not prevent or restrict:
814 (a) Publishing reports that are required to be submitted to
815 the office pursuant to s. 655.045(2) or required by applicable
816 federal statutes or regulations to be published.
817 (b) Furnishing records or information to any other state,
818 federal, or foreign agency responsible for the regulation or
819 supervision of financial institutions.
820 (c) Disclosing or publishing summaries of the condition of
821 financial institutions and general economic and similar
822 statistics and data, provided that the identity of a particular
823 financial institution is not disclosed.
824 (d) Reporting any suspected criminal activity, with
825 supporting documents and information, to appropriate law
826 enforcement and prosecutorial agencies.
827 (e) Furnishing information upon request to the Chief
828 Financial Officer or the Division of Treasury of the Department
829 of Financial Services regarding the financial condition of any
830 financial institution that is, or has applied to be, designated
831 as a qualified public depository pursuant to chapter 280.
832 (f) Furnishing information to Federal Home Loan Banks
833 regarding its member institutions pursuant to an information
834 sharing agreement between the Federal Home Loan Banks and the
835 office.
836
837 Any confidential information or records obtained from the office
838 pursuant to this subsection shall be maintained as confidential
839 and exempt from s. 119.07(1) and s. 24(a), Art. I of the State
840 Constitution.
841 (10) Materials supplied to the office or to employees of
842 any financial institution by other state or federal governmental
843 agencies remain the property of the submitting agency or the
844 corporation, and any document request must be made to the
845 appropriate agency. Any confidential documents supplied to the
846 office or to employees of any financial institution by other
847 state or federal governmental agencies are confidential and
848 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
849 Constitution. Such information shall be made public only with
850 the consent of such agency or the corporation.
851 (15) Subsections (1)-(4), (6), and (10) are subject to the
852 Open Government Sunset Review Act in accordance with s. 119.15
853 and are repealed October 2, 2031, unless reviewed and saved from
854 repeal through reenactment by the Legislature.
855 Section 16. (1) The Legislature finds that it is a public
856 necessity that all records and information relating to an
857 investigation by the Office of Financial Regulation undertaken
858 pursuant to chapter 655, Florida Statutes, be made confidential
859 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
860 Article I of the State Constitution until the investigation
861 ceases to be active. The Legislature further finds that such
862 information should remain confidential and exempt from s.
863 119.07(1), Florida Statutes, and s. 24(a), Article I of the
864 State Constitution after the investigation ceases to be active
865 if its disclosure would jeopardize the office’s investigations
866 by revealing techniques or procedures, or otherwise reveal
867 information that is being used in another investigation; reveal
868 personal financial information or a confidential source; or
869 defame or cause unwarranted damage to an individual’s reputation
870 or jeopardize his or her safety.
871 (2) Information specified in s. 655.057(1)-(4), (6), and
872 (10), Florida Statutes, is held by the office in conjunction
873 with examinations and investigations of trust companies which
874 may include records concerning payment stablecoin issuer
875 products or services offered by such trust companies, as
876 authorized in s. 658.997, Florida Statutes. As a result, the
877 office may receive sensitive personal and financial information
878 relating to such trust companies in conjunction with its duties
879 under chapter 655, Florida Statutes. An exemption from public
880 records requirements provides the same protections to trust
881 companies that are qualified payment stablecoin issuers as are
882 afforded to other financial institutions, thereby preventing any
883 disadvantage to these similarly regulated entities in comparison
884 to other entities currently classified as financial
885 institutions. An exemption from public records requirements for
886 reports of examinations, operations, or condition, including
887 working papers, is necessary to ensure the office’s ability to
888 effectively and efficiently administer its examination and
889 investigation duties. Examination and investigation are
890 essential components of financial institutions regulation. They
891 deter fraud and ensure the safety and soundness of the financial
892 system. Examinations and investigations also provide a means of
893 early detection of violations, allowing for corrective action to
894 be taken before any harm can be done.
895 (3) The Legislature finds that it is a public necessity to
896 make confidential and exempt from s. 119.07(1), Florida
897 Statutes, and s. 24(a), Article I of the State Constitution
898 records and information relating to an examination or
899 investigation by the Office of Financial Regulation; portions of
900 records relating to a completed or inactive examination or
901 investigation by the office which would jeopardize the integrity
902 of another active examination or investigation, impair the
903 safety and soundness of the financial institution, reveal
904 personal financial information, reveal the identity of a
905 confidential source, defame or cause unwarranted damage to the
906 good name or reputation of an individual or jeopardize the
907 safety of an individual, or reveal investigative techniques or
908 procedures; reports of examinations, operations, or conditions,
909 including working papers, or portions thereof, prepared by, or
910 for the use of, the office or any state or federal agency
911 responsible for the regulation or supervision of financial
912 institutions in this state, until 1 year after the appointment
913 of a liquidator; any portion of such reports which discloses the
914 identities of depositors, bondholders, members, borrowers, or
915 stockholders, other than directors, officers, or controlling
916 stockholders of the institution; trade secrets held by the
917 office in accordance with its statutory duties under chapter
918 655, Florida Statutes, unless an administrative law judge or
919 circuit judge determines that the release of personal financial
920 information to the public is in the interest of justice; and
921 materials supplied to the office or to employees of any
922 financial institution by other state or federal governmental
923 agencies.
924 (4) Release of information specified in s. 655.057(1)-(4),
925 (6), and (10), Florida Statutes, could compromise the office’s
926 examinations and investigations, reveal investigative
927 techniques, result in the disclosure of an individual’s personal
928 financial information, or defame or cause unwarranted damage to
929 the good name or reputation of an individual or entity or
930 jeopardize his or her safety. Such disclosure could also result
931 in the spread of inaccurate information, which could harm the
932 subject of the examination or investigation, or otherwise impair
933 commerce conducted by financial institutions in this state. Any
934 portion of a record or information relating to an examination or
935 investigation which reveals personal financial information or
936 the identity of a confidential source may defame, or cause
937 unwarranted damage to the good name or reputation of, those
938 individuals, or jeopardize their safety.
939 (5) A trade secret derives independent economic value,
940 actual or potential, from not being generally known to, and not
941 readily ascertainable by, other persons who can obtain economic
942 value from the disclosure or use of the trade secret. Without an
943 exemption for a trade secret held by the office in accordance
944 with its duties prescribed by chapter 655, Florida Statutes,
945 that trade secret becomes a public record when received and must
946 be divulged upon request. Divulging a trade secret under the
947 public records law would give business competitors an unfair
948 advantage and destroy the value of that property, causing a
949 financial loss to the person or entity submitting the trade
950 secret and weakening the position of that person or entity in
951 the marketplace.
952 (6) The Legislature finds that there is little public
953 benefit derived from access to such information during the
954 office’s examinations or investigations, and that the exemption
955 is narrowly tailored to allow for release except where the
956 public benefit is outweighed by harm to individuals or
957 institutions, when the disclosure would jeopardize other
958 examinations or investigations, reveal the office’s
959 investigative techniques or procedures, or expose personal
960 financial information or a confidential source.
961 (7) This section shall take effect on the same date that SB
962 314 or similar legislation takes effect, if such legislation is
963 adopted in the same legislative session or an extension thereof
964 and becomes a law.
965 Section 17. Effective on the same date that SB 314 or
966 similar legislation takes effect, if such legislation is adopted
967 in the same legislative session or an extension thereof and
968 becomes a law, subsection (7) of section 655.50, Florida
969 Statutes, is amended, and paragraph (d) of subsection (5) of
970 this section is reenacted, to read:
971 655.50 Florida Control of Money Laundering and Terrorist
972 Financing in Financial Institutions Act.—
973 (5) A financial institution shall keep a record of each
974 financial transaction occurring in this state known to it which
975 involves currency or other monetary instrument, as the
976 commission prescribes by rule, has a value greater than $10,000,
977 and involves the proceeds of specified unlawful activity, or is
978 designed to evade the reporting requirements of this section,
979 chapter 896, or similar state or federal law, or which the
980 financial institution reasonably believes is suspicious
981 activity. Each financial institution shall maintain appropriate
982 procedures to ensure compliance with this section, chapter 896,
983 and other similar state or federal law. Any report of suspicious
984 activity made pursuant to this subsection is entitled to the
985 same confidentiality provided under 31 C.F.R. s. 1020.320,
986 whether the report or information pertaining to or identifying
987 the report is in the possession or control of the office or the
988 reporting institution.
989 (d) Each financial institution shall file a report of the
990 records required under this subsection with the office. Each
991 report shall be filed at such time and must contain such
992 information as the commission requires by rule.
993 (7) All reports and records filed with the office pursuant
994 to this section are confidential and exempt from s. 119.07(1)
995 and s. 24(a), Art. I of the State Constitution. However, the
996 office shall provide any report filed pursuant to this section,
997 or information contained therein, to federal, state, and local
998 law enforcement and prosecutorial agencies, and any federal or
999 state agency responsible for the regulation or supervision of
1000 financial institutions.
1001 Section 18. (1) The Legislature finds that it is a public
1002 necessity that all reports and records filed with the Office of
1003 Financial Regulation be made confidential and exempt from s.
1004 119.07(1), Florida Statutes, and s. 24(a), Article I of the
1005 State Constitution unless disclosure is requested by a federal,
1006 state, or local law enforcement or prosecutorial agency or any
1007 federal or state agency responsible for the regulation or
1008 supervision of financial institutions. Information regarding
1009 potential money laundering or terrorism must be safeguarded to
1010 prevent the potential offender from being tipped off or
1011 circumventing an investigation conducted by the office, and
1012 disclosure of such information could harm the office’s
1013 investigations.
1014 (2) These reports and records are held by the office in
1015 conjunction with its duties pursuant to 31 U.S.C. s. 5313 and 31
1016 C.F.R. part 1020 and its examinations or investigations of trust
1017 companies’ transactions involving monetary instruments
1018 concerning payment stablecoin products or services offered by
1019 such companies, as authorized in s. 658.997, Florida Statutes,
1020 to include any transactions involving payment stablecoin
1021 products or services offered by such financial institutions. As
1022 a result, the office may receive sensitive personal and
1023 financial information relating to such entities in conjunction
1024 with its duties under chapter 655, Florida Statutes. An
1025 exemption from public records requirements provides the same
1026 protections to trust companies that hold a certificate of
1027 authority as a qualified payment stablecoin issuer as are
1028 afforded to other financial institutions, thereby preventing any
1029 disadvantage to these similarly regulated entities in comparison
1030 to other entities currently classified as financial
1031 institutions. An exemption from public records requirements for
1032 reports and records submitted to the office is necessary to
1033 ensure the office’s ability to effectively and efficiently
1034 administer its investigation duties. Examination and
1035 investigation are essential components of financial institutions
1036 regulation. They deter fraud and ensure the safety and soundness
1037 of the financial system. Examinations and investigations also
1038 provide a means of early detection of violations, allowing for
1039 corrective action to be taken before any harm can be done.
1040 (3) This section shall take effect on the same date that SB
1041 314 or similar legislation takes effect, if such legislation is
1042 adopted in the same legislative session or an extension thereof
1043 and becomes a law.
1044 Section 19. Except as otherwise expressly provided in this
1045 act and except for this section, which shall take effect upon
1046 becoming a law, this act shall take effect on the same date that
1047 SB 540 or similar legislation takes effect, if such legislation
1048 is adopted in the same legislative session or an extension
1049 thereof and becomes a law.