Bill Text: FL S0222 | 2015 | Regular Session | Comm Sub

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Electronic Commerce

Spectrum: Slight Partisan Bill (? 3-1)

Status: (Passed) 2015-05-15 - Chapter No. 2015-14 [S0222 Detail]

Download: Florida-2015-S0222-Comm_Sub.html

---

       Florida Senate - 2015                CS for CS for CS for SB 222
       
       
        
       By the Committees on Judiciary; Communications, Energy, and
       Public Utilities; and Commerce and Tourism; and Senator Hukill
       
       
       
       
       590-03273-15                                           2015222c3
    1                        A bill to be entitled                      
    2         An act relating to electronic commerce; providing a
    3         directive to the Division of Law Revision and
    4         Information; creating the “Computer Abuse and Data
    5         Recovery Act”; creating s. 668.801, F.S.; providing a
    6         statement of purpose; creating s. 668.802, F.S.;
    7         defining terms; creating s. 668.803, F.S.; prohibiting
    8         a person from intentionally committing specified acts
    9         without authorization with respect to a protected
   10         computer; providing penalties for a violation;
   11         creating s. 668.804, F.S.; specifying remedies for
   12         civil actions brought by persons affected by a
   13         violation; providing that specified criminal judgments
   14         or decrees against a defendant act as estoppel as to
   15         certain matters in specified civil actions; providing
   16         that specified civil actions must be filed within
   17         certain periods of time; creating s. 668.805, F.S.;
   18         providing that the act does not prohibit specified
   19         activity by certain state, federal, and foreign law
   20         enforcement agencies, regulatory agencies, and
   21         political subdivisions; providing that the act does
   22         not impose liability on specified providers in certain
   23         circumstances; providing an effective date.
   24          
   25  Be It Enacted by the Legislature of the State of Florida:
   26  
   27         Section 1. The Division of Law Revision and Information is
   28  directed to create part V of chapter 668, Florida Statutes,
   29  consisting of ss. 668.801-668.805, Florida Statutes, to be
   30  entitled the “Computer Abuse and Data Recovery Act.”
   31         Section 2. Section 668.801, Florida Statutes, is created to
   32  read:
   33         668.801 Purpose.—This part shall be construed liberally to:
   34         (1) Safeguard an owner, operator, or lessee of a protected
   35  computer used in the operation of a business from harm or loss
   36  caused by unauthorized access to such computer.
   37         (2) Safeguard an owner of information stored in a protected
   38  computer used in the operation of a business from harm or loss
   39  caused by unauthorized access to such computer.
   40         Section 3. Section 668.802, Florida Statutes, is created to
   41  read:
   42         668.802 Definitions.—As used in this part, the term:
   43         (1) “Authorized user” means, with respect to a protected
   44  computer: a director, officer, employee, third-party agent,
   45  contractor, or consultant of the owner, operator, or lessee of
   46  the computer or the owner of information stored in the protected
   47  computer if the director, officer, employee, third-party agent,
   48  contractor, or consultant is granted access to the protected
   49  computer by the owner, operator, or lessee of the protected
   50  computer or by the owner of information stored in such protected
   51  computer through a technological access barrier.
   52  
   53  If the owner, operator, or lessee of the protected computer or
   54  the owner of information stored in the protected computer
   55  provides a director, officer, employee, third-party agent,
   56  contractor, or consultant with a technological access barrier
   57  within the scope of his or her employment, the owner, operator,
   58  or lessee of the computer or the owner of information stored in
   59  the protected computer gives explicit permission to the
   60  director, officer, employee, third-party agent, contractor, or
   61  consultant to use the technological access barrier and
   62  establishes the director, officer, employee, third-party agent,
   63  contractor, or consultant as an authorized user. Such
   64  permission, however, is terminated upon cessation of his or her
   65  employment.
   66         (2) “Business” means any trade or business regardless of
   67  its for-profit or not-for-profit status.
   68         (3) “Computer” means an electronic, magnetic, optical,
   69  electrochemical, or other high-speed data processing device that
   70  performs logical, arithmetic, or storage functions and includes
   71  any data storage facility, data storage device, or
   72  communications facility directly related to, or operating in
   73  conjunction with, the device.
   74         (4) “Harm” means any impairment to the integrity, access,
   75  or availability of data, programs, systems, or information.
   76         (5) “Loss” means any of the following:
   77         (a) Any reasonable cost incurred by the owner, operator, or
   78  lessee of a protected computer or the owner of stored
   79  information, including the reasonable cost of conducting a
   80  damage assessment for harm associated with the violation and the
   81  reasonable cost for remediation efforts, such as restoring the
   82  data, programs, systems, or information to the condition it was
   83  in before the violation.
   84         (b) Economic damages.
   85         (c) Lost profits.
   86         (d) Consequential damages, including the interruption of
   87  service.
   88         (e) Profits earned by a violator as a result of the
   89  violation.
   90         (6) “Protected computer” means a computer that is used in
   91  connection with the operation of a business and stores
   92  information, programs, or code in connection with the operation
   93  of the business in which the stored information, programs, or
   94  code can be accessed only by employing a technological access
   95  barrier.
   96         (7) “Technological access barrier” means a password,
   97  security code, token, key fob, access device, or similar
   98  measure.
   99         (8) “Traffic” means to sell, purchase, or deliver.
  100         (9) “Without authorization” means access to a protected
  101  computer by a person who:
  102         (a) Is not an authorized user;
  103         (b) Has stolen a technological access barrier of an
  104  authorized user; or
  105         (c) Circumvents a technological access barrier on a
  106  protected computer without the express or implied permission of
  107  the owner, operator, or lessee of the computer or the express or
  108  implied permission of the owner of information stored in the
  109  protected computer. The term does not include circumventing a
  110  technological measure that does not effectively control access
  111  to the protected computer or the information stored in the
  112  protected computer.
  113         Section 4. Section 668.803, Florida Statutes, is created to
  114  read:
  115         668.803 Prohibited acts.—A person who knowingly and with
  116  intent to cause harm or loss:
  117         (1) Obtains information from a protected computer without
  118  authorization and, as a result, causes harm or loss;
  119         (2) Causes the transmission of a program, code, or command
  120  to a protected computer without authorization and, as a result
  121  of the transmission, causes harm or loss; or
  122         (3) Traffics in any technological access barrier through
  123  which access to a protected computer may be obtained without
  124  authorization,
  125  
  126  is liable to the extent provided in s. 668.804 in a civil action
  127  to the owner, operator, or lessee of the protected computer, or
  128  the owner of information stored in the protected computer who
  129  uses the information in connection with the operation of a
  130  business.
  131         Section 5. Section 668.804, Florida Statutes, is created to
  132  read:
  133         668.804 Remedies.—
  134         (1) A person who brings a civil action for a violation
  135  under s. 668.803 may:
  136         (a) Recover actual damages, including the person’s lost
  137  profits and economic damages.
  138         (b) Recover the violator’s profits that are not included in
  139  the computation of actual damages under paragraph (a).
  140         (c) Obtain injunctive or other equitable relief from the
  141  court to prevent a future violation of s. 668.803.
  142         (d) Recover the misappropriated information, program, or
  143  code, and all copies thereof, that are subject to the violation.
  144         (2) A court shall award reasonable attorney fees to the
  145  prevailing party in any action arising under this part.
  146         (3) The remedies available for a violation of s. 668.803
  147  are in addition to remedies otherwise available for the same
  148  conduct under federal or state law.
  149         (4) A final judgment or decree in favor of the state in any
  150  criminal proceeding under chapter 815 shall estop the defendant
  151  in any subsequent action brought pursuant to s. 668.803 as to
  152  all matters as to which the judgment or decree would be an
  153  estoppel as if the plaintiff had been a party in the previous
  154  criminal action.
  155         (5) A civil action filed under s. 668.803 must be commenced
  156  within 3 years after the violation occurred or within 3 years
  157  after the violation was discovered or should have been
  158  discovered with due diligence.
  159         Section 6. Section 668.805, Florida Statutes, is created to
  160  read:
  161         668.805 Exclusions.—This part does not prohibit any
  162  lawfully authorized investigative, protective, or intelligence
  163  activity of any law enforcement agency, regulatory agency, or
  164  political subdivision of this state, any other state, the United
  165  States, or any foreign country. This part may not be construed
  166  to impose liability on any provider of an interactive computer
  167  service as defined in 47 U.S.C. 230(f), of an information
  168  service as defined in 47 U.S.C. 153, or of a communications
  169  service as defined in s. 202.11, if the provider provides the
  170  transmission, storage, or caching of electronic communications
  171  or messages of a person other than the provider, related
  172  telecommunications or commercial mobile radio services, or
  173  content provided by a person other than the provider.
  174         Section 7. This act shall take effect October 1, 2015.