Bill Text: FL S1648 | 2023 | Regular Session | Engrossed

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Public Records/Investigations by the Department of Legal Affairs and Law Enforcement Agencies

Spectrum: Slight Partisan Bill (? 2-1)

Status: (Passed) 2023-06-20 - Chapter No. 2023-262, companion bill(s) passed, see CS/CS/SB 262 (Ch. 2023-201) [S1648 Detail]

Download: Florida-2023-S1648-Engrossed.html

---

       CS for CS for SB 1648                            First Engrossed
       
       
       
       
       
       
       
       
       20231648e1
       
    1                        A bill to be entitled                      
    2         An act relating to public records; amending ss.
    3         501.1735 and 501.722, F.S.; providing exemptions from
    4         public records requirements for information relating
    5         to investigations by the Department of Legal Affairs
    6         and law enforcement agencies of certain data privacy
    7         violations; providing for future legislative review
    8         and repeal of the exemptions; providing statements of
    9         public necessity; providing a contingent effective
   10         date.
   11          
   12  Be It Enacted by the Legislature of the State of Florida:
   13  
   14         Section 1. Subsection (6) is added to section 501.1735,
   15  Florida Statutes, as created by SB 262 or similar legislation,
   16  2023 Regular Session, to read:
   17         501.1735 Protection of children in online spaces.—
   18         (6) PUBLIC RECORDS EXEMPTION.—
   19         (a) All information received by the department pursuant to
   20  a notification of a violation under this section, or received by
   21  the department pursuant to an investigation by the department or
   22  a law enforcement agency of a violation of this section, is
   23  confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
   24  of the State Constitution, until such time as the investigation
   25  is completed or ceases to be active. This exemption shall be
   26  construed in conformity with s. 119.071(2)(c).
   27         (b) During an active investigation, information made
   28  confidential and exempt pursuant to paragraph (a) may be
   29  disclosed by the department:
   30         1. In the furtherance of its official duties and
   31  responsibilities;
   32         2. For print, publication, or broadcast if the department
   33  determines that such release would assist in notifying the
   34  public or locating or identifying a person that the department
   35  believes to be a victim of a data breach or an improper use or
   36  disposal of customer records, except that information made
   37  confidential and exempt by paragraph (c) may not be released
   38  pursuant to this subparagraph; or
   39         3. To another governmental entity in the furtherance of its
   40  official duties and responsibilities.
   41         (c) Upon completion of an investigation or once an
   42  investigation ceases to be active, the following information
   43  received by the department shall remain confidential and exempt
   44  from s. 119.07(1) and s. 24(a), Art. I of the State
   45  Constitution:
   46         1. All information to which another public records
   47  exemption applies.
   48         2. Personal information.
   49         3. A computer forensic report.
   50         4. Information that would otherwise reveal weaknesses in
   51  the data security of an online platform.
   52         5. Information that would disclose the proprietary
   53  information of an online platform.
   54         (d) For purposes of this section, the term “proprietary
   55  information” means information that:
   56         1. Is owned or controlled by the online platform.
   57         2. Is intended to be private and is treated by the online
   58  platform as private because disclosure would harm the online
   59  platform or its business operations.
   60         3. Has not been disclosed except as required by law or a
   61  private agreement that provides that the information will not be
   62  released to the public.
   63         4. Is not publicly available or otherwise readily
   64  ascertainable through proper means from another source in the
   65  same configuration as received by the department.
   66         5. Includes:
   67         a. Trade secrets as defined in s. 688.002.
   68         b. Competitive interests, the disclosure of which would
   69  impair the competitive advantage of the online platform who is
   70  the subject of the information.
   71         (e) This section is subject to the Open Government Sunset
   72  Review Act in accordance with s. 119.15 and shall stand repealed
   73  on October 2, 2028, unless reviewed and saved from repeal
   74  through reenactment by the Legislature.
   75         Section 2. The Legislature finds that it is a public
   76  necessity that all information received by the Department of
   77  Legal Affairs pursuant to a notification of a violation of s.
   78  501.1735, Florida Statutes, or received by the department
   79  pursuant to an investigation by the department or a law
   80  enforcement agency of a violation of that section, be made
   81  confidential and exempt from s. 119.07(1), Florida Statutes, and
   82  s. 24(a), Article I of the State Constitution for the following
   83  reasons:
   84         (1) A notification of a violation of s. 501.1735, Florida
   85  Statutes, may result in an investigation of such violation. The
   86  premature release of such information could frustrate or thwart
   87  the investigation and impair the ability of the department to
   88  effectively and efficiently administer s. 501.1735, Florida
   89  Statutes. In addition, release of such information before
   90  completion of an active investigation could jeopardize the
   91  ongoing investigation.
   92         (2) Release of information to which another public records
   93  exemption applies once an investigation is completed or ceases
   94  to be active would undo the specific statutory exemption
   95  protecting that information.
   96         (3) An investigation of a violation of s. 501.1735, Florida
   97  Statutes, is likely to result in the gathering of sensitive
   98  personal information, including identification numbers, unique
   99  identifiers, professional or employment-related information, and
  100  personal financial information. Such information could be used
  101  for the purpose of identity theft. The release of such
  102  information could subject possible victims of data privacy
  103  violations to further harm.
  104         (4) Notices received by the department and information
  105  received during an investigation of a violation of s. 501.1735,
  106  Florida Statutes, are likely to contain proprietary information.
  107  Such information, including trade secrets, derives independent,
  108  economic value, actual or potential, from being generally
  109  unknown to, and not readily ascertainable by, other persons who
  110  might obtain economic value from its disclosure or use. Allowing
  111  public access to proprietary information, including a trade
  112  secret, through a public records request could destroy the value
  113  of the proprietary information and cause a financial loss to the
  114  online platform. Release of such information could give business
  115  competitors an unfair advantage.
  116         (5) Information received by the department may contain a
  117  computer forensic report or information that could reveal
  118  weaknesses in the data security of an online platform. The
  119  release of this information could result in the identification
  120  of vulnerabilities in the cybersecurity system of the online
  121  platform and be used to harm the online platform and clients.
  122         (6) The harm that may result from the release of
  123  information received by the department pursuant to a
  124  notification or investigation by the department or a law
  125  enforcement agency of a violation of s. 501.1735, Florida
  126  Statutes, could impair the effective and efficient
  127  administration of the investigation and thus, outweighs the
  128  public benefit that may be derived from the disclosure of the
  129  information.
  130         Section 3. Section 501.722, Florida Statutes, is created
  131  and incorporated into part V of chapter 501, Florida Statutes,
  132  as created by SB 262 or similar legislation, 2023 Regular
  133  Session, to read:
  134         501.722 Public records exemption.—
  135         (1) All information received by the department pursuant to
  136  a notification of a violation under this part, or received by
  137  the department pursuant to an investigation by the department or
  138  a law enforcement agency of a violation of this part, is
  139  confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
  140  of the State Constitution, until such time as the investigation
  141  is completed or ceases to be active. This exemption shall be
  142  construed in conformity with s. 119.071(2)(c).
  143         (2) During an active investigation, information made
  144  confidential and exempt pursuant to subsection (1) may be
  145  disclosed by the department:
  146         (a) In the furtherance of its official duties and
  147  responsibilities;
  148         (b) For print, publication, or broadcast if the department
  149  determines that such release would assist in notifying the
  150  public or locating or identifying a person that the department
  151  believes to be a victim of a data breach or an improper use or
  152  disposal of customer records, except that information made
  153  confidential and exempt by subsection (3) may not be released
  154  pursuant to this paragraph; or
  155         (c) To another governmental entity in the furtherance of
  156  its official duties and responsibilities.
  157         (3) Upon completion of an investigation or once an
  158  investigation ceases to be active, the following information
  159  received by the department shall remain confidential and exempt
  160  from s. 119.07(1) and s. 24(a), Art. I of the State
  161  Constitution:
  162         (a) All information to which another public records
  163  exemption applies.
  164         (b) Personal information.
  165         (c) A computer forensic report.
  166         (d) Information that would otherwise reveal weaknesses in
  167  the data security of a controller, processor, or third party.
  168         (e) Information that would disclose the proprietary
  169  information of a controller, processor, or third party.
  170         (4) For purposes of this section, the term “proprietary
  171  information” means information that:
  172         (a) Is owned or controlled by the controller, processor, or
  173  third party.
  174         (b) Is intended to be private and is treated by the
  175  controller, processor, or third party as private because
  176  disclosure would harm the controller, processor, or third party
  177  or its business operations.
  178         (c) Has not been disclosed except as required by law or a
  179  private agreement that provides that the information will not be
  180  released to the public.
  181         (d) Is not publicly available or otherwise readily
  182  ascertainable through proper means from another source in the
  183  same configuration as received by the department.
  184         (e) Includes:
  185         1. Trade secrets as defined in s. 688.002.
  186         2. Competitive interests, the disclosure of which would
  187  impair the competitive advantage of the controller, processor,
  188  or third party who is the subject of the information.
  189         (5) This section is subject to the Open Government Sunset
  190  Review Act in accordance with s. 119.15 and shall stand repealed
  191  on October 2, 2028, unless reviewed and saved from repeal
  192  through reenactment by the Legislature.
  193         Section 4. The Legislature finds that it is a public
  194  necessity that all information received by the Department of
  195  Legal Affairs pursuant to a notification of a violation of part
  196  V of chapter 501, Florida Statutes, or received by the
  197  department pursuant to an investigation by the department or a
  198  law enforcement agency of a violation of that part, be made
  199  confidential and exempt from s. 119.07(1), Florida Statutes, and
  200  s. 24(a), Article I of the State Constitution for the following
  201  reasons:
  202         (1) A notification of a violation of part V of chapter 501,
  203  Florida Statutes, may result in an investigation of such
  204  violation. The premature release of such information could
  205  frustrate or thwart the investigation and impair the ability of
  206  the department to effectively and efficiently administer part V
  207  of chapter 501, Florida Statutes. In addition, release of such
  208  information before completion of an active investigation could
  209  jeopardize the ongoing investigation.
  210         (2) Release of information to which another public records
  211  exemption applies once an investigation is completed or ceases
  212  to be active would undo the specific statutory exemption
  213  protecting that information.
  214         (3) An investigation of a violation of part V of chapter
  215  501, Florida Statutes, is likely to result in the gathering of
  216  sensitive personal information, including identification
  217  numbers, unique identifiers, professional or employment-related
  218  information, and personal financial information. Such
  219  information could be used for the purpose of identity theft. The
  220  release of such information could subject possible victims of
  221  data privacy violations to further harm.
  222         (4) Notices received by the department and information
  223  received during an investigation of a violation of part V of
  224  chapter 501, Florida Statutes, are likely to contain proprietary
  225  information. Such information, including trade secrets, derives
  226  independent, economic value, actual or potential, from being
  227  generally unknown to, and not readily ascertainable by, other
  228  persons who might obtain economic value from its disclosure or
  229  use. Allowing public access to proprietary information,
  230  including a trade secret, through a public records request could
  231  destroy the value of the proprietary information and cause a
  232  financial loss to the controller, processor, or third party.
  233  Release of such information could give business competitors an
  234  unfair advantage.
  235         (5) Information received by the department may contain a
  236  computer forensic report or information that could reveal
  237  weaknesses in the data security of a controller, processor, or
  238  third party. The release of this information could result in the
  239  identification of vulnerabilities in the cybersecurity system of
  240  the controller, processor, or third party and be used to harm
  241  the controller, processor, or third party and clients.
  242         (6) The harm that may result from the release of
  243  information received by the department pursuant to a
  244  notification or investigation by the department or a law
  245  enforcement agency of a violation of part V of chapter 501,
  246  Florida Statutes, could impair the effective and efficient
  247  administration of the investigation and thus, outweighs the
  248  public benefit that may be derived from the disclosure of the
  249  information.
  250         Section 5. This act shall take effect on the same date that
  251  SB 262 or similar legislation takes effect, if such legislation
  252  is adopted in the same legislative session or an extension
  253  thereof and becomes a law.