The Florida Senate
BILL ANALYSIS AND FISCAL IMPACT STATEMENT
(This document is based on the provisions contained in the legislation as of the latest date listed below.)
Prepared By: The Professional Staff of the Committee on Military and Veterans Affairs, Space, and Domestic Security
BILL: CS\SB 1694
INTRODUCER: Committee on Military and Veterans Affairs, Space, and Domestic Security, and Senator
Hutson
SUBJECT: Public Records/Criminal Intelligence Information or Criminal Investigative Information
DATE: February 8, 2022
ANALYST STAFF DIRECTOR REFERENCE ACTION
1. Lloyd Caldwell MS CS\Fav
2. AEG
3. AP
Please see Section IX. for Additional Information:
COMMITTEE SUBSTITUTE - Substantial Changes
I. Summary:
CS/SB 1694 creates a public records and meetings exemption for information relating to a
cybersecurity incident or ransomware incident held by a political subdivision or state agency to
the extent that a disclosure of such information would facilitate unauthorized access to or the
unauthorized modification, disclosure, or destruction of physical or virtual data or information
technology resources as defined in the exemption. The bill:
Allows for information which has been made confidential and exempt under s.
119.07(1), F.S., and Art. I, of the State Constitution to be disclosed in limited
circumstances by a political subdivision or state agency in the furtherance of it’s or
the other agency’s official or statutory duties or responsibilities;
Prohibits any portion of an exempt public meeting from being off the record; and
Requires any portion of an exempted public meeting to be recorded and transcribed.
The exemption provided under CS/SB 1694 shall stand repealed effective October 2, 2027,
unless reviewed and saved from repeal through reenactment by the Legislature.
CS/SB 1694 provides a statement of public necessity that the public records exemption is
necessary as disclosure of information relating to cybersecurity and ransomware incidents held
by a political subdivision or the state could include information that could facilitate unauthorized
access to, or modification, disclosure or destruction of information, information technology, or
REVISED: BILL: CS\SB 1694 Page 2
information resources. CS/SB 1694 includes a statement of public necessity for the closure of
public meetings where any portion of a meeting discloses confidential and exempt information
making the meeting exempt from s. 286.011, F.S.
The effective date of this act is the same date on which CS/SB 1670 or similar legislation takes
effect, if such legislation takes effect in the same legislative session or an extension thereof and
becomes a law.
II. Present Situation:
Access to Public Records - Generally
The Florida Constitution provides that the public has the right to inspect or copy records made or
received in connection with official governmental business.
1
The right to inspect or copy applies
to the official business of any public body, officer, or employee of the state, including all three
branches of state government, local governmental entities, and any person acting on behalf of the
government.
2
Additional requirements and exemptions related to public records are found in various statutes
and rules, depending on the branch of government involved. For instance, s. 11.0431, F.S.,
provides public access requirements for legislative records. Relevant exemptions are codified in
s. 11.0431(2)-(3), F.S., and adopted in the rules of each house of the legislature.
3
Florida Rule of
Judicial Administration 2.420 governs public access to judicial branch records.
4
Lastly, chapter
119, F.S., known as the Public Records Act, provides requirements for public records held by
executive agencies.
Executive Agency Records – The Public Records Act
The Public Records Act provides that all state, county, and municipal records are open for
personal inspection and copying by any person, and that providing access to public records is a
duty of each agency.
5
Section 119.011(12), F.S., defines “public records” to include:
All documents, papers, letters, maps, books, tapes, photographs, films,
sound recordings, data processing software, or other material, regardless of
the physical form, characteristics, or means of transmission, made or
1
FLA. CONST. art. I, s. 24(a).
2
Id.
3
See Rule 1.48, Rules and Manual of the Florida Senate, (2018-2020) and Rule 14.1, Rules of the Florida House of
Representatives, Edition 2, (2018-2020)
4
State v. Wooten, 260 So. 3d 1060 (Fla. 4
th
DCA 2018).
5
Section 119.01(1), F.S. Section 119.011(2), F.S., defines “agency” as “any state, county, district, authority, or municipal
officer, department, division, board, bureau, commission, or other separate unit of government created or established by law
including, for the purposes of this chapter, the Commission on Ethics, the Public Service Commission, and the Office of
Public Counsel, and any other public or private agency, person, partnership, corporation, or business entity acting on behalf
of any public agency.” BILL: CS\SB 1694 Page 3
received pursuant to law or ordinance or in connections with the transaction
of official business by any agency.
The Florida Supreme Court has interpreted this definition to encompass all materials made or
received by an agency in connection with official business that are used to “perpetuate,
communicate, or formalize knowledge of some type.”
6
The Florida Statutes specify conditions under which public access to public records must be
provided. The Public Records Act guarantees every person’s right to inspect and copy any public
record at any reasonable time, under reasonable conditions, and under supervision by the
custodian of the public record.
7
A violation of the Public Records Act may result in civil or
criminal liability.
8
The Legislature may exempt public records from public access requirements by passing a
general law by a two-thirds vote of both the House and the Senate.
9
The exemption must state
with specificity the public necessity justifying the exemption and must be no broader than
necessary to accomplish the stated purpose of the exemption.
10
General exemptions from the public records requirements are contained in the Public Records
Act.
11
Specific exemptions often are placed in the substantive statutes relating to a particular
agency or program.
12
When creating a public records exemption, the Legislature may provide that a record is “exempt”
or “confidential and exempt.” There is a difference between records the Legislature has
determined to be exempt from the Public Records Act and those which the Legislature has
determined to be exempt from the Public Records Act and confidential.
13
Records designated as
“confidential and exempt” are not subject to inspection by the public and may only be released
under the circumstances defined by statute.
14
Records designated as “exempt” may be released at
the discretion of the records custodian under certain circumstances.
15
6
Shevin v. Byron, Harless, Schaffer, Reid and Assoc., Inc., 379 So. 2d 633, 640 (Fla. 1980).
7
Section 119.07(1)(a), F.S.
8
Section 119.10, F.S. Public records laws are found throughout the Florida Statutes, as are the penalties for violating those
laws.
9
FLA. CONST. art. I, s. 24(c).
10
Id. See, e.g., Halifax Hosp. Medical Center v. News-Journal Corp., 724 So. 2d 567 (Fla. 1999) (holding that a public
meetings exemption was unconstitutional because the statement of public necessity did not define important terms and did
not justify the breadth of the exemption); Baker County Press, Inc. v. Baker County Medical Services, Inc., 870 So. 2d 189
(Fla. 1st DCA 2004) (holding that a statutory provision written to bring another party within an existing public records
exemption is unconstitutional without a public necessity statement).
11
See, e.g., s. 119.071(1)(a), F.S. (exempting from public disclosure examination questions and answer sheets of
examinations administered by a governmental agency for the purpose of licensure).
12
See, e.g., s. 213.053(2)(a), F.S. (exempting from public disclosure information contained in tax returns received by the
Department of Revenue).
13
WFTV, Inc. v. The Sch. Bd. of Seminole County, 874 So. 2d 48, 53 (Fla. 5
th
DCA 2004).
14
Id.
15
Williams v. City of Minneola, 575 So. 2d 683 (Fla. 5th DCA 1991). BILL: CS\SB 1694 Page 4
Open Meetings Laws
The Florida Constitution provides that the public has a right to access governmental meetings.
16
Each collegial body must provide notice of its meetings to the public and permit the public to
attend any meeting at which official acts are taken or at which public business is transacted or
discussed.
17
This applies to the meetings of any collegial body of the executive branch of state
government, counties, municipalities, school districts, or special districts.
18
Public policy regarding access to government meetings also is addressed in the Florida Statutes.
Section 286.011, F.S., known as the “Government in the Sunshine Law,”
19
or the “Sunshine
Law,”
20
requires all meetings of any board or commission of any state or local agency or
authority at which official acts are to be taken be open to the public.
21
The board or commission
must provide the public reasonable notice of such meetings.
22
Public meetings may not be held at
any location that discriminates on the basis of sex, age, race, creed, color, origin, or economic
status or which operates in a manner that unreasonably restricts the public’s access to the
facility.
23
Minutes of a public meeting must be promptly recorded and open to public
inspection.
24
Failure to abide by open meetings requirements will invalidate any resolution, rule,
or formal action adopted at a meeting.
25
A public officer or member of a governmental entity
who violates the Sunshine Law is subject to civil and criminal penalties.
26
The Legislature may create an exemption to open meetings requirements by passing a general
law by at least a two-thirds vote of each house of the Legislature.
27
The exemption must
explicitly lay out the public necessity justifying the exemption and must be no broader than
necessary to accomplish the stated purpose of the exemption.
28
A statutory exemption which
does not meet these two criteria may be unconstitutional and may not be judicially saved.
29
16
Art. I, s. 24(b), Fla. Const.
17
Id.
18
Id. Meetings of the Legislature are governed by Article III, section 4(e) of the Florida Constitution, which states: “The
rules of procedure of each house shall further provide that all prearranged gatherings, between more than two members of the
legislature, or between the governor, the president of the senate, or the speaker of the house of representatives, the purpose of
which is to agree upon formal legislative action that will be taken at a subsequent time, or at which formal legislative action
is taken, regarding pending legislation or amendments, shall be reasonably open to the public.”
19
Times Pub. Co. v. Williams, 222 So. 2d 470, 472 (Fla. 2d DCA 1969).
20
Board of Public Instruction of Broward County v. Doran, 224 So. 2d 693, 695 (Fla. 1969).
21
Section 286.011(1)-(2), F.S.
22
Id.
23
Section 286.011(6), F.S.
24
Section 286.011(2), F.S.
25
Section 286.011(1), F.S.
26
Section 286.011(3), F.S.
27
Art. I, s. 24(c), Fla. Const.
28
Id.
29
Halifax Hosp. Medical Center v. New-Journal Corp., 724 So. 2d 567 (Fla. 1999). In Halifax Hospital, the Florida Supreme
Court found that a public meetings exemption was unconstitutional because the statement of public necessity did not define
important terms and did not justify the breadth of the exemption. Id. at 570. The Florida Supreme Court also declined to
narrow the exemption in order to save it. Id. In Baker County Press, Inc. v. Baker County Medical Services, Inc., 870 So. 2d
189 (Fla. 1st DCA 2004), the court found that the intent of a public records statute was to create a public records exemption.
The Baker County Press court found that since the law did not contain a public necessity statement, it was unconstitutional.
Id. at 196. BILL: CS\SB 1694 Page 5
The Open Government Sunset Review Act (Act) prescribes a legislative review process for
newly created or substantially amended public records exemptions,
30
with specified exceptions.
31
It requires the automatic repeal of such exemption on October 2nd of the fifth year after creation
or substantial amendment, unless the Legislature reenacts the exemption.
32
The Act provides that
a public records exemption may be created or maintained only if it serves an identifiable public
purpose and is no broader than is necessary to meet such public purpose.
33
Open Government Sunset Review Act
The provisions of s. 119.15, F.S., known as the Open Government Sunset Review Act
34
(the
Act), prescribe a legislative review process for newly created or substantially amended
35
public
records or open meetings exemptions, with specified exceptions.
36
The Act requires the repeal of
such exemption on October 2nd of the fifth year after creation or substantial amendment, unless
the Legislature reenacts the exemption.
37
The Act provides that a public records or open meetings exemption may be created or
maintained only if it serves an identifiable public purpose and is no broader than is necessary.
38
An exemption serves an identifiable purpose if it meets one of the following purposes and the
Legislature finds that the purpose of the exemption outweighs open government policy and
cannot be accomplished without the exemption:
It allows the state or its political subdivisions to effectively and efficiently administer a
governmental program, and administration would be significantly impaired without the
exemption;
39
It protects sensitive, personal information, the release of which would be defamatory, cause
unwarranted damage to the good name or reputation of the individual, or would jeopardize
the individual’s safety. If this public purpose is cited as the basis of an exemption, however,
only personal identifying information is exempt;
40
or
It protects information of a confidential nature concerning entities, such as trade or business
secrets.
41
30
Section 119.15, F.S. An exemption is substantially amended if the amendment expands the scope of the exemption to
include more records or information or to include meetings as well as records (s. 119.15(4)(b), F.S.). The requirements of the
Act do not apply to an exemption that is required by federal law or that applies solely to the Legislature or the State Court
System (s. 119.15(2), F.S.).
31
Section 119.15(2)(a) and (b), F.S., provide that exemptions that are required by federal law or are applicable solely to the
Legislature or the State Court System are not subject to the Open Government Sunset Review Act.
32
Section 119.15(3), F.S.
33
Section 119.15(6)(b), F.S.
34
Section 119.15, F.S.
35
An exemption is considered to be substantially amended if it is expanded to include more records or information or to
include meetings as well as records. Section 119.15(4)(b), F.S.
36
Section 119.15(2)(a) and (b), F.S., provides that exemptions required by federal law or applicable solely to the Legislature
or the State Court System are not subject to the Open Government Sunset Review Act.
37
Section 119.15(3), F.S.
38
Section 119.15(6)(b), F.S.
39
Section 119.15(6)(b)1., F.S.
40
Section 119.15(6)(b)2., F.S.
41
Section 119.15(6)(b)3., F.S. BILL: CS\SB 1694 Page 6
The Act also requires specified questions to be considered during the review process.
42
In
examining an exemption, the Act directs the Legislature to question the purpose and necessity of
reenacting the exemption.
If the exemption is continued and expanded, then a public necessity statement and a two-thirds
vote for passage are required.
43
If the exemption is continued without substantive changes or if
the exemption is continued and narrowed, then a public necessity statement and a two-thirds vote
for passage are not required. If the Legislature allows an exemption to expire, the previously
exempt records will remain exempt unless otherwise provided by law.
44
III. Effect of Proposed Changes:
A public records and meeting exemption is added to s. 282.3185, F.S., as newly created in the
linked substantive bill, CS/SB1670, as subsection (3).
Public Records Exemption
The public records exemption under CS/SB 1694 makes confidential and exempt from public
records inspection and copying those records held by a state agency or political subdivision
relating to cybersecurity or ransomware incidents to the extent that disclosure of such
information would facilitate unauthorized access to the unauthorized modification, disclosure, or
destruction of:
Data or information, whether physical or virtual; or
Information technology resources, including but not limited to:
o Security of local government resources, processes, and practices designed to
protect networks, computers, data processing software, and data from attack,
damage, or unauthorized access; and
o Information relating to a local government’s existing or proposed information
technology systems.
Information that is made confidential and exempt may be disclosed by another a state agency or
political subdivision or to another state agency or political subdivision in furtherance of its
official duties and responsibilities.
42
Section 119.15(6)(a), F.S. The specified questions are:
What specific records or meetings are affected by the exemption?
Whom does the exemption uniquely affect, as opposed to the general public?
What is the identifiable public purpose or goal of the exemption?
Can the information contained in the records or discussed in the meeting be readily obtained by alternative means?
If so, how?
Is the record or meeting protected by another exemption?
Are there multiple exemptions for the same type of record or meeting that it would be appropriate to merge?
43
See generally s. 119.15, F.S.
44
Section 119.15(7), F.S. BILL: CS\SB 1694 Page 7
Public Meetings Exemption
The bill also creates a meetings exemption establishing that any portion of a meeting that would
reveal information which has been made confidential and exempt under this bill is exempt from
s. 286.011, F.S. and s. 24(b), Art. I of the State Constitution. The bill prohibits any portion of an
exempted meeting from being off the record and requires a recording and transcript of any closed
meeting. The recording and the transcript are also confidential and exempt under s. 119.07(1),
F.S. and s. 24(a)., Art. I of the State Constitution.
Review Date
The exemptions created under CS/SB 1694 are subject to the Open Government Sunshine Review
Act and shall stand repealed as of October 2, 2027, unless reviewed and saved from repeal
through reenactment by the Legislature.
Statement of Important Public Necessity and Importance
The Legislature finds that this public records and meetings exemption serves an important public
necessity as the information held by a political subdivision or a state agency as relating to
cybersecurity or ransomware incidents, if released, could allow others to identify vulnerabilities
in the computer network systems of state agencies and political subdivisions. Identification of
these vulnerabilities could facilitate the unauthorized access, modification, disclosure, or
destruction of data, information, or information technology in government network systems and
could impair the administration of vital programs.
The Legislature also finds that the public meetings exemption in CS/SB 1694 is a public
necessity and that any portion of a meeting in which confidential and exempt information is
discussed should be exempt from s. 286.011, F.S., and art. 2(b), of the State Constitution. The
failure to close that portion of the meeting would defeat the underlying purpose of the exemption
and could result in the release of highly sensitive information relating to cybersecurity incidents
and ransomware incidents in state or political subdivision computer network systems.
The Legislature states the public records and meetings exemptions are of the utmost importance
and are a public necessity.
The public records exemption shall take effect upon the same date as the effective date of CS/SB
1670 or similar legislation, if such legislation is adopted in the same legislative session or an
extension thereof and becomes law.
IV. Constitutional Issues:
A. Municipality/County Mandates Restrictions:
None.
B. Public Records/Open Meetings Issues:
Vote Requirement BILL: CS\SB 1694 Page 8
Article I, s. 24(c) of the State Constitution requires a two-thirds vote of the members
present and voting for final passage of a bill creating or expanding an exemption to the
public records and meetings requirements. This bill enacts new public records and
meeting exemptions covering cybersecurity and ransomware incidents where information
such as computer network systems, local government technology, data, and transcripts or
recordings of any portions of meetings in which the covered subjects or data and its
impact on state agencies and local governments is discussed.
Public Necessity Statement
Article I, s. 24(c) of the State Constitution requires a bill creating or expanding an
exemption to the public records requirements to state with specificity the public necessity
justifying the exemption. Section 2 of the bill contains statements of public necessity for
the exemption by the Legislature, including a finding this exemption serves an important
public necessity as information held by a political subdivision or a state agency as
relating to cybersecurity or ransomware incidents, if released, could allow others to
identify vulnerabilities in these computer network systems and facilitate further
unauthorized breaches into the state’s or political subdivision’s data, information,
information technology resources. Identification of additional vulnerabilities of political
subdivisions and state agencies are identified specifically in CS/SB 1670 should the data
and resources from a cybersecurity or ransomware incident not be protected as are the
potentially consequences should such information be publicly available.
CS/SB 1694 also provided a statement of public necessity for closed public meetings
when confidential and exempt information relating to the cybersecurity and ransomware
incidents are discussed. Any recordings and transcripts from these meetings in which
exempt information is discussed is also made confidential and exempt. The meetings
exemption is drawn to close only that portion of any meeting in which the confidential
information is discussed and requires that closed meetings be transcribed and recorded.
The Legislature states that public records and meetings exemptions in CS/SB 1694 are of
the utmost importance and are a public necessity.
Breadth of Exemption
Article I, s. 24(c) of the State Constitution requires an exemption to the public records
requirements to be no broader than necessary to accomplish the stated purpose of the law.
The purpose of the proposed exemption is to protect data that may have been involved in
data breaches, mitigate future data breaches that may involve the same entity, and ensure
the security of the existing computer systems, computer network, or electronic devices.
This bill draws a narrow exemption for specific types of data and information technology
tools held by state agencies and local governments. Furthermore, CS/SB 1694 requires
the transcription of any closed meeting as a records of events should there any questions
later and for certain meetings, a recording is also required. BILL: CS\SB 1694 Page 9
C. Trust Funds Restrictions:
None.
D. State Tax or Fee Increases:
None.
E. Other Constitutional Issues:
None.
V. Fiscal Impact Statement:
A. Tax/Fee Issues:
None.
B. Private Sector Impact:
If information is protected from public release, more individuals or entities that are the
subject of cybersecurity attacks or ransomware incidents may come forward to law
enforcement or state agencies for assistance.
C. Government Sector Impact:
Disclosure of cybersecurity and ransomware incidents can expose state agencies and
political subdivisions to future attacks as such information and data can make these
entities vulnerable helping to facilitate the unauthorized access to or modification of state
and local governmental entity computer networks and systems. Release of data and
information can result in further data breaches as these vulnerabilities become public.
If information is protected from public release, more individuals or entities that are the
subject of cybersecurity attacks or ransomware incidents may come forward to law
enforcement or state agencies for assistance.
VI. Technical Deficiencies:
None.
VII. Related Issues:
None.
VIII. Statutes Affected:
This bill substantially amends section 282.3185 of the Florida Statutes. BILL: CS\SB 1694 Page 10
IX. Additional Information:
A. Committee Substitute – Statement of Substantial Changes:
(Summarizing differences between the Committee Substitute and the prior version of the bill.)
CS by Committee on Military and Veterans Affairs, Space, and Domestic Security
on February 8, 2022:
CS/SB 1694 narrows the public records and meetings exemption for information relating
to a cybersecurity incident or ransomware incident held by a political subdivision or state
agency to the extent that a disclosure of such information would facilitate unauthorized
access to or the unauthorized modification, disclosure, or destruction of physical or
virtual data or information technology resources as defined in the exemption.
CS/SB 1694:
Allows for information which has been made confidential and exempt under s.
119.07(1), F.S., and Art. I, of the State Constitution to be disclosed in limited
circumstances by a political subdivision or state agency in the furtherance of it’s or
the other agency’s official duties;
Prohibits any portion of an exempt public meeting from being off the record;
Requires any portion of an exempted public meeting to be recorded and transcribed;
Maintains the repeal effective date of October 2, 2027, unless reviewed and saved
from repeal through reenactment by the Legislature;
Provides a revised statement of public necessity that the public records exemption is
necessary as disclosure of information relating to cybersecurity and ransomware
incidents held by a political subdivision or the state could include information that
could facilitate unauthorized access to, or modification, disclosure or destruction of
information, information technology, or information resources;
Includes a statement of public necessity relating to the closure of public meetings
where any portion of a meeting in which this confidential and exempt information is
discussed be made exempt from s. 286.011, F.S., including any recordings or
transcripts; and
Adds the linked substantive bill number, CS/SB 1670.
B. Amendments:
None.
This Senate Bill Analysis does not reflect the intent or official position of the bill’s introducer or the Florida Senate.