This document does not reflect the intent or official position of the bill sponsor or House of Representatives.
STORAGE NAME: h1549z.DOCX
DATE: 5/9/2023
HOUSE OF REPRESENTATIVES STAFF FINAL BILL ANALYSIS
BILL #: CS/HB 1549 Pub. Rec./Investigations by the Department of Legal Affairs
SPONSOR(S): Regulatory Reform & Economic Development Subcommittee, McFarland
TIED BILLS: CS/HB 1547 IDEN./SIM. BILLS: CS/CS/SB 1648
FINAL HOUSE FLOOR ACTION: 113 Y’s
0 N’s GOVERNOR’S ACTION: Pending
SUMMARY ANALYSIS
CS/HB 1549 passed the House on May 3, 2023, as CS/CS/SB 1648, as amended. The bill was amended in the
Senate on May 4, 2023, and returned to the House. The House concurred in the Senate amendments, and
subsequently passed the bill as amended on May 4, 2023.
As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to contextualize
consumer data. Businesses use it for a range of purposes. The European Union, California, Virginia, and a few
other states have enacted data privacy regulations to protect consumers’ personal information and give
consumers more control over how their information is used.
CS/CS/SB 262, to which this bill is linked, gives certain consumer rights related to personal data, including the
right to access personal data collected about them; the right to delete or correct their personal data; the right to
opt-out of the sale of their personal data to third parties; and online platform protections for children. The
Department of Legal Affairs (DLA), upon belief that any person or online platform is in violation of CS/CS/SB
262’s provisions, may bring an action under the Florida Unfair or Deceptive Trade Practices Act.
This bill provides that all information received by DLA pursuant to a notification or investigation by DLA or a law
enforcement agency of a violation is confidential and exempt from public record requirements. The bill provides
that the information may be released by DLA during an active investigation:
• In the furtherance of its official duties and responsibilities;
• For print, publication, or broadcast to notify the public of a data breach; or
• To another governmental entity in the furtherance of the receiving entity’s official duties and
responsibilities.
Once an investigation is completed, the following information remains confidential and exempt:
• All information to which another public records exemption applies;
• Personal information;
• A computer forensic report;
• Information that would otherwise reveal weaknesses in data security; and
• Information that would otherwise disclose proprietary information.
The bill provides that the public records exemption is subject to the Open Government Sunset Review Act and
will repeal on October 2, 2028, unless reviewed and saved from repeal through reenactment by the
Legislature.
Subject to the Governor’s veto powers, the bill is effective at the same time as CS/SB 1648.
STORAGE NAME: h1549z.DOCX PAGE: 2
DATE: 5/9/2023
I. SUBSTANTIVE INFORMATION
A. EFFECT OF CHANGES:
Present Situation
Public Records
Article I, s. 24(a) of the State Constitution sets forth the state’s public policy regarding access to
government records. This section guarantees every person a right to inspect or copy any public record
of the legislative, executive, and judicial branches of government.
1
The Legislature, however, may
provide by general law for the exemption of records from these requirements provided the exemption
passes by two-thirds vote of each chamber, states with specificity the public necessity justifying the
exemption, and is no broader than necessary to meet its public purpose.
2
Public policy regarding access to government records is also addressed by statute. Section 119.07(1),
F.S., guarantees every person a right to inspect and copy any state, county, or municipal record, unless
the record is exempt.
3
Furthermore, the Open Government Sunset Review Act
4
provides that a public
record exemption may be created or maintained only if it serves an identifiable public purpose that is
sufficiently compelling to override the strong public policy of open government and that cannot be
accomplished without the exemption.
5
An identifiable public purpose is served if the exemption meets
one of the following purposes:
Allows the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption;
Protects sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision; or
Protects trade or business secrets.
6
The Open Government Sunset Review Act requires the automatic repeal of a newly created exemption
on October 2nd of the fifth year after creation or substantial amendment, unless the Legislature
reenacts the exemption.
7
Technology Transparency
As technologies that capture and analyze data proliferate, so, too, do businesses' abilities to
contextualize consumer data. Businesses use it for a range of purposes, including better understanding
day-to-day operations, making more informed business decisions and learning about their customers.
8
The European Union, several other countries, California, and a few other states have enacted data
privacy regulations to protect such data and give consumers more control over how their information is
used. Florida does not have a broad data privacy law, but there is a law which governs what actions
must be taken by certain government and business entities in the event of a data breach of personal
information.
9
1
Art. I, s. 24(a), FLA. CONST.
2
Art. I, s. 24(c), FLA. CONST.
3
A “public record exemption” means a provision of general law which provides that a specified record, or portion thereof, is not subject
to the access requirements of s. 119.07(1), F.S., or s. 24, Art. I of the State Constitution. See s. 119.011(8), F.S.
4
S. 119.15, F.S.
5
S. 119.15(6)(b), F.S.
6
Id.
7
S. 119.15(3), F.S.
8
Max Freedman, How Businesses Are Collecting Data (And What They’re Doing With It), Business News Daily (Jun. 17, 2020)
https://www.businessnewsdaily.com/10625-businesses-collecting-data.html. (last visited Mar. 31, 2023)
9
S. 501.171, F.S.
STORAGE NAME: h1549z.DOCX PAGE: 3
DATE: 5/9/2023
Department of Legal Affairs
The Office of the Attorney General, also known as the Department of Legal Affairs (DLA), provides a
wide variety of legal services, including defending the state in civil litigation cases, representing the
people of Florida in criminal appeals in state and federal courts, protecting rights of children,
consumers, and victims through its various protection programs, and investigating and litigating against
businesses that seek to limit competition and defraud taxpayers.
10
CS/HB 1547
CS/HB 1547, to which this bill is linked, gives certain consumer rights related to personal information,
including:
• The right to access personal data collected on them by a controller;
• The right to delete or correct their personal data; and
• The right to opt-out of the sale of their personal data to third parties.
A “controller” is a for profit entity doing business in Florida that:
Collects and controls personal information;
Has global annual gross revenues in excess of $1 billion; and
Satisfies one of the following thresholds:
o Derives 50 percent or more of its global annual revenues from providing targeted
advertising or the sale of ads online.
o Operates a consumer smart speaker and voice command component service with an
integrated virtual assistant connected to a cloud computing service that uses hands-free
verbal activation. A consumer smart speaker and voice command component service
does not include a motor vehicle or speaker or device associated with or connected to a
vehicle.
o Operates an app store or a digital distribution platform that offers at least 250,000
different software applications for consumers to download and install.
Under the bill, personal information is information that identifies, relates to, or describes a particular
consumer or household, or is reasonably capable of being directly or indirectly associated or linked
with, a particular consumer or household. The term does not include public information from
government records, certain employment information, or deidentified or aggregate consumer
information.
The bill provides certain operational requirements on controllers with respect to collecting, selling, or
sharing personal data with processors or third parties.
Also, the bill provides that online platforms that are predominantly accessed by children may not,
except under certain circumstances:
Process personal information of or profile a child.
Collect, sell, share, or retain personal information or geolocation of a child.
Use a child’s personal information for any unstated reason.
Use dark patterns to obtain more information of a child than necessary.
Use collected information to estimate age for any other reason.
DLA, upon belief that any person or online platform is in violation of the bill, may bring an action under
the Florida Unfair or Deceptive Trade Practices Act.
10
OPPAGA, Office of the Attorney General (Department of Legal Affairs),
https://oppaga.fl.gov/ProgramSummary/ProgramDetail?programNumber=1026 (last visited Mar. 31, 2023).
STORAGE NAME: h1549z.DOCX PAGE: 4
DATE: 5/9/2023
Effect of Proposed Changes
The bill creates a public record exemption for all information received by DLA pursuant to a notification
or investigation by DLA or a law enforcement agency of a violation of certain statutory requirements.
Such information is made confidential and exempt
11
from public record requirements.
During an active investigation, information made confidential and exempt may be disclosed by DLA:
In the furtherance of its official duties and responsibilities;
• For print, publication, or broadcast if DLA determines that such release would assist in notifying
the public or locating or identifying a person that DLA believes to be a victim of a data breach or
improper use or disposal of customer records, except that information made confidential and
exempt after an investigation may not be released in this manner; or
• To another governmental entity in the furtherance of the receiving entity’s official duties and
responsibilities.
Once an investigation is completed or once an investigation ceases to be active, the following
information received by DLA remains confidential and exempt:
All information to which another public records exemption applies;
Personal information;
A computer forensic report;
Information that would otherwise reveal weaknesses in a person’s or online platform’s data
security; and
Information that would otherwise disclose a person’s or online platform’s proprietary information.
The bill defines the term "proprietary information" to mean information that:
Is owned or controlled by the person or online platform;
Is intended to be private and is treated by the person or online platform as private because
disclosure would harm the person or online platform or its business operations;
Has not been disclosed except as required by law or a private agreement that provides that the
information will not be released to the public;
Is not publicly available or otherwise readily ascertainable through proper means from another
source in the same configuration as received by DLA; and
Includes trade secrets and competitive interests.
The bill provides a public necessity statement as required by article I, s. 24(c) of the Florida
Constitution. The public necessity statement provides that, if released, information received by DLA
pursuant to an investigation by DLA or a law enforcement agency could:
Frustrate or thwart the investigation and impair the ability of DLA to perform assigned functions;
Undo a specific statutory exemption protecting the information;
Be used for the purpose of identity theft;
Result in the identification of vulnerabilities; and
Result in economic harm.
The bill provides that the public record exemption is subject to the Open Government Sunset Review
Act and will repeal on October 2, 2028, unless the Legislature reviews and reenacts the exemption by
that date.
11
There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
deems confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain circumstances.
See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied 892 So.2d 1015 (Fla. 2004); City of
Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA 1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5
th
DCA 1991). If
the Legislature designates a record as confidential and exempt from public disclosure, such record may not be released by the
custodian of public records, to anyone other than the persons or entities specifically designated in statute. See Op. Att’y Gen. Fla.
(1985).
STORAGE NAME: h1549z.DOCX PAGE: 5
DATE: 5/9/2023
The bill will become effective on the same date that CS/HB 1547 or similar legislation takes effect, if
such legislation is adopted in the same legislative session or an extension thereof and becomes a law.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
See Fiscal Comments.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
The bill may have a minimal fiscal impact on DLA because agency staff responsible for complying with
public records requests may require training related to the creation of the public record exemption. DLA
could incur costs associated with redacting the confidential and exempt information prior to releasing a
record. The costs, however, would be absorbed by existing resources, as they are part of the day-to-
day responsibilities of agencies.