This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives.
STORAGE NAME: h7045.RRS
DATE: 1/30/2024
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 7045 PCB EEG 24-06 OGSR/Department of the Lottery
SPONSOR(S): Ethics, Elections & Open Government Subcommittee, Porras
TIED BILLS: IDEN./SIM. BILLS: CS/SB 7008
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
Orig. Comm.: Ethics, Elections & Open Government
Subcommittee
15 Y, 0 N Poreda Toliver
1) Regulatory Reform & Economic Development
Subcommittee
Wright Anstead
2) State Affairs Committee
SUMMARY ANALYSIS
The Open Government Sunset Review Act requires the Legislature to review each public record exemption
and each public meeting exemption five years after enactment. If the Legislature does not reenact the
exemption, it automatically repeals on October 2
nd
of the fifth year after enactment.
The Florida Constitution permits the state to create lotteries, the proceeds from which are required to be
deposited in a State Education Lotteries Trust Fund. The Department of the Lottery (department) was
established to operate the state lottery with the purpose of maximizing revenues in a manner consonant with
the dignity of the state and the welfare of its citizens.
In 2019, the Legislature created public record exemptions for certain information held by the department
relating to its operations and processes. Specifically, the following information is protected from disclosure that,
if released, could harm the security or integrity of the department:
Information relating to the security of the department’s information technology security.
Security information or information that would reveal security measures of the department.
Information about lottery games, tickets, inventory, and promotions for games.
Information concerning terminals, machines, and devices that issue tickets.
Current law also protects the following department information, regardless of whether the information could
harm the security or integrity of the department:
Information that must be maintained as confidential in order for the department to participate in a multi-
state lottery association or game.
Personal identifying information obtained by the department when processing background
investigations of current or potential retailers or vendors.
Financial information about an entity that is not publicly available and is provided to the department in
connection with its review of the financial responsibility of the entity.
In 2022, the Legislature passed CS/HB 7057, which created a general public record exemption — applicable to
all agencies — for certain information related to cybersecurity. Pursuant to the OGSR act, the exemption for
cybersecurity information will repeal on October 2, 2027, unless reviewed and saved from repeal by the
Legislature.
The bill extends the repeal date for the department’s information technology security exemption to October 2,
2027, to coincide with the future OGSR repeal date of the general cybersecurity exemption in statute. The bill
saves from repeal the remaining public record exemptions under review relating to the department. Each of the
exemptions will repeal on October 2, 2024, if this bill does not become law.
The bill does not appear to have a fiscal impact on state government or local governments. STORAGE NAME: h7045.RRS PAGE: 2
DATE: 1/30/2024
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Background
Open Government Sunset Review Act
The Open Government Sunset Review Act (OGSR Act)
1
sets forth a legislative review process for
newly created or substantially amended public record or public meeting exemptions. It requires an
automatic repeal of the exemption on October 2nd of the fifth year after creation or substantial
amendment, unless the Legislature reenacts the exemption.
2
The OGSR Act provides that a public record or public meeting exemption may be created or maintained
only if it serves an identifiable public purpose. In addition, it may be no broader than is necessary to
meet one of the following purposes:
Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
Protect trade or business secrets.
3
If, and only if, in reenacting an exemption that will repeal, the exemption is expanded, then a public
necessity statement and a two-thirds vote for passage are required.
4
If the exemption is reenacted with
grammatical or stylistic changes that do not expand the exemption, if the exemption is narrowed, or if
an exception to the exemption is created,
then a public necessity statement and a two-thirds vote for
passage are not required.
Department of the Lottery
The Florida Constitution initially prohibited “[l]otteries, other than the types of pari-mutuel pools
authorized by law.”
5
However, in 1986, Florida voters approved an amendment to the Florida
Constitution that specifically authorizes the state to operate lotteries, the proceeds from which are
required to be deposited in a State Education Lotteries Trust Fund.
6
The Legislature, soon thereafter,
passed legislation to implement the constitutional provision
7
in order to enable “the people of the state
to benefit from significant additional moneys for education” and “to play the best lottery games
available.”
8
The Department of the Lottery (department)
9
was established in 1987 to operate the state lottery with
the purpose of maximizing revenues in a manner consonant with the dignity of the state and the welfare
of its citizens.
10
It was the Legislature’s intent that the department be self-supporting, revenue-
producing, and function as much as possible as an entrepreneurial business.
11
The department is
headed by a secretary appointed by the Governor, subject to the confirmation of the Senate.
12
The
1
Section 119.15, F.S.
2
Section 119.15(3), F.S.
3
Section 119.15(6)(b), F.S.
4
Article I, s. 24(c), FLA. CONST.
5
Article X, s. 7, FLA. CONST.
6
Article X, s. 15, FLA. CONST.
7
Chapter 24, F.S. and Chapter 87-65, L.O.F
8
Id.
9
Section 24.102, F.S.
10
Section 24.104, F.S.
11
Section 24.102(2), F.S.
12
Section 20.317(1)(a), F.S. STORAGE NAME: h7045.RRS PAGE: 3
DATE: 1/30/2024
department is authorized to adopt rules governing the establishment and operation of the state lottery.
13
Florida began offering lottery games in 1988, with a $1 weekly drawing.
14
Since then, the Lottery has
grown to include approximately 13,500 retailer locations across the state with lottery tickets ranging
from $1 to $50
15
and total ticket sales of $9.325 billion.
16
Current Public Record Exemptions related to the Department
The name of a winner of a prize valued at $250,000 or more is confidential and exempt
17
from public
record requirements for 90- days from the date the prize is claimed, unless the winner consents to the
release of his or her name.
18
The department is also required to maintain the confidentiality of the street
address and telephone number of a game winner, which are confidential and exempt from public record
requirements, unless the winner consents to the release of the information.
19
The department must disclose any confidential and exempt information to the Auditor General, to the
Office of Program Policy Analysis and Government Accountability, or to the lottery’s independent
auditor upon his or her request.
20
In addition, if the President of the Senate or the Speaker of the House
of Representatives certifies that confidential information is necessary for effecting legislative changes,
the requested information must be disclosed to him or her, and he or she may disclose such
information to members of the Legislature and legislative staff as necessary to affect such purpose.
21
Current law provides that any person who, with intent to defraud or with intent to provide a financial or
other advantage to himself, herself, or another, knowingly and willfully discloses any confidential and
exempt information relating to the lottery is guilty of a first-degree felony.
22
Cybersecurity Public Record Exemption
In 2022, the Legislature passed CS/HB 7057, which created a general public record exemption —
applicable to all agencies
23
— for the certain information related to cybersecurity.
24
Specifically, CS/HB
7057, which was codified as s. 119.0725, F.S., protected the following information:
Information related to critical infrastructure.
25
Network schematics, hardware and software configurations, or encryption information or
information that identifies detection, investigation, or response practices for suspected or
confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure
13
Section 24.105(9), F.S.
14
Florida Lottery, History, available at https://www.flalottery.com/history (last visited Jan. 15, 2024).
15
Id.
16
OPPAGA, Review of the Florida Lottery, 2022, available at https://oppaga.fl.gov/Documents/Reports/23-02.pdf (last visited Jan. 15,
2024). Ticket sales figure based on Fiscal Year 2021-2022.
17
There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
designates confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain
circumstances. See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied, 892 So.2d 1015 (Fla.
2004); State v. Wooten, 260 So. 3d 1060, 1070 (Fla. 4th DCA 2018); City of Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA
1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5th DCA 1991). If the Legislature designates a record as confidential
and exempt from public disclosure, such record may not be released by the custodian of public records to anyone other than the
persons or entities specifically designated in statute. See Op. Att’y Gen. Fla. 04- 09 (2004).
18
Section 24.1051(3)(a), F.S. However, the name of a winner must be provided pursuant to s. 24.115, F.S., regarding persons owing
child support and s. 409.2577, F.S., regarding the parent locator service to locate parents that have deserted their children.
19
Section 24.1051(2), F.S.
20
Section 24.1051(4), F.S.
21
Section 24.105(12)(c), F.S.
22
A first-degree felony is punishable by up to thirty years imprisonment and a fine of up to $10,000. Sections 755.082 and 755.083,
F.S.
23
“Agency” means any state, county, district, authority, or municipal officer, department, division, board, bureau, commission, or
other separate unit of government created or established by law including, for the purposes of ch. 119, F.S., the Commission on Ethics,
the Public Service Commission, and the Office of Public Counsel, and any other public or private agency, person, partnership,
corporation, or business entity acting on behalf of any public agency. Section 119.011(2), F.S.
24
See s. 119.0725, F.S.
25
“Critical infrastructure” means existing and proposed information technology and operation technology systems and assets, whether
physical and virtual, the incapacity or destruction of which would negatively affect security, economic security, public health, or
public safety. Section 119.0725(1)(b), F.S. STORAGE NAME: h7045.RRS PAGE: 4
DATE: 1/30/2024
of such information would facilitate unauthorized access to or unauthorized modification,
disclosure, or destruction of:
o Data or information, whether physical or virtual; or
o Information technology (I.T.) resources, which include an agency’s existing or proposed
I.T. systems.
Coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation
coverages acquired for the protection of IT systems, operational technology (OT) systems, or
data of an agency.
Cybersecurity incident information contained in certain reports.
CS/HB 7057 (2022) also created a public meeting exemption for any portion of a meeting that would
reveal the confidential and exempt information; however, any portion of an exempt meeting must be
recorded and transcribed.
26
The recording and transcript are confidential and exempt from public record
requirements.
27
Pursuant to the OGSR act, the exemption for cybersecurity information will repeal on October 2, 2027,
unless reviewed and saved from repeal by the Legislature.
Public Record Exemptions under Review
In 2019, the Legislature created public record exemptions for certain information held by the
department related the department’s cybersecurity, information technology, information about lottery
games, personal identifying information of retailers and vendors for the purposes of background
investigations, and certain financial information of vendors. The following information is exempt from
public record requirements if release could harm the security or integrity of the department:
Information relating to the security of the department’s technologies, processes, and practices
designed to protect networks, computers, data processing software, data, and data systems
from attack, damage, or unauthorized access.
Security information or information that would reveal security measures of the department,
whether physical or virtual.
Information about lottery games, tickets, inventory, and promotions for games, including
description, design, production, printing, packaging, shipping, delivery, storage, and validation
of such games, promotions, tickets, stock.
Information concerning terminals, machines, and devices that issue tickets.
Current law also makes the following information exempt, regardless of whether release could harm the
security or integrity of the department:
Information that must be maintained as confidential in order for the department to participate in
a multi-state lottery association or game.
Personal identifying information obtained by the department when processing background
investigations of current or potentials retailers or vendors.
Financial information about an entity that is not publicly available and is provided to the
department in connection with its review of the financial responsibility of the entity, provided that
the entity marks such information as confidential.
28
The protected information must be released to the Auditor General, the Office of Program Policy
Analysis and Government Accountability, and to the lottery’s independent auditor, upon his or her
request.
29
The information may be released to other governmental entities as needed in connection
with performance of their duties.
30
26
Section 119.0725(3), F.S.
27
Id.
28
Id.
29
Section 24.1051(4), F.S.
30
Section 24.1051(1)(c), F.S. STORAGE NAME: h7045.RRS PAGE: 5
DATE: 1/30/2024
In 2019, the public necessity statements
31
for the public record exemptions provide the following:
32
I.T. Security Information.
Ensuring the security and integrity of lottery operations safeguards against
players gaining an unfair advantage over other players and enables the
department to operate in a manner consistent with the dignity of the state
lottery. If such security information were made available to the public, the
integrity and efficiency of the lottery would be jeopardized and the effective
and efficient administration of the lottery would be significantly impaired.
Multistate Game Information
The department is authorized to enter into agreements with other states for
the operation and promotion of a multistate lottery and without the
exemption, the department would be unable to join certain associations and
games, thus causing the state to miss opportunities to generate revenue
for education. As a result, the effective and efficient administration of the
lottery would be significantly impaired if the confidentiality of these records
is not maintained.
Personal Identifying Information relating to Background Investigations
The release of such sensitive personal information could cause great
financial harm to an individual and his or her family, cause unwarranted
damage to the good name and reputation of such individuals, and increase
the risk of identity theft. Without the exemption, current and potential
retailers and vendors may be reluctant to participate as a department
retailer or vendor, and the effective and efficient administration of the lottery
would be significantly impaired.
Confidential Financial Information about Certain Entities
The release of such information could harm the business operations of
entities with which the department wishes to contract, injure those entities
in the marketplace, and decrease the likelihood that such entities would
work with the department. As a result, the effective and efficient
administration of the lottery would be significantly impaired without
maintaining the confidentiality of such financial information.
Pursuant to the OGSR Act, the exemptions will repeal on October 2, 2024, unless reenacted by the
Legislature.
During the 2023 interim, House and Senate committee staff met jointly with staff from the Department
of the Lottery to discuss the public records exemption under review. The department staff indicated that
they had not had any difficulty interpreting or applying the exemptions and were not aware of any
litigation concerning the exemptions. Department staff noted the continued necessity for the exemption
and recommended that the exemption be reenacted as is. Committee staff inquired as whether any
duplicity existed between the cybersecurity protections in the department’s exemption concerning
certain IT security information and the general cybersecurity exemption in s. 119.0725, F.S.,
department staff indicated that while there was likely overlap between the two exemptions, the general
cybersecurity exemption would not cover the same categories of information.
33
Effect of the Bill
31
Article I, s. 24(c), FLA. CONST., requires each public record exemption to “state with specificity the public necessity justifying the
exemption.”
32
Chapter 2019-41, L.O.F.
33
Memorandum from Reginald D. Dixon, Chief of Staff, Department of the Lottery, September 26, 2023, on file with the Ethics,
Elections & Open Government Subcommittee. STORAGE NAME: h7045.RRS PAGE: 6
DATE: 1/30/2024
The bill extends the repeal date for the department’s I.T. security exemption relating to October 2,
2027, to coincide with the future OGSR repeal date of the general cybersecurity exemption in s.
119.0725, F.S. The bill saves from repeal the remaining public record exemptions under review relating
to the department. Each of the exemptions under review will repeal on October 2, 2024, if this bill does
not become law.
B. SECTION DIRECTORY:
Section 1 amends s. 24.1051, F.S., relating to exemptions from inspection or copying of public records.
Section 2 provides an effective date of October 1, 2024.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
None.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. This bill does not appear to affect county or municipal governments.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill does not require rulemaking nor confer rulemaking authority.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
STORAGE NAME: h7045.RRS PAGE: 7
DATE: 1/30/2024
IV. AMENDMENTS/ COMMITTEE SUBSTITUTE CHANGES
None.