SECTION 627.352. Security of data and information technology in Citizens Property Insurance Corporation.

• (1) The following data and information from technology systems owned by, under contract with, or maintained by Citizens Property Insurance Corporation are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:

  (a) Records held by the corporation which identify detection, investigation, or response practices for suspected or confirmed information technology security incidents, including suspected or confirmed breaches, if the disclosure of such records would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of:

  1. Data or information, whether physical or virtual; or

  2. Information technology resources, including:

  a. Information relating to the security of the corporation’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access; or

  b. Security information, whether physical or virtual, which relates to the corporation’s existing or proposed information technology systems.

  (b) Those portions of risk assessments, evaluations, audits, and other reports of the corporation’s information technology security program for its data, information, and information technology resources which are held by the corporation, if the disclosure of such records would facilitate unauthorized access to or the unauthorized modification, disclosure, or destruction of:

  1. Data or information, whether physical or virtual; or

  2. Information technology resources, which include:

  a. Information relating to the security of the corporation’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access; or

  b. Security information, whether physical or virtual, which relates to the corporation’s existing or proposed information technology systems.
  (2) Those portions of a public meeting as specified in s. 286.011 which would reveal data and information described in subsection (1) are exempt from s. 286.011 and s. 24(b), Art. I of the State Constitution. No exempt portion of an exempt meeting may be off the record. All exempt portions of such a meeting must be recorded and transcribed. The recording and transcript of the meeting must remain confidential and exempt from disclosure under s. 119.07(1) and s. 24(a), Art. 1 of the State Constitution unless a court of competent jurisdiction, following an in camera review, determines that the meeting was not restricted to the discussion of data and information made confidential and exempt by this section. In the event of such a judicial determination, only that portion of the transcript which reveals nonexempt data and information may be disclosed to a third party.
  (3) The records and portions of public meeting recordings and transcripts described in subsection (2) must be available to the Auditor General, the Cybercrime Office of the Department of Law Enforcement, and the Office of Insurance Regulation. Such records and portions of meetings, recordings, and transcripts may be made available to a state or federal agency for security purposes or in furtherance of the agency’s official duties.
  (4) The exemptions provided by this section apply to records held by the corporation before, on, or after the effective date of this act.
  (5) This section is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2023, unless reviewed and saved from repeal through reenactment by the Legislature.

History.-s. 1, ch. 2018-65.

History.-s. 1, ch. 2018-65.