SESSION WATCH
THE BILL ITSELF

CS/CS/SB 1440

Public Records/Office of Financial Regulation

VERSION S 1440 e1 · BACK TO THE SUMMARY · OFFICIAL RECORD

underlined language is being added; struck language is being deleted. Line numbers are the Legislature's own — the same ones amendments cite.

CS for CS for SB 1440 First Engrossed (ntc) 20261440e1
1 A bill to be entitled
2 An act relating to public records; amending s.
3 494.00125, F.S.; providing an exemption from public
4 records requirements for information received by the
5 Office of Financial Regulation pursuant to certain
6 cybersecurity event provisions relating to information
7 systems and customer information of loan originators,
8 mortgage brokers, and mortgage lenders and for
9 information received by the office as a result of
10 investigations and examinations of such cybersecurity
11 events; providing for future legislative review and
12 repeal of the exemption; providing a statement of
13 public necessity; amending s. 517.2015, F.S.;
14 providing a public records exemption for certain
15 information in reports of financial exploitation;
16 providing for future legislative review and repeal of
17 the exemption; providing a statement of public
18 necessity; reenacting and amending s. 560.129, F.S.;
19 expanding a public records exemption for certain
20 information obtained by the Office of Financial
21 Regulation concerning or during the course of an
22 investigation or examination conducted by the office,
23 including customer and consumer complaints, to
24 incorporate the inclusion of documents relating to
25 cybersecurity incidents, data breaches, and
26 information security programs; providing an exemption
27 from public records requirements for information
28 received by the office pursuant to certain
29 cybersecurity events, documents relating to
30 information systems, and customer information of money
31 services businesses and for information received by
32 the office as a result of investigations and
33 examinations of such cybersecurity events; providing
34 for future legislative review and repeal of the
35 exemptions; providing a statement of public necessity;
36 amending s. 560.129, F.S.; expanding a public records
37 exemption for certain information obtained by the
38 Office of Financial Regulation concerning or during
39 the course of an investigation or examination
40 conducted by the office, including customer and
41 consumer complaints, to incorporate the inclusion of
42 documents relating to virtual currency businesses and
43 qualified payment stablecoin issuers; providing for
44 future legislative review and repeal of the
45 exemptions; specifying that certain provisions do not
46 become effective under certain circumstances;
47 providing statements of public necessity; amending s.
48 655.0171, F.S.; providing an exemption from public
49 records requirements for customer personal information
50 received by the office relating to breaches of
51 security of financial institutions or received by the
52 office as a result of investigations of such breaches
53 under certain circumstances; providing exceptions;
54 providing definitions; providing for future
55 legislative review and repeal of the exemption;
56 providing a statement of public necessity; amending s.
57 655.057, F.S.; providing an exemption from public
58 records requirements for certain information received
59 by the office pursuant to applications for authority
60 to organize new state credit unions and for certain
61 information relating to specified persons; providing
62 exceptions; defining the term “personal identifying
63 information”; revising the date for future legislative
64 review and repeal of the exemption; providing a
65 statement of public necessity; reenacting and amending
66 s. 655.057, F.S.; expanding a public records exemption
67 for certain information obtained by the office
68 concerning an investigation or examination conducted
69 by the office, including reports or papers of
70 examinations, operations, or condition, and trade
71 secrets to incorporate the inclusion of trust
72 companies that are qualified payment stablecoin
73 issuers; providing for future legislative review and
74 repeal of the exemption; providing a statement of
75 public necessity; reenacting and amending s. 655.50,
76 F.S.; expanding a public records exemption for reports
77 and records filed with the office to incorporate the
78 inclusion of financial institutions that are trust
79 companies that are qualified payment stablecoin
80 issuers; providing a statement of public necessity;
81 providing contingent effective dates.
83 Be It Enacted by the Legislature of the State of Florida:
85 Section 1. Subsection (4) is added to section 494.00125,
86 Florida Statutes, to read:
87 494.00125 Public records exemptions.—
88 (4) INFORMATION SECURITY; CYBERSECURITY.—All information
89 received by the office pursuant to s. 494.00123, or received by
90 the office as result of an investigation by the office or a law
91 enforcement agency of a cybersecurity event pursuant to s.
92 494.00123, is confidential and exempt from s. 119.07(1) and s.
93 24(a), Art. I of the State Constitution, until such time as the
94 investigation is completed or ceases to be active. The public
95 records exemption of the information received by the office
96 under this subsection shall be construed in conformity with s.
97 119.071(2)(c). This subsection is subject to the Open Government
98 Sunset Review Act in accordance with s. 119.15 and shall stand
99 repealed on October 2, 2031, unless reviewed and saved from
100 repeal through reenactment by the Legislature.
101 Section 2. (1) The Legislature finds that it is a public
102 necessity that information on cybersecurity events submitted to
103 or obtained by the Office of Financial Regulation pursuant to s.
104 494.00123, Florida Statutes, or as a result of an investigation
105 by the office which involve information security programs of
106 loan originators, mortgage brokers, and mortgage lenders and
107 nonpublic personal data of customers of such loan originators,
108 mortgage brokers, and mortgage lenders be made confidential and
109 exempt from public disclosure.
110 (2)(a) Premature or unrestricted release of information on
111 cybersecurity events, as defined in s. 494.00123(1), Florida
112 Statutes, could compromise ongoing investigations, expose system
113 vulnerabilities, and hinder the office’s ability to protect
114 consumers and regulate financial institutions effectively.
115 Disclosure of such information could also place affected
116 individuals at heightened risk of identity theft and financial
117 fraud while revealing trade secrets, proprietary data, and
118 technical safeguards that could be exploited by malicious
119 actors.
120 (b) Protecting information on cybersecurity events ensures
121 that entities cooperate fully with regulators, encourages
122 accurate reporting of security incidents, and maintains the
123 overall integrity of the financial and cybersecurity
124 infrastructure of this state.
125 (3) It is therefore a public necessity that all information
126 received by the office pursuant to s. 494.00123, Florida
127 Statutes, or through an investigation by the office or a law
128 enforcement agency of a cybersecurity event pursuant to s.
129 494.00123, Florida Statutes, be made confidential and exempt
130 from s. 119.07(1), Florida Statutes, and s. 24(a), Article I of
131 the State Constitution.
132 Section 3. Paragraph (b) of subsection (1) of section
133 517.2015, Florida Statutes, is amended, and subsection (4) is
134 added to that section, to read:
135 517.2015 Confidentiality of information relating to
136 investigations and examinations.—
137 (1)
138 (b) Except as necessary for the office to enforce the
139 provisions of this chapter, a consumer complaint , a report of
140 financial exploitation, and other information relative to an
141 investigation or examination shall remain confidential and
142 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
143 Constitution after the investigation or examination is completed
144 or ceases to be active to the extent disclosure would:
145 1. Jeopardize the integrity of another active investigation
146 or examination.
147 2. Reveal the name, address, telephone number, social
148 security number, or any other identifying number or information
149 of any complainant, customer, specified adult as defined in s.
150 517.34(1), or account holder.
151 3. Disclose the identity of a confidential source.
152 4. Disclose investigative techniques or procedures.
153 5. Reveal a trade secret as defined in s. 688.002.
154 6. Disclose financial information or personal health or
155 medical conditions of a complainant, customer, or specified
156 adult as defined in s. 517.34(1).
157 (4) Paragraph (1)(b) is subject to the Open Government
158 Sunset Review Act in accordance with s. 119.15 and is repealed
159 October 2, 2031, unless reviewed and saved from repeal through
160 reenactment by the Legislature.
161 Section 4. The Legislature finds that it is a public
162 necessity that information in the possession of the Office of
163 Financial Regulation arising from a report of financial
164 exploitation under s. 517.34, Florida Statutes, concerning the
165 financial exploitation of specified adults be made confidential
166 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
167 Article I of the State Constitution. The exemptions from public
168 records requirements provided under s. 517.2015 (1)(b), Florida
169 Statutes, are necessary to ensure the office’s ability to
170 administer its regulatory duties while preventing unwarranted
171 damage to the good name or reputation of a specified adult or
172 jeopardizing his or her safety. Such disclosure could also
173 result in the spread of inaccurate information, which could harm
174 the specified adult. The Legislature finds that the release of
175 information in a report of financial exploitation under s.
176 517.34, Florida Statutes, which contains sensitive personal
177 nonfinancial information related to the physical and mental
178 health or condition of the exploited person could result in the
179 disclosure of personal health and medical conditions, as well as
180 the further targeting and exploitation of the specified adult.
181 Section 5. Present subsection (7) of section 560.129,
182 Florida Statutes, is redesignated as subsection (9), new
183 subsections (7) and (8) are added to that section, and
184 subsections (1), (2), and (4) of that section are reenacted, to
185 read:
186 560.129 Confidentiality.—
187 (1) Except as otherwise provided in this section, all
188 information concerning an investigation or examination conducted
189 by the office pursuant to this chapter, including any customer
190 complaint received by the office or the Department of Financial
191 Services, is confidential and exempt from s. 119.07(1) and s.
192 24(a), Art. I of the State Constitution until the investigation
193 or examination ceases to be active. For purposes of this
194 section, an investigation or examination is considered “active”
195 so long as the office or any other administrative, regulatory,
196 or law enforcement agency of any jurisdiction is proceeding with
197 reasonable dispatch and has a reasonable good faith belief that
198 action may be initiated by the office or other administrative,
199 regulatory, or law enforcement agency.
200 (2) All information obtained by the office in the course of
201 its investigation or examination which is a trade secret, as
202 defined in s. 688.002, or which is personal financial
203 information shall remain confidential and exempt from s.
204 119.07(1) and s. 24(a), Art. I of the State Constitution. If any
205 administrative, civil, or criminal proceeding against a money
206 services business, its authorized vendor, or an affiliated party
207 is initiated and the office seeks to use matter that a licensee
208 believes to be a trade secret or personal financial information,
209 such records shall be subject to an in camera review by the
210 administrative law judge, if the matter is before the Division
211 of Administrative Hearings, or a judge of any court of this
212 state, any other state, or the United States, as appropriate,
213 for the purpose of determining if the matter is a trade secret
214 or is personal financial information. If it is determined that
215 the matter is a trade secret, the matter shall remain
216 confidential. If it is determined that the matter is personal
217 financial information, the matter shall remain confidential
218 unless the administrative law judge or judge determines that, in
219 the interests of justice, the matter should become public.
220 (4) Except as necessary for the office or any other
221 administrative, regulatory, or law enforcement agency of any
222 jurisdiction to enforce the provisions of this chapter or the
223 law of any other state or the United States, a consumer
224 complaint and other information concerning an investigation or
225 examination shall remain confidential and exempt from s.
226 119.07(1) and s. 24(a), Art. I of the State Constitution after
227 the investigation or examination ceases to be active to the
228 extent that disclosure would:
229 (a) Jeopardize the integrity of another active
230 investigation;
231 (b) Reveal personal financial information;
232 (c) Reveal the identity of a confidential source; or
233 (d) Reveal investigative techniques or procedures.
234 (7) All information received by the office related to
235 cybersecurity incidents, security breaches, or an information
236 security program notification or required submission pursuant to
237 s. 560.1311 or as a result of an investigation by the office or
238 a law enforcement agency is confidential and exempt from s.
239 119.07(1) and s. 24(a), Art. I of the State Constitution.
240 Information received as a result of an investigation by the
241 office or a law enforcement agency shall remain confidential and
242 exempt until such time as the investigation is completed or
243 ceases to be active. Information that is exempt as a result of
244 an investigation shall be construed in conformity with s.
245 119.071(2)(c). This subsection is subject to the Open Government
246 Sunset Review Act in accordance with s. 119.15 and shall stand
247 repealed on October 2, 2031, unless reviewed and saved from
248 repeal through reenactment by the Legislature.
249 (8) Subsections (1), (2), and (4) are subject to the Open
250 Government Sunset Review Act in accordance with s. 119.15 and
251 shall stand repealed on October 2, 2031, unless reviewed and
252 saved from repeal through reenactment by the Legislature.
253 Section 6. (1) The Legislature finds all of the following:
254 (a) It is a public necessity that all information
255 concerning an investigation or examination of a money services
256 business conducted by the Office of Financial Regulation
257 pursuant to chapter 560, Florida Statutes, including a consumer
258 complaint, be made confidential and exempt from s. 119.07(1),
259 Florida Statutes, and s. 24(a), Article I of the State
260 Constitution until the investigation or examination ceases to be
261 active. The Legislature further finds that such information
262 should remain confidential and exempt from s. 119.07(1), Florida
263 Statutes, and s. 24(a), Article I of the State Constitution
264 after the investigation or examination ceases to be active if
265 its disclosure would jeopardize the office’s investigations by
266 revealing techniques or procedures or otherwise reveal
267 information that is being used in another investigation, or if
268 disclosure would reveal personal financial information or a
269 confidential source.
270 (b) It is a public necessity that trade secrets or personal
271 financial information obtained by the office in the course of an
272 investigation or examination pursuant to chapter 560, Florida
273 Statutes, be made confidential and exempt from s. 119.07(1),
274 Florida Statutes, and s. 24(a), Article I of the State
275 Constitution, unless an administrative law judge or circuit
276 judge determines that the release of personal financial
277 information to the public is in the interest of justice.
278 (c) It is a public necessity that information related to
279 cybersecurity incidents, data breaches, and information security
280 programs submitted to or obtained by the Office of Financial
281 Regulation be made confidential and exempt from public
282 disclosure.
283 (2) Information specified in subsection (1) is held by the
284 office in conjunction with its investigations and examinations
285 of money services businesses, which includes documents relating
286 to cybersecurity incidents, data breaches, and information
287 security programs. Premature or unrestricted release of such
288 information could compromise ongoing investigations, expose
289 system vulnerabilities, and hinder the office’s ability to
290 protect consumers and regulate money services businesses
291 effectively. Disclosure could also place affected individuals at
292 heightened risk of identity theft and financial fraud while
293 revealing trade secrets, proprietary data, and technical
294 safeguards that could be exploited by malicious actors.
295 Protecting this information ensures that entities cooperate
296 fully with regulators, encourages accurate reporting of security
297 incidents, and maintains the overall integrity of this state’s
298 financial and cybersecurity infrastructure.
299 Section 7. Effective on the same date that SB 198 or SB
300 314, 2026 Regular Session, or similar legislation takes effect,
301 if such legislation is adopted in the same legislative session
302 or an extension thereof and becomes a law, present subsection
303 (7) of section 560.129, Florida Statutes, is redesignated as
304 subsection (8), a new subsection (7) is added to that section,
305 and subsections (1), (2), and (4) of that section are reenacted,
306 to read:
307 560.129 Confidentiality.—
308 (1) Except as otherwise provided in this section, all
309 information concerning an investigation or examination conducted
310 by the office pursuant to this chapter, including any customer
311 complaint received by the office or the Department of Financial
312 Services, is confidential and exempt from s. 119.07(1) and s.
313 24(a), Art. I of the State Constitution until the investigation
314 or examination ceases to be active. For purposes of this
315 section, an investigation or examination is considered “active”
316 so long as the office or any other administrative, regulatory,
317 or law enforcement agency of any jurisdiction is proceeding with
318 reasonable dispatch and has a reasonable good faith belief that
319 action may be initiated by the office or other administrative,
320 regulatory, or law enforcement agency.
321 (2) All information obtained by the office in the course of
322 its investigation or examination which is a trade secret, as
323 defined in s. 688.002, or which is personal financial
324 information shall remain confidential and exempt from s.
325 119.07(1) and s. 24(a), Art. I of the State Constitution. If any
326 administrative, civil, or criminal proceeding against a money
327 services business, its authorized vendor, or an affiliated party
328 is initiated and the office seeks to use matter that a licensee
329 believes to be a trade secret or personal financial information,
330 such records shall be subject to an in camera review by the
331 administrative law judge, if the matter is before the Division
332 of Administrative Hearings, or a judge of any court of this
333 state, any other state, or the United States, as appropriate,
334 for the purpose of determining if the matter is a trade secret
335 or is personal financial information. If it is determined that
336 the matter is a trade secret, the matter shall remain
337 confidential. If it is determined that the matter is personal
338 financial information, the matter shall remain confidential
339 unless the administrative law judge or judge determines that, in
340 the interests of justice, the matter should become public.
341 (4) Except as necessary for the office or any other
342 administrative, regulatory, or law enforcement agency of any
343 jurisdiction to enforce the provisions of this chapter or the
344 law of any other state or the United States, a consumer
345 complaint and other information concerning an investigation or
346 examination shall remain confidential and exempt from s.
347 119.07(1) and s. 24(a), Art. I of the State Constitution after
348 the investigation or examination ceases to be active to the
349 extent that disclosure would:
350 (a) Jeopardize the integrity of another active
351 investigation;
352 (b) Reveal personal financial information;
353 (c) Reveal the identity of a confidential source; or
354 (d) Reveal investigative techniques or procedures.
355 (7) Subsections (1), (2), and (4) are subject to the Open
356 Government Sunset Review Act in accordance with s. 119.15 and
357 shall stand repealed on October 2, 2031, unless reviewed and
358 saved from repeal through reenactment by the Legislature.
359 Section 8. Effective upon becoming a law, notwithstanding
360 section 7 of this act, if section 5 of this act becomes law, the
361 amendment to s. 560.129(7), Florida Statutes, in section 7 of
362 this act may not take effect.
363 Section 9. (1) The Legislature finds all of the following:
364 (a) It is a public necessity that all information
365 concerning an investigation or examination of a money services
366 business conducted by the Office of Financial Regulation
367 pursuant to chapter 560, Florida Statutes, including a consumer
368 complaint, be made confidential and exempt from s. 119.07(1),
369 Florida Statutes, and s. 24(a), Article I of the State
370 Constitution until the investigation or examination ceases to be
371 active. The Legislature further finds that such information
372 should remain confidential and exempt from s. 119.07(1), Florida
373 Statutes, and s. 24(a), Article I of the State Constitution
374 after the investigation or examination ceases to be active if
375 its disclosure would jeopardize the office’s investigations by
376 revealing techniques or procedures or otherwise reveal
377 information that is being used in another investigation, or if
378 disclosure would reveal personal financial information or a
379 confidential source.
380 (b) It is a public necessity that trade secrets or personal
381 financial information obtained by the office in the course of an
382 investigation or examination pursuant to chapter 560, Florida
383 Statutes, be made confidential and exempt from s. 119.07(1),
384 Florida Statutes, and s. 24(a), Article I of the State
385 Constitution, unless an administrative law judge or circuit
386 judge determines that the release of personal financial
387 information to the public is in the interest of justice.
388 (2) Information specified in paragraphs (1)(a) and (b) is
389 held by the office in conjunction with its investigations and
390 examinations of money services businesses, which include virtual
391 currency kiosk businesses, as defined in s. 560.103, Florida
392 Statutes, as amended by chapter 2025-100, Laws of Florida.
393 Virtual currency kiosk businesses are thus subject to
394 investigation or examination by the office. As a result, the
395 office may receive sensitive personal and financial information
396 relating to such entities in conjunction with its duties under
397 chapter 560, Florida Statutes. An exemption from public records
398 requirements provides the same protections to virtual currency
399 kiosk businesses as are afforded to other money services
400 businesses, thereby preventing any disadvantage to these
401 similarly regulated entities in comparison to other entities
402 currently classified as money services businesses. An exemption
403 from public records requirements for reports of examinations,
404 operations, or condition, including working papers, is necessary
405 to ensure the office’s ability to effectively and efficiently
406 administer its examination and investigation duties. Examination
407 and investigation are essential components of financial
408 institutions regulation. They deter fraud and ensure the safety
409 and soundness of the financial system. Examinations and
410 investigations also provide a means of early detection of
411 violations, allowing for corrective action to be taken before
412 any harm can be done. Release of such information could
413 compromise the office’s examinations or investigations, reveal
414 investigative techniques, or result in the disclosure of an
415 individual’s personal financial information. Such disclosure
416 could also result in the release of inaccurate information,
417 which could harm the subject of the examination or
418 investigation, or otherwise impair commerce relating to money
419 services businesses. The Legislature finds that there is little
420 public benefit derived from access to such information during
421 the office’s examinations or investigations, and that the
422 exemption is narrowly tailored to allow for release except where
423 the public benefit is outweighed by harm to either the office’s
424 investigations or examinations or to individuals whose personal
425 financial information may be disclosed.
426 (3) This section shall take effect on the same date that SB
427 198 or similar legislation takes effect, if such legislation is
428 adopted in the same legislative session or an extension thereof
429 and becomes a law.
430 Section 10. (1) The Legislature finds all of the
431 following:
432 (a) It is a public necessity that all information
433 concerning an investigation or examination of a money services
434 business conducted by the Office of Financial Regulation
435 pursuant to chapter 560, Florida Statutes, including a consumer
436 complaint, be made confidential and exempt from s. 119.07(1),
437 Florida Statutes, and s. 24(a), Article I of the State
438 Constitution until the investigation or examination ceases to be
439 active. The Legislature further finds that such information
440 should remain confidential and exempt from s. 119.07(1), Florida
441 Statutes, and s. 24(a), Article I of the State Constitution
442 after the investigation or examination ceases to be active if
443 its disclosure would jeopardize the office’s investigations or
444 examinations by revealing techniques or procedures or otherwise
445 reveal information that is being used in another investigation
446 or examinations, or if disclosure would reveal personal
447 financial information or a confidential source.
448 (b) It is a public necessity that trade secrets or personal
449 financial information obtained by the office in the course of an
450 investigation or examination pursuant to chapter 560, Florida
451 Statutes, be made confidential and exempt from s. 119.07(1),
452 Florida Statutes, and s. 24(a), Article I of the State
453 Constitution, unless an administrative law judge or circuit
454 judge determines that the release of personal financial
455 information to the public is in the interest of justice.
456 (2) Information specified in paragraphs (1)(a) and (b) is
457 held by the office in conjunction with its investigations and
458 examinations of money services businesses, which include
459 qualified payment stablecoin issuers, as defined in s. 560.103,
460 Florida Statutes, as amended by chapter 2025-100, Laws of
461 Florida. Qualified payment stablecoin issuers are thus subject
462 to investigation or examination by the office. As a result, the
463 office may receive sensitive personal and financial information
464 relating to such entities in conjunction with its duties under
465 chapter 560, Florida Statutes. An exemption from public records
466 requirements provides the same protections to qualified payment
467 stablecoin issuers as are afforded to other money services
468 businesses, thereby preventing any disadvantage to these
469 similarly regulated entities in comparison to other entities
470 currently classified as money services businesses. An exemption
471 from public records requirements for reports of examinations,
472 operations, or condition, including working papers, is necessary
473 to ensure the office’s ability to effectively and efficiently
474 administer its examination and investigation duties. Examination
475 and investigation are essential components of financial
476 institutions regulation. They deter fraud and ensure the safety
477 and soundness of the financial system. Examinations and
478 investigations also provide a means of early detection of
479 violations, allowing for corrective action to be taken before
480 any harm can be done. Release of such information could
481 compromise the office’s examinations or investigations, reveal
482 investigative techniques, or result in the disclosure of an
483 individual’s personal financial information. Such disclosure
484 could also result in the release of inaccurate information,
485 which could harm the subject of the examination or
486 investigation, or otherwise impair commerce relating to money
487 services businesses. The Legislature finds that there is little
488 public benefit derived from access to such information during
489 the office’s examinations or investigations, and that the
490 exemption is narrowly tailored to allow for release except where
491 the public benefit is outweighed by harm to either the office’s
492 investigations or examinations or to individuals whose personal
493 financial information may be disclosed.
494 (3) This section shall take effect on the same date that SB
495 314 or similar legislation takes effect, if such legislation is
496 adopted in the same legislative session or an extension thereof
497 and becomes a law.
498 Section 11. Subsection (6) is added to section 655.0171,
499 Florida Statutes, as created by SB 540, 2026 Regular Session, to
500 read:
501 655.0171 Requirements for customer data security and for
502 notices of security breaches.—
503 (6) PUBLIC RECORDS EXEMPTION.—
504 (a) All information received by the office pursuant to a
505 notification required by this section, or received by the office
506 pursuant to an investigation by the office or a law enforcement
507 agency under this section, is confidential and exempt from s.
508 119.07(1) and s. 24(a), Art. I of the State Constitution.
509 Information received by the office pursuant to an investigation
510 by the office or a law enforcement agency under this section
511 shall remain confidential and exempt until such time as the
512 investigation is completed or ceases to be active. This
513 exemption shall be construed in conformity with s.
514 119.071(2)(c).
515 (b) During an active investigation, information made
516 confidential and exempt pursuant to paragraph (a) may be
517 disclosed by the office:
518 1. In the furtherance of its official duties and
519 responsibilities;
520 2. For print, publication, or broadcast if the office
521 determines that such release would assist in notifying the
522 public or locating or identifying a person that the office
523 believes to be a victim of a data breach or improper disposal of
524 customer records, except that information made confidential and
525 exempt by paragraph (c) may not be released pursuant to this
526 subparagraph; or
527 3. To another governmental entity in the furtherance of its
528 official duties and responsibilities.
529 (c) Upon completion of an investigation or once an
530 investigation ceases to be active, the following information
531 received by the office remains confidential and exempt from s.
532 119.07(1) and s. 24(a), Art. I of the State Constitution:
533 1. All information to which another public records
534 exemption applies.
535 2. Personal information.
536 3. A computer forensic report.
537 4. Information that would otherwise reveal weaknesses in a
538 financial institution’s data security.
539 5. Information that would disclose a financial
540 institution’s proprietary information.
541 a. As used in this subparagraph, the term “proprietary
542 information” means information that:
543 (I) Is owned or controlled by the financial institution.
544 (II) Is intended to be private and is treated by the
545 financial institution as private because disclosure would harm
546 the financial institution or its business operations.
547 (III) Has not been disclosed except as required by law or a
548 private agreement that provides that the information will not be
549 released to the public.
550 (IV) Is not publicly available or otherwise readily
551 ascertainable through proper means from another source in the
552 same configuration as received by the office.
553 b. The term “proprietary information” includes:
554 (I) Trade secrets as defined in s. 688.002.
555 (II) Competitive interests, the disclosure of which would
556 impair the competitive business of the financial institution
557 that is the subject of the information.
558 (d) As used in this subsection, the term “customer records”
559 means any material, regardless of the physical form, on which
560 personal information is recorded or preserved by any means,
561 including, but not limited to, written or spoken words,
562 graphically depicted, printed, or electromagnetically
563 transmitted, which is provided by an individual in this state to
564 a financial institution for the purpose of purchasing or leasing
565 a product or obtaining a service.
566 (e) This subsection is subject to the Open Government
567 Sunset Review Act in accordance with s. 119.15 and shall stand
568 repealed on October 2, 2031, unless reviewed and saved from
569 repeal through reenactment by the Legislature.
570 Section 12. The Legislature finds that it is a public
571 necessity that all information received by the Office of
572 Financial Regulation pursuant to a notification of a violation
573 of s. 655.0171, Florida Statutes, or received by the Department
574 of Legal Affairs pursuant to an investigation by the department
575 or a law enforcement agency relating to a violation of s.
576 655.0171, Florida Statutes, be made confidential and exempt from
577 s. 119.07(1), Florida Statutes, and s. 24(a), Article I of the
578 State Constitution for the following reasons:
579 (1) A notification of a violation of s. 655.0171, Florida
580 Statutes, is likely to result in an investigation. The premature
581 release of such information could frustrate or thwart the
582 investigation and impair the ability of the office to
583 effectively and efficiently administer s. 655.0171, Florida
584 Statutes. In addition, release of such information before
585 completion of an active investigation could jeopardize the
586 ongoing investigation.
587 (2) The Legislature finds that it is a public necessity to
588 continue to protect from public disclosure all information to
589 which another public record exemption applies once an
590 investigation is completed or ceases to be active. Release of
591 such information by the office would undo the specific statutory
592 exemption protecting that information.
593 (3) An investigation of a data breach or improper disposal
594 of customer records is likely to result in the gathering of
595 sensitive personal information, including social security
596 numbers, identification numbers, and personal financial
597 information of customers of financial institutions. Such
598 information could be used for the purpose of identity theft, and
599 release of such information could subject possible victims of
600 the data breach or improper disposal of customer records to
601 further financial harm.
602 (4) Release of a computer forensic report or other
603 information that would otherwise reveal weaknesses in a covered
604 financial institution’s data security could compromise the
605 future security of that financial institution, or other
606 financial institutions, if such information were available upon
607 conclusion of an investigation or once an investigation ceased
608 to be active. The release of such report or information could
609 compromise the security of current financial institutions and
610 make those financial institutions susceptible to future data
611 breaches. Release of such report or information could result in
612 the identification of vulnerabilities and further breaches of
613 that system.
614 (5) Notices received by the office and information received
615 during an investigation of a data breach are likely to contain
616 proprietary information, including trade secrets, about the
617 security of the breached system. The release of the proprietary
618 information could result in the identification of
619 vulnerabilities and further breaches of that system. In
620 addition, a trade secret derives independent, economic value,
621 actual or potential, from being generally unknown to, and not
622 readily ascertainable by, other persons. Allowing public access
623 to proprietary information, including a trade secret, through a
624 public records request could destroy the value of the
625 proprietary information and cause a financial loss to the
626 financial institution submitting the information. Release of
627 such information could give business competitors an unfair
628 advantage in the marketplace and weaken the position of the
629 financial institution supplying the proprietary information.
630 Section 13. Subsection (5) of section 655.057, Florida
631 Statutes, is amended to read:
632 655.057 Records; limited restrictions upon public access.—
633 (5)(a) The following information received by the office
634 pursuant to an application for authority to organize a new state
635 bank or new state trust company under chapter 658 , or pursuant
636 to an application for authority to organize a new state credit
637 union under chapter 657, is confidential and exempt from s.
638 119.07(1) and s. 24(a), Art. I of the State Constitution:
639 1. Personal financial information.
640 2. A driver license number, a passport number, a military
641 identification number, or any other number or code issued on a
642 government document used to verify identity.
643 3. Books and records of a current or proposed financial
644 institution.
645 4. The proposed state bank’s , or proposed state trust
646 company’s , or proposed state credit union’s proposed business
647 plan.
648 (b) The personal identifying information of a proposed
649 officer or proposed director who is currently employed by, or
650 actively participates in the affairs of, another financial
651 institution received by the office pursuant to an application
652 for authority to organize a new state bank or new state trust
653 company under chapter 658 , or pursuant to an application for
654 authority to organize a new state credit union under chapter
655 657, is exempt from s. 119.07(1) and s. 24(a), Art. I of the
656 State Constitution until the application is approved and the
657 charter is issued. As used in this paragraph, the term “personal
658 identifying information” means names, home addresses, e-mail
659 addresses, telephone numbers, names of relatives, work
660 experience, professional licensing and educational backgrounds,
661 and photographs.
662 (c) This subsection is subject to the Open Government
663 Sunset Review Act in accordance with s. 119.15 and is repealed
664 October 2, 2031 2029 , unless reviewed and saved from repeal
665 through reenactment by the Legislature.
666 Section 14. (1)(a) The Legislature finds that it is a
667 public necessity that information received by the Office of
668 Financial Regulation pursuant to an application for authority to
669 organize a new state credit union under chapter 657, Florida
670 Statutes, be made confidential and exempt from s. 119.07(1),
671 Florida Statutes, and s. 24(a), Article I of the State
672 Constitution to the extent that disclosure would reveal:
673 1. Personal financial information;
674 2. A driver license number, a passport number, a military
675 identification number, or any other number or code issued on a
676 government document used to verify identity;
677 3. Books and records of a current or proposed financial
678 institution; or
679 4. A proposed new state credit union’s business plan and
680 any attached supporting documentation.
681 (b) The Legislature further finds that it is a public
682 necessity that the personal identifying information of a
683 proposed officer or proposed director who is currently employed
684 by, or actively participates in the affairs of, another
685 financial institution which is received by the office pursuant
686 to an application for authority to organize a new state credit
687 union under chapter 657, Florida Statutes, be made confidential
688 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
689 Article I of the State Constitution for the duration of the
690 application process, until the application is approved and a
691 charter is issued.
692 (2) The office may receive sensitive personal, financial,
693 and business information in conjunction with its duties related
694 to the review of applications for the organization or
695 establishment of new state credit unions. The exemptions from
696 public records requirements provided under subsection (1) are
697 necessary to ensure the office’s ability to administer its
698 regulatory duties while preventing unwarranted damage to the
699 proposed state credit unions or certain proposed officers or
700 proposed directors of new state credit unions in this state. The
701 release of information that could lead to the identification of
702 an individual involved in the potential establishment of a new
703 state credit union may subject such individual to retribution
704 and jeopardize his or her current employment with, or
705 participation in the affairs of, another financial institution.
706 Thus, the public availability of such information has a chilling
707 effect on the establishment of new state credit unions. Further,
708 the public availability of the books and financial records of a
709 current or proposed state credit union presents an unnecessary
710 risk of harm to the business operations of such credit union.
711 Finally, the public availability of a proposed state credit
712 union’s business plan may cause competitive harm to its future
713 business operations and presents an unfair competitive advantage
714 for existing state credit unions that are not required to
715 release such information.
716 Section 15. Effective on the same date that SB 314 or
717 similar legislation takes effect, if such legislation is adopted
718 in the same legislative session or an extension thereof and
719 becomes a law, subsection (15) is added to section 655.057,
720 Florida Statutes, and subsections (1) through (4), (6), and (10)
721 of that section are reenacted, to read:
722 655.057 Records; limited restrictions upon public access.—
723 (1) Except as otherwise provided in this section and except
724 for such portions thereof which are otherwise public record, all
725 records and information relating to an investigation by the
726 office are confidential and exempt from s. 119.07(1) and s.
727 24(a), Art. I of the State Constitution until such investigation
728 is completed or ceases to be active. For purposes of this
729 subsection, an investigation is considered “active” while such
730 investigation is being conducted by the office with a
731 reasonable, good faith belief that it may lead to the filing of
732 administrative, civil, or criminal proceedings. An investigation
733 does not cease to be active if the office is proceeding with
734 reasonable dispatch, and there is a good faith belief that
735 action may be initiated by the office or other administrative or
736 law enforcement agency. After an investigation is completed or
737 ceases to be active, portions of the records relating to the
738 investigation are confidential and exempt from s. 119.07(1) and
739 s. 24(a), Art. I of the State Constitution to the extent that
740 disclosure would:
741 (a) Jeopardize the integrity of another active
742 investigation;
743 (b) Impair the safety and soundness of the financial
744 institution;
745 (c) Reveal personal financial information;
746 (d) Reveal the identity of a confidential source;
747 (e) Defame or cause unwarranted damage to the good name or
748 reputation of an individual or jeopardize the safety of an
749 individual; or
750 (f) Reveal investigative techniques or procedures.
751 (2) Except as otherwise provided in this section and except
752 for such portions thereof which are public record, reports of
753 examinations, operations, or condition, including working
754 papers, or portions thereof, prepared by, or for the use of, the
755 office or any state or federal agency responsible for the
756 regulation or supervision of financial institutions in this
757 state are confidential and exempt from s. 119.07(1) and s.
758 24(a), Art. I of the State Constitution. However, such reports
759 or papers or portions thereof may be released to:
760 (a) The financial institution under examination;
761 (b) Any holding company of which the financial institution
762 is a subsidiary;
763 (c) Proposed purchasers if necessary to protect the
764 continued financial viability of the financial institution, upon
765 prior approval by the board of directors of such institution;
766 (d) Persons proposing in good faith to acquire a
767 controlling interest in or to merge with the financial
768 institution, upon prior approval by the board of directors of
769 such financial institution;
770 (e) Any officer, director, committee member, employee,
771 attorney, auditor, or independent auditor officially connected
772 with the financial institution, holding company, proposed
773 purchaser, or person seeking to acquire a controlling interest
774 in or merge with the financial institution; or
775 (f) A fidelity insurance company, upon approval of the
776 financial institution’s board of directors. However, a fidelity
777 insurance company may receive only that portion of an
778 examination report relating to a claim or investigation being
779 conducted by such fidelity insurance company.
780 (g) Examination, operation, or condition reports of a
781 financial institution shall be released by the office within 1
782 year after the appointment of a liquidator, receiver, or
783 conservator to the financial institution. However, any portion
784 of such reports which discloses the identities of depositors,
785 bondholders, members, borrowers, or stockholders, other than
786 directors, officers, or controlling stockholders of the
787 institution, shall remain confidential and exempt from s.
788 119.07(1) and s. 24(a), Art. I of the State Constitution.
790 Any confidential information or records obtained from the office
791 pursuant to this subsection shall be maintained as confidential
792 and exempt from s. 119.07(1) and s. 24(a), Art. I of the State
793 Constitution.
794 (3) Except as otherwise provided in this section and except
795 for those portions that are otherwise public record, after an
796 investigation relating to an informal enforcement action is
797 completed or ceases to be active, informal enforcement actions
798 are confidential and exempt from s. 119.07(1) and s. 24(a), Art.
799 I of the State Constitution to the extent that disclosure would:
800 (a) Jeopardize the integrity of another active
801 investigation.
802 (b) Impair the safety and soundness of the financial
803 institution.
804 (c) Reveal personal financial information.
805 (d) Reveal the identity of a confidential source.
806 (e) Defame or cause unwarranted damage to the good name or
807 reputation of an individual or jeopardize the safety of an
808 individual.
809 (f) Reveal investigative techniques or procedures.
810 (4) Except as otherwise provided in this section and except
811 for those portions that are otherwise public record, trade
812 secrets as defined in s. 688.002 which comply with s. 655.0591
813 and which are held by the office in accordance with its
814 statutory duties with respect to the financial institutions
815 codes are confidential and exempt from s. 119.07(1) and s.
816 24(a), Art. I of the State Constitution.
817 (6) This section does not prevent or restrict:
818 (a) Publishing reports that are required to be submitted to
819 the office pursuant to s. 655.045(2) or required by applicable
820 federal statutes or regulations to be published.
821 (b) Furnishing records or information to any other state,
822 federal, or foreign agency responsible for the regulation or
823 supervision of financial institutions.
824 (c) Disclosing or publishing summaries of the condition of
825 financial institutions and general economic and similar
826 statistics and data, provided that the identity of a particular
827 financial institution is not disclosed.
828 (d) Reporting any suspected criminal activity, with
829 supporting documents and information, to appropriate law
830 enforcement and prosecutorial agencies.
831 (e) Furnishing information upon request to the Chief
832 Financial Officer or the Division of Treasury of the Department
833 of Financial Services regarding the financial condition of any
834 financial institution that is, or has applied to be, designated
835 as a qualified public depository pursuant to chapter 280.
836 (f) Furnishing information to Federal Home Loan Banks
837 regarding its member institutions pursuant to an information
838 sharing agreement between the Federal Home Loan Banks and the
839 office.
841 Any confidential information or records obtained from the office
842 pursuant to this subsection shall be maintained as confidential
843 and exempt from s. 119.07(1) and s. 24(a), Art. I of the State
844 Constitution.
845 (10) Materials supplied to the office or to employees of
846 any financial institution by other state or federal governmental
847 agencies remain the property of the submitting agency or the
848 corporation, and any document request must be made to the
849 appropriate agency. Any confidential documents supplied to the
850 office or to employees of any financial institution by other
851 state or federal governmental agencies are confidential and
852 exempt from s. 119.07(1) and s. 24(a), Art. I of the State
853 Constitution. Such information shall be made public only with
854 the consent of such agency or the corporation.
855 (15) Subsections (1)-(4), (6), and (10) are subject to the
856 Open Government Sunset Review Act in accordance with s. 119.15
857 and are repealed October 2, 2031, unless reviewed and saved from
858 repeal through reenactment by the Legislature.
859 Section 16. (1) The Legislature finds that it is a public
860 necessity that all records and information relating to an
861 investigation by the Office of Financial Regulation undertaken
862 pursuant to chapter 655, Florida Statutes, be made confidential
863 and exempt from s. 119.07(1), Florida Statutes, and s. 24(a),
864 Article I of the State Constitution until the investigation
865 ceases to be active. The Legislature further finds that such
866 information should remain confidential and exempt from s.
867 119.07(1), Florida Statutes, and s. 24(a), Article I of the
868 State Constitution after the investigation ceases to be active
869 if its disclosure would jeopardize the office’s investigations
870 by revealing techniques or procedures, or otherwise reveal
871 information that is being used in another investigation; reveal
872 personal financial information or a confidential source; or
873 defame or cause unwarranted damage to an individual’s reputation
874 or jeopardize his or her safety.
875 (2) Information specified in s. 655.057(1)-(4), (6), and
876 (10), Florida Statutes, is held by the office in conjunction
877 with examinations and investigations of trust companies which
878 may include records concerning payment stablecoin issuer
879 products or services offered by such trust companies, as
880 authorized in s. 658.997, Florida Statutes. As a result, the
881 office may receive sensitive personal and financial information
882 relating to such trust companies in conjunction with its duties
883 under chapter 655, Florida Statutes. An exemption from public
884 records requirements provides the same protections to trust
885 companies that are qualified payment stablecoin issuers as are
886 afforded to other financial institutions, thereby preventing any
887 disadvantage to these similarly regulated entities in comparison
888 to other entities currently classified as financial
889 institutions. An exemption from public records requirements for
890 reports of examinations, operations, or condition, including
891 working papers, is necessary to ensure the office’s ability to
892 effectively and efficiently administer its examination and
893 investigation duties. Examination and investigation are
894 essential components of financial institutions regulation. They
895 deter fraud and ensure the safety and soundness of the financial
896 system. Examinations and investigations also provide a means of
897 early detection of violations, allowing for corrective action to
898 be taken before any harm can be done.
899 (3) The Legislature finds that it is a public necessity to
900 make confidential and exempt from s. 119.07(1), Florida
901 Statutes, and s. 24(a), Article I of the State Constitution
902 records and information relating to an examination or
903 investigation by the Office of Financial Regulation; portions of
904 records relating to a completed or inactive examination or
905 investigation by the office which would jeopardize the integrity
906 of another active examination or investigation, impair the
907 safety and soundness of the financial institution, reveal
908 personal financial information, reveal the identity of a
909 confidential source, defame or cause unwarranted damage to the
910 good name or reputation of an individual or jeopardize the
911 safety of an individual, or reveal investigative techniques or
912 procedures; reports of examinations, operations, or conditions,
913 including working papers, or portions thereof, prepared by, or
914 for the use of, the office or any state or federal agency
915 responsible for the regulation or supervision of financial
916 institutions in this state, until 1 year after the appointment
917 of a liquidator; any portion of such reports which discloses the
918 identities of depositors, bondholders, members, borrowers, or
919 stockholders, other than directors, officers, or controlling
920 stockholders of the institution; trade secrets held by the
921 office in accordance with its statutory duties under chapter
922 655, Florida Statutes, unless an administrative law judge or
923 circuit judge determines that the release of personal financial
924 information to the public is in the interest of justice; and
925 materials supplied to the office or to employees of any
926 financial institution by other state or federal governmental
927 agencies.
928 (4) Release of information specified in s. 655.057(1)-(4),
929 (6), and (10), Florida Statutes, could compromise the office’s
930 examinations and investigations, reveal investigative
931 techniques, result in the disclosure of an individual’s personal
932 financial information, or defame or cause unwarranted damage to
933 the good name or reputation of an individual or entity or
934 jeopardize his or her safety. Such disclosure could also result
935 in the spread of inaccurate information, which could harm the
936 subject of the examination or investigation, or otherwise impair
937 commerce conducted by financial institutions in this state. Any
938 portion of a record or information relating to an examination or
939 investigation which reveals personal financial information or
940 the identity of a confidential source may defame, or cause
941 unwarranted damage to the good name or reputation of, those
942 individuals, or jeopardize their safety.
943 (5) A trade secret derives independent economic value,
944 actual or potential, from not being generally known to, and not
945 readily ascertainable by, other persons who can obtain economic
946 value from the disclosure or use of the trade secret. Without an
947 exemption for a trade secret held by the office in accordance
948 with its duties prescribed by chapter 655, Florida Statutes,
949 that trade secret becomes a public record when received and must
950 be divulged upon request. Divulging a trade secret under the
951 public records law would give business competitors an unfair
952 advantage and destroy the value of that property, causing a
953 financial loss to the person or entity submitting the trade
954 secret and weakening the position of that person or entity in
955 the marketplace.
956 (6) The Legislature finds that there is little public
957 benefit derived from access to such information during the
958 office’s examinations or investigations, and that the exemption
959 is narrowly tailored to allow for release except where the
960 public benefit is outweighed by harm to individuals or
961 institutions, when the disclosure would jeopardize other
962 examinations or investigations, reveal the office’s
963 investigative techniques or procedures, or expose personal
964 financial information or a confidential source.
965 (7) This section shall take effect on the same date that SB
966 314 or similar legislation takes effect, if such legislation is
967 adopted in the same legislative session or an extension thereof
968 and becomes a law.
969 Section 17. Effective on the same date that SB 314 or
970 similar legislation takes effect, if such legislation is adopted
971 in the same legislative session or an extension thereof and
972 becomes a law, subsection (7) of section 655.50, Florida
973 Statutes, is amended, and paragraph (d) of subsection (5) of
974 this section is reenacted, to read:
975 655.50 Florida Control of Money Laundering and Terrorist
976 Financing in Financial Institutions Act.—
977 (5) A financial institution shall keep a record of each
978 financial transaction occurring in this state known to it which
979 involves currency or other monetary instrument, as the
980 commission prescribes by rule, has a value greater than $10,000,
981 and involves the proceeds of specified unlawful activity, or is
982 designed to evade the reporting requirements of this section,
983 chapter 896, or similar state or federal law, or which the
984 financial institution reasonably believes is suspicious
985 activity. Each financial institution shall maintain appropriate
986 procedures to ensure compliance with this section, chapter 896,
987 and other similar state or federal law. Any report of suspicious
988 activity made pursuant to this subsection is entitled to the
989 same confidentiality provided under 31 C.F.R. s. 1020.320,
990 whether the report or information pertaining to or identifying
991 the report is in the possession or control of the office or the
992 reporting institution.
993 (d) Each financial institution shall file a report of the
994 records required under this subsection with the office. Each
995 report shall be filed at such time and must contain such
996 information as the commission requires by rule.
997 (7) All reports and records filed with the office pursuant
998 to this section are confidential and exempt from s. 119.07(1)
999 and s. 24(a), Art. I of the State Constitution . However, the
1000 office shall provide any report filed pursuant to this section,
1001 or information contained therein, to federal, state, and local
1002 law enforcement and prosecutorial agencies, and any federal or
1003 state agency responsible for the regulation or supervision of
1004 financial institutions.
1005 Section 18. (1) The Legislature finds that it is a public
1006 necessity that all reports and records filed with the Office of
1007 Financial Regulation be made confidential and exempt from s.
1008 119.07(1), Florida Statutes, and s. 24(a), Article I of the
1009 State Constitution unless disclosure is requested by a federal,
1010 state, or local law enforcement or prosecutorial agency or any
1011 federal or state agency responsible for the regulation or
1012 supervision of financial institutions. Information regarding
1013 potential money laundering or terrorism must be safeguarded to
1014 prevent the potential offender from being tipped off or
1015 circumventing an investigation conducted by the office, and
1016 disclosure of such information could harm the office’s
1017 investigations.
1018 (2) These reports and records are held by the office in
1019 conjunction with its duties pursuant to 31 U.S.C. s. 5313 and 31
1020 C.F.R. part 1020 and its examinations or investigations of trust
1021 companies’ transactions involving monetary instruments
1022 concerning payment stablecoin products or services offered by
1023 such companies, as authorized in s. 658.997, Florida Statutes,
1024 to include any transactions involving payment stablecoin
1025 products or services offered by such financial institutions. As
1026 a result, the office may receive sensitive personal and
1027 financial information relating to such entities in conjunction
1028 with its duties under chapter 655, Florida Statutes. An
1029 exemption from public records requirements provides the same
1030 protections to trust companies that hold a certificate of
1031 authority as a qualified payment stablecoin issuer as are
1032 afforded to other financial institutions, thereby preventing any
1033 disadvantage to these similarly regulated entities in comparison
1034 to other entities currently classified as financial
1035 institutions. An exemption from public records requirements for
1036 reports and records submitted to the office is necessary to
1037 ensure the office’s ability to effectively and efficiently
1038 administer its investigation duties. Examination and
1039 investigation are essential components of financial institutions
1040 regulation. They deter fraud and ensure the safety and soundness
1041 of the financial system. Examinations and investigations also
1042 provide a means of early detection of violations, allowing for
1043 corrective action to be taken before any harm can be done.
1044 (3) This section shall take effect on the same date that SB
1045 314 or similar legislation takes effect, if such legislation is
1046 adopted in the same legislative session or an extension thereof
1047 and becomes a law.
1048 Section 19. Except as otherwise expressly provided in this
1049 act and except for this section, which shall take effect upon
1050 becoming a law, this act shall take effect on the same date that
1051 SB 540 or similar legislation takes effect, if such legislation
1052 is adopted in the same legislative session or an extension
1053 thereof and becomes a law.