F.S. 1004.0551004.055 Security of data and information technology in state postsecondary education institutions.—(1) All of the following data or information from technology systems owned, under contract, or maintained by a state university or a Florida College System institution is confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:(a) Records held by the university or institution which identify detection, investigation, or response practices for suspected or confirmed information technology security incidents, including suspected or confirmed breaches, if the disclosure of such records would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of:1. Data or information, whether physical or virtual; or 2. Information technology resources, which include:a. Information relating to the security of the university’s or institution’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access; or b. Security information, whether physical or virtual, which relates to the university’s or institution’s existing or proposed information technology systems. (b) Those portions of risk assessments, evaluations, audits, and other reports of the university’s or institution’s information technology security program for its data, information, and information technology resources which are held by the university or institution, if the disclosure of such records would facilitate unauthorized access to or the unauthorized modification, disclosure, or destruction of:1. Data or information, whether physical or virtual; or 2. Information technology resources, which include:a. Information relating to the security of the university’s or institution’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access; or b. Security information, whether physical or virtual, which relates to the university’s or institution’s existing or proposed information technology systems. (2) Those portions of a public meeting as specified in s. 286.011 which would reveal data and information described in subsection (1) are exempt from s. 286.011 and s. 24(b), Art. I of the State Constitution. No exempt portion of an exempt meeting may be off the record. All exempt portions of such a meeting must be recorded and transcribed. The recording and transcript of the meeting must remain confidential and exempt from disclosure under s. 119.07(1) and s. 24(a), Art. I of the State Constitution unless a court of competent jurisdiction, following an in camera review, determines that the meeting was not restricted to the discussion of data and information made confidential and exempt by this section. In the event of such a judicial determination, only that portion of the transcript which reveals nonexempt data and information may be disclosed to a third party. (3) The records and portions of public meeting recordings and transcripts described in subsection (1) must be available to the Auditor General; the Cybercrime Office of the Department of Law Enforcement; for a state university, the Board of Governors; and for a Florida College System institution, the State Board of Education. Such records and portions of meetings, recordings, and transcripts may be made available to a state or federal agency for security purposes or in furtherance of the agency’s official duties. (4) The exemptions listed in this section apply to such records or portions of public meetings, recordings, and transcripts held by the university or institution before, on, or after June 14, 2017. History.—ss. 1, 3, ch. 2017-109; s. 1, ch. 2022-9.
|
