House Select Committee to Protect Personal Information Meeting Report

On Monday, February 4, 2008, a representative of this Firm attended a meeting of the House Select Committee to Protect Personal Information (“Committee”) held in Tallahassee, Florida. 

The Committee, chaired by Representative William Proctor (R), heard recommendations regarding privacy protection from several Committee members, recommendations submitted by Kevin Frein, Assistant State Attorney, Fourth Judicial Circuit, as well as a number of miscellaneous recommendations. 

To view the meeting packet, click here.

Below is a review of the pertinent discussions and issues raised at the meeting.

Committee member Representative Janet Long (D) submitted two proposals for the Committee to consider:

• Representative Long proposed that Florida certify its vendors to ensure that they and their employees, who may be handling sensitive information, are trained on various privacy and data security standards provided by the International Association of Privacy Professionals.
• Representative Long’s second proposal pertained to the creation of a position of Chief Privacy Officer (“CPO”) and a team of auditors under the oversight of the Florida Department of Management Services.  The CPO would create a report card-style assessment for the Governor and public on how well Florida’s executive, legislative, and judicial branches are performing in terms of the secure data collection and storage of personal information.

Committee Member Representative Sandra Adams (R), who serves as Vice Chair of the Committee, submitted a more general recommendation citing existing Florida law regarding the gathering and disposal of personal information by state agencies. 

Committee Member Representative Ronald Brisé (D) submitted two specific recommendations for the Committee to consider:

• Based on best practices, the State of Florida should encourage the private sector to establish protocols to standardize the method in which customer data found on credit cards and debit cards is managed and discarded.
• The Florida House of Representatives should propose a statute banning the use of card readers that do not truncate credit card and debit card numbers.

Kevin Frein, Assistant State Attorney, Fourth Judicial Circuit, by e-mail dated January 31, 2008, submitted several specific recommendations to the Committee.  Both Mr. Frein’s e-mail and the agenda of the meeting (which can be viewed by clicking on the link provided above) include the specific recommendations and the relevant statutes.  Several of Mr. Frein’s recommendations received active discussion at the end of the meeting when they were addressed by a non-Committee member in attendance. Those recommendations were: 

• Alter certain statutes pertaining to identity theft, so as to make the law more expansive, thereby allowing firms, corporations and partnerships to be guilty of crimes related to the unlawful use of personal identification information. In response to this recommendation, at the conclusion of the meeting, a non-Committee member in attendance stated that the Judiciary had already wrestled with these issues and that there was no need for the Legislature to “reinvent the wheel,” but that rather, the Judiciary’s interpretation of existing law could be codified quite simply.
• Increase the current penalty for engaging in counterfeiting personal information.
• Expand law enforcement officers’ authority to make arrests related to the unlawful use of personal information. 

At the conclusion of the meeting, it was further recommended that there may be a need for a database to be used exclusively by the Florida Department of Law Enforcement and exempt from public access.  Thus, such a database could aid in the detection and prosecution of crimes related to the unlawful use of personal information.

Other recommendations included:

• Creating statutory standards for businesses for the safeguard and disposal of personal information.
• Creating a statute that would increase a felony charge by one degree should personal information be unlawfully used during the commission of the felony.
• Provide the Florida Highway Patrol and the Department of Highway Safety and Motor Vehicles with funding for facial recognition software that is used to determine victims of identity theft.
• Provide mandatory training requirements for Florida Department of Law Enforcement Officers on the investigation of identity theft crimes. 

At the conclusion of the meeting, in response to these recommendations, a non-Committee member expressed the opinion that because attorney’s fees are prohibitively expensive, and because local law enforcement cannot effectively deal with the complex technological and jurisdictional issues involved with crimes of this nature, that it may be necessary for the State to create a law enforcement agency directed at dealing with the unlawful use of personal information on behalf of victims. As part of this recommendation, the following suggestions were made:

• Providing prosecutors with training geared toward the prosecution of these crimes.
• Enacting a legislative mandate requiring each State Attorney’s Office to designate two Assistant State Attorney’s as “identity theft” prosecutors, ensuring that each jurisdiction has identity theft experts who can assist both law enforcement and victims

In addition to the above referenced recommendations, a number of miscellaneous recommendations were also presented to the Committee.  These included:

• A recommendation to the Speaker that staff of the appropriate standing committee or the Office of Program Policy and Government Accountability  effect an interim review of state agency forms to determine the types of personal information collected by agencies
• A recommendation to the Speaker that staff of the appropriate standing committee similarly study the issue of identity theft with a specific focus on the types of personal information commonly used by identity thieves to commit identity theft
• A recommendation to the Speaker and the Speaker-Designate that the Select Committee to protect Personal Identity Information be re-established to continue reviewing the issues surrounding agency collection of information and the storage, retrieval, security and destruction practices by agencies
• A recommendation to amend s. 119, Fla. Stat., to create minimum requirements for agencies to meet when destroying hard copy and electronic public records containing confidential, exempt, or personal information
• A recommendation to amend s. 119, Fla. Stat., to create a policy that agencies must use when determining whether to actively publish public records on the Internet

Please note that the material above is a brief summary of the discussion and events that took place during the meeting of the House Select Committee to Protect Personal Information.  It is not intended to be a comprehensive review of any particular issues relating to the policies and/or programs discussed.  Further, this report should not be relied upon for making any specific decisions. 

Should you have any questions about any of the above matters, please do not hesitate to contact this office.  This Office will continue to follow this and other issues related to actions taken by the Florida Legislature pertaining to the protection of personal information, and will provide information and analysis of those issues and events as they arise.

 

To unsubscribe from this newsletter, please send an email to ccochran@cftlaw.com.