Bill Text: FL S0586 | 2010 | Regular Session | Introduced

---

Bill Title: Data Destruction [CPSC]

Spectrum: Partisan Bill (Republican 1-0)

Status: (Failed) 2010-04-30 - Died in Committee on Commerce [S0586 Detail]

Download: Florida-2010-S0586-Introduced.html

---

 
Florida Senate - 2010                                     SB 586 
 
By Senator Fasano 
11-00473A-10                                           2010586__ 
1                        A bill to be entitled 
2         An act relating to data destruction; providing 
3         definitions; requiring all public agencies and private 
4         entities that collect personal information to adhere 
5         to the procedures provided in the National Institute 
6         of Standards and Technology “Guidelines for Media 
7         Sanitization” when destroying such information; 
8         requiring such agencies and entities to maintain a 
9         copy of the guidelines; requiring all state agencies 
10         to submit a sampling of sanitized media to a third 
11         party vendor for verification of data destruction; 
12         requiring the Department of Management Services to 
13         adopt rules; providing an effective date. 
14 
15  Be It Enacted by the Legislature of the State of Florida: 
16 
17         Section 1. Media sanitization.— 
18         (1) As used in this section, the term: 
19         (a) “Media” means: 
20         1. Hard copy information, which is the physical 
21  representation of information, including, but not limited to, 
22  paper printouts, printer and facsimile ribbons, drums, and 
23  platens; and 
24         2. Electronic information, which is the bits and bytes 
25  contained in hard drives, random-access memory, read-only 
26  memory, optical disc storage media, memory devices, telephones, 
27  mobile computing devices, networking equipment, and other types 
28  of information storage equipment. 
29         (b) “Sanitization” or “sanitized” means the process of 
30  removing data from media such that the data may not be retrieved 
31  or reconstructed. 
32         (2) All agencies, as defined in s. 119.011, Florida 
33  Statutes, and all private corporations, business trusts, 
34  partnerships, limited liability companies, associations, joint 
35  ventures, estates, trusts, or any other legal or commercial 
36  entities, for profit or not for profit, located in or doing 
37  business in this state, which collect any information that is 
38  deemed secret, private, personal, or confidential in nature; 
39  contains identifying information, including names, personal or 
40  business addresses, social security numbers, credit or debit 
41  card numbers, bank account numbers, telephone numbers, or 
42  photographs that are recorded on media; and is subject to 
43  sanitization or meets the criteria for destruction as set forth 
44  in the “Guidelines for Media Sanitization: Recommendation of the 
45  National Institute of Standards and Technology,” NIST Special 
46  Publication 800-88, must use the purge or physical destruction 
47  techniques for media destruction described in that document. 
48         (3) All state agencies and private entities subject to 
49  subsection (2) must keep a copy of the Guidelines for Media 
50  Sanitization available for use. An electronic copy of the 
51  document must be kept on the computer desktop of the chief 
52  information officer, security officer, records management 
53  officer, or other person responsible for the sanitization of the 
54  personal or private data at the agency or entity. 
55         (4) All state agencies must submit a sampling of sanitized 
56  electronic media to a third-party vendor without a stake in the 
57  sanitization process for verification of data destruction. The 
58  Department of Management Services shall adopt by rule criteria 
59  for the selection of such vendor and procedures for the 
60  submission and return of such samples. 
61         Section 2. This act shall take effect July 1, 2010.