Pub. Rec./Office of Financial Regulation

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 1 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

A bill to be entitled 1
An act relating to public records; amending s. 2
494.00125, F.S.; providing an exemption from public 3
records requirements for information received by the 4
Office of Financial Regulation pursuant to certain 5
cybersecurity event provisions relating to information 6
systems and customer information of loan originators, 7
mortgage brokers, and mortgage lenders and for 8
information received by the office as a result of 9
investigations and examinations of such cybersecurity 10
events; providing for future legislative review and 11
repeal of the exemption; providing a statement of 12
public necessity; amending s. 560.129, F.S.; providing 13
an exemption from public records requirements for 14
information received by the office pursuant to certain 15
cybersecurity events provisions relating to 16
information systems and customer information of money 17
services businesses and for information received by 18
the office as a result of investigations and 19
examinations of such cybersecurity events; providing 20
for future legislative review and repeal of the 21
exemption; providing a statement of public necessity; 22
amending s. 655.0171, F.S.; providing an exemption 23
from public records requirements for customer personal 24
information received by the office relating to 25

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 2 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

breaches of security of financial institutions or 26
received by the office as a result of investigations 27
of such breaches under certain circumstances; 28
providing exceptions; providing definitions; providing 29
for future legislative review and repeal of the 30
exemption; providing a statement of public necessity; 31
amending s. 655.057, F.S.; providing an exemption from 32
public records requirements for certain information 33
received by the office pursuant to applications for 34
authority to organize new financial institutions and 35
for certain information relating to specified persons; 36
providing exceptions; defining the term "personal 37
identifying information"; providing for future 38
legislative review and repeal of the exemption; 39
providing a statement of public necessity; providing a 40
contingent effective date. 41
42
Be It Enacted by the Legislature of the State of Florida: 43
44
Section 1. Subsection (4) is added to section 494.00125, 45
Florida Statutes, to read: 46
494.00125 Public records exemptions.— 47
(4) INFORMATION SECURITY; CYBERSECURITY.—All information 48
received by the office pursuant to s. 494.00123, or received by 49
the office as result of an investigation by the office or a law 50

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 3 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

enforcement agency of a cybersecurity event pursuant to s. 51
494.00123, is confidential and exempt from s. 119.07(1) and s. 52
24(a), Art. I of the State Constitution, until such time as the 53
investigation is completed or ceases to be active. The public 54
records exemption of the information received by the office 55
under this subsection shall be construed in conformity with s. 56
119.071(2)(c). This subsection is subject to the Open Government 57
Sunset Review Act in accordance with s. 119.15 and shall stand 58
repealed on October 2, 2031, unless reviewed and saved from 59
repeal through reenactment by the Legislature. 60
Section 2. (1) The Legislature finds that it is a public 61
necessity that information on cybersecurity events submitted to 62
or obtained by the Office of Financial Regulation pursuant to s. 63
494.00123, Florida Statutes, or as a result of an investigation 64
by the office which involve information security programs of 65
loan originators, mortgage brokers, and mortgage lenders and 66
nonpublic personal data of customers of such loan originators, 67
mortgage brokers, and mortgage lenders be made confidential and 68
exempt from public disclosure. 69
(2)(a) Premature or unrestricted release of information on 70
cybersecurity events, as defined in s. 494.00123(1), Florida 71
Statutes, could compromise ongoing investigations, expose system 72
vulnerabilities, and hinder the office's ability to protect 73
consumers and regulate financial institutions effectively. 74
Disclosure of such information could also place affected 75

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 4 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

individuals at heightened risk of identity theft and financial 76
fraud while revealing trade secrets, proprietary data, and 77
technical safeguards that could be exploited by malicious 78
actors. 79
(b) Protecting information on cybersecurity events ensures 80
that entities cooperate fully with regulators, encourages 81
accurate reporting of security incidents, and maintains the 82
overall integrity of the financial and cybersecurity 83
infrastructure of this state. 84
(3) It is therefore a public necessity that all 85
information received by the office pursuant to s. 494.00123, 86
Florida Statutes, or through an investigation by the office or a 87
law enforcement agency of a cybersecurity event pursuant to s. 88
494.00123, Florida Statutes, be made confidential and exempt 89
from s. 119.07(1), Florida Statutes, and s. 24(a), Article I of 90
the State Constitution. 91
Section 3. Subsection (7) of section 560.129, Florida 92
Statutes, is renumbered as subsection (8), and a new subsection 93
(7) is added to that section to read: 94
560.129 Confidentiality.— 95
(7) All information received by the office pursuant to s. 96
560.1311 or as a result of an investigation by the office or a 97
law enforcement agency is confidential and exempt from s. 98
119.07(1) and s. 24(a), Art. I of the State Constitution, until 99
such time as the investigation is completed or ceases to be 100

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 5 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

active. This exemption shall be construed in conformity with s. 101
119.071(2)(c). This subsection is subject to the Open Government 102
Sunset Review Act in accordance with s. 119.15 and shall stand 103
repealed on October 2, 2031, unless reviewed and saved from 104
repeal through reenactment by the Legislature. 105
Section 4. The Legislature finds that it is a public 106
necessity that information related to cybersecurity incidents, 107
data breaches, and information security programs submitted to or 108
obtained by the Office of Financial Regulation be made 109
confidential and exempt from public disclosure. Premature or 110
unrestricted release of such information could compromise 111
ongoing investigations, expose system vulnerabilities, and 112
hinder the office's ability to protect consumers and regulate 113
money services businesses effectively. Disclosure could also 114
place affected individuals at heightened risk of identity theft 115
and financial fraud while revealing trade secrets, proprietary 116
data, and technical safeguards that could be exploited by 117
malicious actors. Protecting this information ensures that 118
entities cooperate fully with regulators, encourages accurate 119
reporting of security incidents, and maintains the overall 120
integrity of this state's financial and cybersecurity 121
infrastructure. 122
Section 5. Subsection (6) is added to section 655.0171, 123
Florida Statutes, as created by HB 381, 2026 Regular Session, to 124
read: 125

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 6 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

655.0171 Requirements for customer data security and for 126
notices of security breaches.— 127
(6) PUBLIC RECORDS EXEMPTION.— 128
(a) All information received by the office pursuant to a 129
notification required by this section, or received by the office 130
pursuant to an investigation by the office or a law enforcement 131
agency under this section, is confidential and exempt from s. 132
119.07(1) and s. 24(a), Art. I of the State Constitution, until 133
such time as the investigation is completed or ceases to be 134
active. This exemption shall be construed in conformity with s. 135
119.071(2)(c). 136
(b) During an active investigation, information made 137
confidential and exempt pursuant to paragraph (a) may be 138
disclosed by the office: 139
1. In the furtherance of its official duties and 140
responsibilities; 141
2. For print, publication, or broadcast if the office 142
determines that such release would assist in notifying the 143
public or locating or identifying a person that the office 144
believes to be a victim of a data breach or improper disposal of 145
customer records, except that information made confidential and 146
exempt by paragraph (c) may not be released pursuant to this 147
subparagraph; or 148
3. To another governmental entity in the furtherance of 149
its official duties and responsibilities. 150

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 7 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(c) Upon completion of an investigation or once an 151
investigation ceases to be active, the following information 152
received by the office remains confidential and exempt from s. 153
119.07(1) and s. 24(a), Art. I of the State Constitution: 154
1. All information to which another public records 155
exemption applies. 156
2. Personal information. 157
3. A computer forensic report. 158
4. Information that would otherwise reveal weaknesses in a 159
financial institution's data security. 160
5. Information that would disclose a financial 161
institution's proprietary information. 162
a. As used in this subparagraph, the term "proprietary 163
information" means information that: 164
(I) Is owned or controlled by the financial institution. 165
(II) Is intended to be private and is treated by the 166
financial institution as private because disclosure would harm 167
the financial institution or its business operations. 168
(III) Has not been disclosed except as required by law or 169
a private agreement that provides that the information will not 170
be released to the public. 171
(IV) Is not publicly available or otherwise readily 172
ascertainable through proper means from another source in the 173
same configuration as received by the office. 174
b. The term includes: 175

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 8 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(I) Trade secrets as defined in s. 688.002. 176
(II) Competitive interests, the disclosure of which would 177
impair the competitive business of the financial institution 178
that is the subject of the information. 179
(d) As used in this subsection, the term "customer 180
records" means any material, regardless of the physical form, on 181
which personal information is recorded or preserved by any 182
means, including, but not limited to, written or spoken words, 183
graphically depicted, printed, or electromagnetically 184
transmitted which are provided by an individual in this state to 185
a financial institution for the purpose of purchasing or leasing 186
a product or obtaining a service. 187
(e) This subsection is subject to the Open Government 188
Sunset Review Act in accordance with s. 119.15 and shall stand 189
repealed on October 2, 2031, unless reviewed and saved from 190
repeal through reenactment by the Legislature. 191
Section 6. The Legislature finds that it is a public 192
necessity that all information received by the Office of 193
Financial Regulation pursuant to a notification of a violation 194
of s. 655.0171, Florida Statutes, or received by the Department 195
of Legal Affairs pursuant to an investigation by the department 196
or a law enforcement agency relation to a violation of s. 197
655.0171, Florida Statutes, be made confidential and exempt from 198
s.119.07(1), Florida Statutes, and s. 24(a), Article I of the 199
State Constitution for the following reasons: 200

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 9 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(1) A notification of a violation of s. 655.0171, Florida 201
Statutes, is likely to result in an investigation. The premature 202
release of such information could frustrate or thwart the 203
investigation and impair the ability of the office to 204
effectively and efficiently administer s. 655.0171, Florida 205
Statutes. In addition, release of such information before 206
completion of an active investigation could jeopardize the 207
ongoing investigation. 208
(2) The Legislature finds that it is a public necessity to 209
continue to protect from public disclosure all information to 210
which another public record exemption applies once an 211
investigation is completed or ceases to be active. Release of 212
such information by the office would undo the specific statutory 213
exemption protecting that information. 214
(3) An investigation of a data breach or improper disposal 215
of customer records is likely to result in the gathering of 216
sensitive personal information, including social security 217
numbers, identification numbers, and personal financial 218
information of customers of financial institutions. Such 219
information could be used for the purpose of identity theft, and 220
release of such information could subject possible victims of 221
the data breach or improper disposal of customer records to 222
further financial harm. 223
(4) Release of a computer forensic report or other 224
information that would otherwise reveal weaknesses in a covered 225

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 10 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

financial institution's data security could compromise the 226
future security of that financial institution, or other 227
financial institutions, if such information were available upon 228
conclusion of an investigation or once an investigation ceased 229
to be active. The release of such report or information could 230
compromise the security of current financial institutions and 231
make those financial institutions susceptible to future data 232
breaches. Release of such report or information could result in 233
the identification of vulnerabilities and further breaches of 234
that system. 235
(5) Notices received by the office and information 236
received during an investigation of a data breach are likely to 237
contain proprietary information, including trade secrets, about 238
the security of the breached system. The release of the 239
proprietary information could result in the identification of 240
vulnerabilities and further breaches of that system. In 241
addition, a trade secret derives independent, economic value, 242
actual or potential, from being generally unknown to, and not 243
readily ascertainable by, other persons. Allowing public access 244
to proprietary information, including a trade secret, through a 245
public records request could destroy the value of the 246
proprietary information and cause a financial loss to the 247
financial institution submitting the information. Release of 248
such information could give business competitors an unfair 249
advantage and weaken the position of the financial institution 250

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 11 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

supplying the proprietary information in the marketplace. 251
Section 7. Subsections (6) through (14) of section 252
655.057, Florida Statutes, are renumbered as subsections (7) 253
through (15), respectively, and a new subsection (6) is added to 254
that section, to read: 255
655.057 Records; limited restrictions upon public access.— 256
(6)(a) The following information received by the office 257
pursuant to an application for authority to organize a new 258
financial institution is confidential and exempt from s. 259
119.07(1) and s. 24(a), Art. I of the State Constitution: 260
1. Personal financial information. 261
2. A driver license number, a passport number, a military 262
identification number, or any other number or code issued on a 263
government document used to verify identity. 264
3. Books and records of a current or proposed financial 265
institution. 266
4. The proposed financial institution's proposed business 267
plan. 268
(b) The personal identifying information of a proposed 269
officer or proposed director who is currently employed by, or 270
actively participates in the affairs of, another financial 271
institution received by the office pursuant to an application 272
for authority to organize a new financial institution under 273
chapters 655-667 is exempt from s. 119.07(1) and s. 24(a), Art. 274
I of the State Constitution until the application is approved 275

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 12 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

and the charter is issued. As used in this paragraph, the term 276
"personal identifying information" means names, home addresses, 277
e-mail addresses, telephone numbers, names of relatives, work 278
experience, professional licensing and educational backgrounds, 279
and photographs. 280
(c) This subsection is subject to the Open Government 281
Sunset Review Act in accordance with s. 119.15 and is repealed 282
October 2, 2031, unless reviewed and saved from repeal through 283
reenactment by the Legislature. 284
Section 8. (1)(a) The Legislature finds that it is a 285
public necessity that information received by the Office of 286
Financial Regulation pursuant to an application for authority to 287
organize a new financial institution pursuant to the Financial 288
Institutions Codes, chapters 655-667, Florida Statutes, be made 289
confidential and exempt from s. 119.07(1), Florida Statutes, and 290
s. 24(a), Article I of the State Constitution to the extent that 291
disclosure would reveal: 292
1. Personal financial information; 293
2. A driver license number, a passport number, a military 294
identification number, or any other number or code issued on a 295
government document used to verify identity; 296
3. Books and records of a current or proposed financial 297
institution; or 298
4. A proposed financial institution's business plan and 299
any attached supporting documentation. 300

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 13 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(b) The Legislature further finds that it is a public 301
necessity that the personal identifying information of a 302
proposed officer or proposed director who is currently employed 303
by, or actively participates in the affairs of, another 304
financial institution be made confidential and exempt from s. 305
119.07(1), Florida Statutes, and s. 24(a), Article I of the 306
State Constitution for the duration of the application process, 307
until the application is approved and a charter is issued. 308
(2) The office may receive sensitive personal, financial, 309
and business information in conjunction with its duties related 310
to the review of applications for the organization or 311
establishment of new financial institutions. The exemptions from 312
public records requirements provided under subsection (1) are 313
necessary to ensure the office's ability to administer its 314
regulatory duties while preventing unwarranted damage to the 315
proposed financial institution or certain proposed officers or 316
proposed directors of financial institutions in this state. The 317
release of information that could lead to the identification of 318
an individual involved in the potential establishment of a new 319
financial institution may subject such individual to retribution 320
and jeopardize his or her current employment with, or 321
participation in the affairs of, another financial institution. 322
Thus, the public availability of such information has a chilling 323
effect on the establishment of new financial institutions. 324
Further, the public availability of the books and financial 325

HB 777 2026

CODING: Words stricken are deletions; words underlined are additions.
hb777-00
Page 14 of 14
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

records of a current or proposed financial institution in this 326
state presents an unnecessary risk of harm to the business 327
operations of such institution. Finally, the public availability 328
of a proposed financial institution's business plan may cause 329
competitive harm to its future business operations and presents 330
an unfair competitive advantage for existing financial 331
institutions that are not required to release such information. 332
Section 9. This act shall take effect on the same date 333
that HB 381 or similar legislation takes effect, if such 334
legislation is adopted in the same legislative session or an 335
extension thereof and becomes a law. 336