F L O R I D A H O U S E O F R E P R E S E N T A HB 1357 1 T I V E 2018 A bill to be entitled 2 An act relating to information technology; amending s. 3 282.0051, F.S.; revising certain powers, duties, and 4 functions of the Agency for State Technology in 5 collaboration with the Department of Management 6 Services; amending s. 282.201, F.S.; authorizing the 7 state data center within the agency to extend, up to a 8 specified timeframe, certain service-level agreements; 9 requiring the state data center to submit a specified 10 report to the Executive Office of the Governor under 11 certain circumstances; deleting a requirement for a 12 service-level agreement to provide a certain 13 termination notice to the agency; requiring the state 14 data center to plan, design, and conduct certain 15 testing, if cost-effective; deleting obsolete 16 provisions relating to the schedule for consolidations 17 of agency data centers; conforming provisions to 18 changes made by the act; amending s. 322.032, F.S.; 19 directing the Department of Highway Safety and Motor 20 Vehicles, in collaboration with the Agency for State 21 Technology, to implement protocols and standards for 22 issuing an optional digital proof of driver license, 23 enter into a contract for a specified purpose, and 24 procure certain interfaces necessary for authorized 25 private entities to consume a digital proof of driver Page 1 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A HB 1357 T I V E 2018 26 license; requiring the agency, in collaboration with 27 the department, to maintain and publish such protocols 28 and standards; requiring the agency to timely review 29 and approve all private entity requests for authorized 30 access to certain interfaces that meet the agency's 31 requirements; providing that agency approval of such 32 access designates the approved entity as an authorized 33 consumer of digital proofs of driver licenses; 34 providing for revenue sharing between such authorized 35 manufacturer and the state; requiring deposit of the 36 state share of such revenue in the Highway Safety 37 Operating Trust Fund; requiring the agency, in 38 collaboration with the department, to enter into a 39 specified agreement with such authorized manufacturer; 40 requiring that a digital proof of driver license be in 41 a format that allows law enforcement to verify the 42 authenticity of such digital proof of driver license; 43 providing that presenting an electronic device 44 displaying a digital proof of driver license does not 45 constitute consent for a law enforcement officer to 46 access any other information on such device; providing 47 for the assumption of liability; amending s. 668.50, 48 F.S.; providing and revising definitions; providing 49 that a contract may not be denied legal effect or 50 enforceability solely because it includes a smart Page 2 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 V E 2018 51 contract term; providing that rights of ownership or 52 use of certain information are not affected by the use 53 of blockchain technology to secure such information; 54 providing an effective date. 55 56 Be It Enacted by the Legislature of the State of Florida: 57 58 59 60 Section 1. Subsection (18) of section 282.0051, Florida Statutes, is amended to read: 282.0051 Agency for State Technology; powers, duties, and 61 functions.—The Agency for State Technology shall have the 62 following powers, duties, and functions: 63 (18) 64 Services: 65 (a) In collaboration with the Department of Management Establish an information technology policy for all 66 information technology-related state contracts, including state 67 term contracts for information technology commodities, 68 consultant services, and staff augmentation services. The 69 information technology policy must include: 70 71 72 73 74 75 1. Identification of the information technology product and service categories to be included in state term contracts. 2. Requirements to be included in solicitations for state term contracts. 3. Evaluation criteria for the award of information technology-related state term contracts. Page 3 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 76 77 78 79 80 4. The term of each information technology-related state term contract. 5. The maximum number of vendors authorized on each state term contract. (b) Evaluate vendor responses for information technology- related state term contract solicitations and invitations to 82 negotiate. 84 85 (c) Answer vendor questions on information technology- related state term contract solicitations. (d) Ensure that all information technology-related 86 solicitations by the department are procured and state contracts 87 are managed in accordance with the information technology policy 88 established under pursuant to paragraph (a) is included in all 89 solicitations and contracts which are administratively executed 90 by the department. 91 Section 2. Paragraph (d) of subsection (2) of section 92 282.201, Florida Statutes, is amended, paragraph (g) is added to 93 that subsection, and subsection (4) of that section is amended, 94 to read: 95 282.201 State data center.—The state data center is 96 established within the Agency for State Technology and shall 97 provide data center services that are hosted on premises or 98 externally through a third-party provider as an enterprise 99 information technology service. The provision of services must 100 E 2018 81 83 V comply with applicable state and federal laws, regulations, and Page 4 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 policies, including all applicable security, privacy, and 102 auditing requirements. 103 (2) STATE DATA CENTER DUTIES.–The state data center shall: 104 (d) Enter into a service-level agreement with each 105 customer entity to provide the required type and level of 106 service or services. If a customer entity fails to execute an 107 agreement within 60 days after commencement of a service, the 108 state data center may cease service. A service-level agreement 109 may not have an original a term exceeding 3 years, but the 110 service-level agreement may be extended for up to 6 months. If 111 the state data center and an existing customer entity either 112 execute an extension or fail to execute a new service-level 113 agreement before the expiration of an existing service-level 114 agreement, the state data center must submit a report to the 115 Executive Office of the Governor within 5 days after the date of 116 the executed extension or 15 days before the scheduled 117 expiration date of the service-level agreement, as applicable, 118 to explain the specific issues preventing execution of a new 119 service-level agreement and to describe the plan and schedule 120 for resolving those issues. A service-level agreement, and at a 121 minimum, must: 123 124 125 E 2018 101 122 V 1. Identify the parties and their roles, duties, and responsibilities under the agreement. 2. State the duration of the contract term and specify the conditions for renewal. Page 5 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 3. Identify the scope of work. 127 4. Identify the products or services to be delivered with 128 sufficient specificity to permit an external financial or 129 performance audit. 5. Establish the services to be provided, the business 131 standards that must be met for each service, the cost of each 132 service, and the metrics and processes by which the business 133 standards for each service are to be objectively measured and 134 reported. 135 6. Provide a timely billing methodology to recover the 136 cost of services provided to the customer entity pursuant to s. 137 215.422. 138 7. Provide a procedure for modifying the service-level 139 agreement based on changes in the type, level, and cost of a 140 service. 141 8. Include a right-to-audit clause to ensure that the 142 parties to the agreement have access to records for audit 143 purposes during the term of the service-level agreement. 144 9. Provide that a service-level agreement may be 145 terminated by either party for cause only after giving the other 146 party and the Agency for State Technology notice in writing of 147 the cause for termination and an opportunity for the other party 148 to resolve the identified cause within a reasonable period. 149 150 E 2018 126 130 V 10. Provide for mediation of disputes by the Division of Administrative Hearings pursuant to s. 120.573. Page 6 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 151 (g) Plan, design, and conduct testing with information technology resources to implement services within the scope of 153 the services provided by the state data center, if cost- 154 effective. 155 (4) SCHEDULE FOR CONSOLIDATIONS OF AGENCY DATA CENTERS.— 156 (a) Consolidations of agency data centers and computing 157 facilities into the state data center shall be made by the dates 158 specified in this section and in accordance with budget 159 adjustments contained in the General Appropriations Act. 161 (b) During the 2013-2014 fiscal year, the following state agencies shall be consolidated by the specified date: 162 1. 163 Opportunity. 164 2. By October 31, 2013, the Department of Economic By December 31, 2013, the Executive Office of the 165 Governor, to include the Division of Emergency Management except 166 for the Emergency Operation Center's management system in 167 Tallahassee and the Camp Blanding Emergency Operations Center in 168 Starke. 169 3. By March 31, 2014, the Department of Elderly Affairs. 170 4. By October 30, 2013, the Fish and Wildlife Conservation 171 Commission, except for the commission's Fish and Wildlife 172 Research Institute in St. Petersburg. 173 E 2018 152 160 V (a)(c) The following agency data centers are exempt from 174 state data center consolidation under this section: the 175 Department of Law Enforcement, the Department of the Lottery's Page 7 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 Gaming System, Systems Design and Development in the Office of 177 Policy and Budget, the regional traffic management centers as 178 described in s. 335.14(2) and the Office of Toll Operations of 179 the Department of Transportation, the State Board of 180 Administration, state attorneys, public defenders, criminal 181 conflict and civil regional counsel, capital collateral regional 182 counsel, and the Florida Housing Finance Corporation. (b)(d) A state agency that is consolidating its agency 184 data center or computing facility into the state data center 185 must execute a new or update an existing service-level agreement 186 within 60 days after the commencement of the service. If a state 187 agency and the state data center are unable to execute a 188 service-level agreement by that date, the agency shall submit a 189 report to the Executive Office of the Governor within 5 working 190 days after that date which explains the specific issues 191 preventing execution and describing the plan and schedule for 192 resolving those issues. 193 (c)(e) Each state agency consolidating scheduled for 194 consolidation into the state data center shall submit a 195 transition plan to the Agency for State Technology by July 1 of 196 the fiscal year before the fiscal year in which the scheduled 197 consolidation will occur. Transition plans must shall be 198 developed in consultation with the state data center and must 199 include: 200 E 2018 176 183 V 1. An inventory of the agency data center's resources Page 8 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 being consolidated, including all hardware and its associated 202 life cycle replacement schedule, software, staff, contracted 203 services, and facility resources performing data center 204 management and operations, security, backup and recovery, 205 disaster recovery, system administration, database 206 administration, system programming, job control, production 207 control, print, storage, technical support, help desk, and 208 managed services, but excluding application development, and the 209 agency's costs supporting these resources. 2. A list of contracts in effect, including, but not 211 limited to, contracts for hardware, software, and maintenance, 212 which identifies the expiration date, the contract parties, and 213 the cost of each contract. 214 3. A detailed description of the level of services needed 215 to meet the technical and operational requirements of the 216 platforms being consolidated. 217 218 219 4. A timetable with significant milestones for the completion of the consolidation. (d)(f) Each state agency consolidating scheduled for 220 consolidation into the state data center shall submit with its 221 respective legislative budget request the specific recurring and 222 nonrecurring budget adjustments of resources by appropriation 223 category into the appropriate data processing category pursuant 224 to the legislative budget request instructions in s. 216.023. 225 E 2018 201 210 V Section 3. Subsections (1) and (2) of section 322.032, Page 9 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 226 Florida Statutes, are amended to read: 322.032 228 (1)(a) Digital proof of driver license.— The department, in collaboration with the Agency 229 for State Technology, shall establish and implement begin to 230 review and prepare for the development of a secure and uniform 231 protocols and standards system for issuing an optional digital 232 proof of driver license, contract with a private entity to serve 233 as the authorized manufacturer of a digital proof of driver 234 license, and procure any application programming interface 235 necessary for enabling qualified and authorized private entities 236 to securely consume a digital proof of driver license. The 237 department may contract with one or more private entities to 238 develop a digital proof of driver license system. (b) The Agency for State Technology, in collaboration with 240 the department, shall maintain and publish on its website the 241 protocols and standards necessary for a private entity to 242 request authorized access to an application programming 243 interface necessary for such private entity to consume a digital 244 proof of driver license. The agency shall timely review requests 245 for authorized access and must approve all requests by private 246 entities that meet the agency's requirements. The agency's 247 approval of a request for authorized access designates the 248 private entity that made the request as an authorized consumer 249 of digital proofs of driver licenses. 250 E 2018 227 239 V (c) Revenue generated from the manufacture or consumption Page 10 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 of a digital proof of driver license must be collected by the 252 authorized manufacturer of digital proofs of driver licenses and 253 such revenue must be shared with the state on a revenue-sharing 254 basis. Such authorized manufacturer is responsible for remitting 255 50 percent of all revenue collected for deposit into the Highway 256 Safety Operating Trust Fund. The Agency for State Technology, in 257 collaboration with the department, shall enter into an agreement 258 with the authorized manufacturer that provides the permitted 259 uses, terms and conditions, privacy policy, and uniform 260 remittance terms relating to the consumption of a digital proof 261 of driver license. (2)(a) A The digital proof of driver license developed by 263 the department or by an entity contracted by the department must 264 be in such a format as to allow law enforcement to verify the 265 authenticity of the digital proof of driver license. The 266 department may adopt rules to ensure valid authentication of a 267 digital proof of driver license licenses by law enforcement. 268 (b) The act of presenting to a law enforcement officer an 269 electronic device displaying a digital proof of driver license 270 does not constitute consent for the officer to access any 271 information on the device other than the digital proof of driver 272 license. 273 (c) 274 275 E 2018 251 262 V The person who presents the device to the officer assumes liability for any resulting damage to the device. Section 4. Subsection (20) of section 668.50, Florida Page 11 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 Statutes, is renumbered as subsection (21), subsection (2) and 277 paragraph (b) of subsection (7) are amended, and a new 278 subsection (20) is added to that section, to read: 279 668.50 280 (2) DEFINITIONS.—As used in this section: 281 (a) "Agreement" means the bargain of the parties in fact, Uniform Electronic Transaction Act.— 282 as found in their language or inferred from other circumstances 283 and from rules, regulations, and procedures given the effect of 284 agreements under provisions of law otherwise applicable to a 285 particular transaction. (b) "Automated transaction" means a transaction conducted 287 or performed, in whole or in part, by electronic means or 288 electronic records, in which the acts or records of one or both 289 parties are not reviewed by an individual in the ordinary course 290 in forming a contract, performing under an existing contract, or 291 fulfilling an obligation required by the transaction. 292 (c) "Blockchain technology" means distributed ledger 293 technology that uses a distributed, decentralized, shared, and 294 replicated ledger, which may be public or private, permissioned 295 or permissionless, and driven by tokenized crypto-economics or 296 tokenless. The data on the ledger must be immutable, auditable, 297 protected with cryptography, and provide an uncensored truth. 298 E 2018 276 286 V (d)(c) "Computer program" means a set of statements or 299 instructions to be used directly or indirectly in an information 300 processing system in order to bring about a certain result. Page 12 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 301 (e)(d) "Contract" means the total legal obligation resulting from the parties' agreement as affected by this act 303 and other applicable provisions of law. (f)(e) "Electronic" means relating to technology having 305 electrical, digital, magnetic, wireless, optical, 306 electromagnetic, or similar capabilities. 307 (g)(f) "Electronic agent" means a computer program or an 308 electronic or other automated means used independently to 309 initiate an action or respond to electronic records or 310 performances in whole or in part, without review or action by an 311 individual. 312 (h)(g) "Electronic record" means a record created, 313 generated, sent, communicated, received, or stored by electronic 314 means. A record or contract that is secured through blockchain 315 technology is in an electronic form and is an electronic record. 316 (i)(h) "Electronic signature" means an electronic sound, 317 symbol, or process attached to or logically associated with a 318 record and executed or adopted by a person with the intent to 319 sign the record. A signature that is secured through blockchain 320 technology is in an electronic form and is an electronic 321 signature. 322 E 2018 302 304 V (j)(i) "Governmental agency" means an executive, 323 legislative, or judicial agency, department, board, commission, 324 authority, institution, or instrumentality of this state, 325 including a county, municipality, or other political subdivision Page 13 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 of this state and any other public or private agency, person, 327 partnership, corporation, or business entity acting on behalf of 328 any public agency. (k)(j) "Information" means data, text, images, sounds, 330 codes, computer programs, software, databases, or other similar 331 representations of knowledge. 332 (l)(k) "Information processing system" means an electronic 333 system for creating, generating, sending, receiving, storing, 334 displaying, or processing information. 335 (m)(l) "Person" means an individual, corporation, business 336 trust, estate, trust, partnership, limited liability company, 337 association, joint venture, governmental agency, public 338 corporation, or any other legal or commercial entity. 339 (n)(m) "Record" means information that is inscribed on a 340 tangible medium or that is stored in an electronic or other 341 medium and is retrievable in perceivable form, including public 342 records as defined in s. 119.011. 343 (o)(n) "Security procedure" means a procedure employed for 344 the purpose of verifying that an electronic signature, record, 345 or performance is that of a specific person or for detecting 346 changes or errors in the information in an electronic record. 347 The term includes a procedure that requires the use of 348 algorithms or other codes, identifying words or numbers, 349 encryption, or callback or other acknowledgment procedures. 350 E 2018 326 329 V (p) "Smart contract" means an event-driven program that Page 14 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T A T I HB 1357 runs on a distributed, decentralized, shared, and replicated 352 ledger and can take custody over and instruct the transfer of 353 assets on that ledger. (q)(o) "State" means a state of the United States, the 355 District of Columbia, Puerto Rico, the United States Virgin 356 Islands, or any territory or insular possession subject to the 357 jurisdiction of the United States. The term includes an Indian 358 tribe or band, or Alaskan native village, which is recognized by 359 federal law or formally acknowledged by a state. 360 (r)(p) "Transaction" means an action or set of actions 361 occurring between two or more persons relating to the conduct of 362 business, commercial, insurance, or governmental affairs. 363 364 365 366 367 368 E 2018 351 354 V (7) LEGAL RECOGNITION OF ELECTRONIC RECORDS, ELECTRONIC SIGNATURES, AND ELECTRONIC CONTRACTS.— (b) A contract may not be denied legal effect or enforceability solely because: 1. An electronic record was used in the formation of the contract. 369 2. 370 (20) The contract contains a smart contract term. RIGHTS OF OWNERSHIP OR USE.—Notwithstanding any law, 371 rule, or regulation to the contrary, the use of blockchain 372 technology to secure information while engaged in interstate or 373 foreign commerce does not affect the rights of ownership or use 374 held by the owner of such information unless the terms of the 375 transaction expressly provide for the transfer of such rights. Page 15 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S F L O R I D A H O U S E O F R E P R E S E N T HB 1357 376 A T I V E 2018 Section 5. This act shall take effect July 1, 2018. Page 16 of 16 CODING: Words stricken are deletions; words underlined are additions. hb1357-00 S