HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 7045 PCB EEG 24-06 OGSR/Department of the Lottery
SPONSOR(S): Ethics, Elections & Open Government Subcommittee, Porras
TIED BILLS: IDEN./SIM. BILLS: CS/SB 7008
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
Orig. Comm.: Ethics, Elections & Open Government 15 Y, 0 N Poreda Toliver
Subcommittee
1) Regulatory Reform & Economic Development 14 Y, 0 N Wright Anstead
Subcommittee
2) State Affairs Committee 20 Y, 0 N Poreda Williamson
SUMMARY ANALYSIS
The Open Government Sunset Review Act (OGSR Act) requires the Legislature to review each public record
exemption and each public meeting exemption five years after enactment. If the Legislature does not reenact
the exemption, it automatically repeals on October 2nd of the fifth year after enactment.
The Florida Constitution permits the state to create lotteries, the proceeds from which are required to be
deposited in a State Education Lotteries Trust Fund. The Department of the Lottery (department) was
established to operate the state lottery with the purpose of maximizing revenues in a manner consonant with
the dignity of the state and the welfare of its citizens.
Current law provides public record exemptions for the following information held by the department:
 Information relating to the security of the department’s information technology security.
 Security information or information that would reveal security measures of the department.
 Information about lottery games, tickets, inventory, and promotions for games.
 Information concerning terminals, machines, and devices that issue tickets.
 Information that must be maintained as confidential in order for the department to participate in a multi-
state lottery association or game.
 Personal identifying information obtained by the department when processing background
investigations of current or potential retailers or vendors.
 Financial information about an entity that is not publicly available and is provided to the department in
connection with its review of the financial responsibility of the entity.
In 2022, the Legislature created a general public record exemption — applicable to all agencies — for certain
information related to cybersecurity. Pursuant to the OGSR act, the exemption for cybersecurity information will
repeal on October 2, 2027, unless reviewed and saved from repeal by the Legislature.
The bill extends the repeal date for the department’s information technology security exemption to October 2,
2027, to coincide with the future OGSR repeal date of the general cybersecurity exemption. The bill also saves
from repeal the remaining public record exemptions for the department, which will repeal on October 2, 2024, if
this bill does not become law.
The bill does not appear to have a fiscal impact on state government or local governments .
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h7045c.SAC
DATE: 2/7/2024
 FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Background
Open Government Sunset Review Act
The Open Government Sunset Review Act (OGSR Act)1 sets forth a legislative review process for
newly created or substantially amended public record or public meeting exemptions. It requires an
automatic repeal of the exemption on October 2nd of the fifth year after creation or substantial
amendment, unless the Legislature reenacts the exemption.2
The OGSR Act provides that a public record or public meeting exemption may be created or maintained
only if it serves an identifiable public purpose. In addition, it may be no broader than is necessary to
meet one of the following purposes:
 Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
 Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
 Protect trade or business secrets.3
If, and only if, in reenacting an exemption that will repeal, the exemption is expanded, then a public
necessity statement and a two-thirds vote for passage are required.4 If the exemption is reenacted with
grammatical or stylistic changes that do not expand the exemption, if the exemption is narrowed, or if
an exception to the exemption is created, then a public necessity statement and a two-thirds vote for
passage are not required.
Department of the Lottery
The Florida Constitution initially prohibited “[l]otteries, other than the types of pari-mutuel pools
authorized by law.”5 However, in 1986, Florida voters approved an amendment to the Florida
Constitution that specifically authorizes the state to operate lotteries, the proceeds from which are
required to be deposited in a State Education Lotteries Trust Fund.6 The Legislature, soon thereafter,
passed legislation to implement the constitutional provision7 in order to enable “the people of the state
to benefit from significant additional moneys for education” and “to play the best lottery games
available.”8
The Department of the Lottery (department) 9 was established in 1987 to operate the state lottery with
the purpose of maximizing revenues in a manner consonant with the dignity of the state and the welfare
of its citizens.10 The department is headed by a secretary appointed by the Governor, subject to the
confirmation of the Senate.11 The department is authorized to adopt rules governing the establishment
and operation of the state lottery.12 Florida began offering lottery games in 1988, with a $1 weekly
1 Section 119.15, F.S.
2 Section 119.15(3), F.S.
3 Section 119.15(6)(b), F.S.
4 Article I, s. 24(c), FLA. CONST .
5 Article X, s. 7, FLA. CONST .
6 Article X, s. 15, FLA. CONST .
7 Chapter 24, F.S. and Chapter 87-65, L.O.F
8 Id.
9 Section 24.102, F.S.
10 Section 24.104, F.S.
11 Section 20.317(1)(a), F.S.
12 Section 24.105(9), F.S.
STORAGE NAME: h7045c.SAC PAGE: 2
DATE: 2/7/2024
 drawing.13 Since then, the Lottery has grown to include approximately 13,500 retailer locations across
the state with lottery tickets ranging from $1 to $5014 and total ticket sales of $9.325 billion.15
Current Public Record Exemptions related to the Department
The name of a winner of a prize valued at $250,000 or more is confidential and exempt 16 from public
record requirements for 90 days from the date the prize is claimed, unless the winner consents to the
release of his or her name,17 as well as the street address and telephone number of all game winners. 18
The department must disclose any confidential and exempt information to the Auditor General, the
Office of Program Policy Analysis and Government Accountability (OPPAGA), or an independent
auditor upon his or her request.19 In addition, if the President of the Senate or the Speaker of the House
of Representatives certifies that confidential information is necessary for effecting legislative changes,
the requested information must be disclosed to him or her, and he or she may disclose such
information to members of the Legislature and legislative staff as necessary to affect such purpose. 20
Current law provides that any person who, with intent to defraud or with intent to provide a financial or
other advantage to himself, herself, or another, knowingly and willfully discloses any confidential and
exempt information relating to the lottery is guilty of a first-degree felony.21
Cybersecurity Public Record Exemption
In 2022, the Legislature created a general public record exemption applicable to all agencies 22 for
certain information related to cybersecurity.23 Section 119.0725, F.S., provides that the following
information is confidential and exempt from public record requirements:
 Information related to critical infrastructure.24
 Network schematics, hardware and software configurations, or encryption information or
information that identifies detection, investigation, or response practices for suspected or
confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure
of such information would facilitate unauthorized access to or unauthorized modification,
disclosure, or destruction of:
o Data or information, whether physical or virtual; or
o Information technology (IT) resources, which include an agency’s existing or proposed
IT systems.
13 Florida Lottery, History, available at https://www.flalottery.com/history (last visited Feb. 2, 2024).
14 Id.
15 OPPAGA, Review of the Florida Lottery, 2022, available at https://oppaga.fl.gov/Documents/Reports/23-02.pdf (last visited Feb. 2,
2024). Ticket sales figure based on Fiscal Year 2021-2022.
16 There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
designates confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain
circumstances. See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied, 892 So.2d 1015 (Fla.
2004); State v. Wooten, 260 So. 3d 1060, 1070 (Fla. 4th DCA 2018); City of Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA
1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5th DCA 1991). If the Legislature designates a record as confidential
and exempt from public disclosure, such record may not be released by the custodian of public records to anyone other than the
persons or entities specifically designated in statute. See Op. Att’y Gen. Fla. 04- 09 (2004).
17 Section 24.1051(3)(a), F.S. However, the name of a winner must be provided pursuant to s. 24.115, F.S., regarding persons owing
child support and s. 409.2577, F.S., regarding the parent locator service to locate parents that have deserted their children .
18 Section 24.1051(2), F.S.
19 Section 24.1051(4), F.S.
20 Section 24.105(12)(c), F.S.
21 A first-degree felony is punishable by up to thirty years imprisonment and a fine of up to $10,000. Sections 755.082 and 755.083,
F.S.
22 “Agency” means any state, county, district, authority, or municipal officer, department, division, board, bu reau, commission, or
other separate unit of government created or established by law including, for the purposes of ch. 119, F.S., the Commission on Ethics,
the Public Service Commission, and the Office of Public Counsel, and any other public or private ag ency, person, partnership,
corporation, or business entity acting on behalf of any public agency. Section 119.011(2), F.S.
23 See s. 119.0725, F.S.
24 “Critical infrastructure” means existing and proposed information technology and operation technology syst ems and assets, whether
physical and virtual, the incapacity or destruction of which would negatively affect security, economic security, public health, or
public safety. Section 119.0725(1)(b), F.S.
STORAGE NAME: h7045c.SAC PAGE: 3
DATE: 2/7/2024
  Coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation
coverages acquired for the protection of IT systems, operational technology systems, or data of
an agency.
 Cybersecurity incident information contained in certain reports.
The Legislature also created a public meeting exemption for any portion of a meeting that would reveal
the confidential and exempt information; however, any portion of an exempt meeting must be recorded
and transcribed.25 The recording and transcript are confidential and exempt from public record
requirements.26
Pursuant to the OGSR act, the exemption for cybersecurity information will repeal on October 2, 2027,
unless reviewed and saved from repeal by the Legislature.
Public Record Exemptions under Review
In 2019, the Legislature created public record exemptions for certain information held by the
department related to cybersecurity, IT, lottery games, and retailers and vendors. The following
information is confidential and exempt from public record requirements if release could harm the
security or integrity of the department:
 Information relating to the security of the department’s technologies, processes, and practices
designed to protect networks, computers, data processing software, data, and data systems
from attack, damage, or unauthorized access.
 Security information or information that would reveal security measures of the department,
whether physical or virtual.
 Information about lottery games, tickets, inventory, and promotions for games, including
description, design, production, printing, packaging, shipping, delivery, storage, and validation
of such games, promotions, tickets, and stock.
 Information concerning terminals, machines, and devices that issue tickets.27
Current law also makes the following information confidential and exempt, regardless of whether
release could harm the security or integrity of the department:
 Information that must be maintained as confidential in order for the department to participate in
a multi-state lottery association or game.
 Personal identifying information obtained by the department when processing background
investigations of current or potentials retailers or vendors.
 Financial information about an entity that is not publicly available and is provided to the
department in connection with its review of the financial responsibility of the entity, provided that
the entity marks such information as confidential.28
The confidential and exempt information must be released to the Auditor General, OPPAGA, and an
independent auditor upon his or her request.29 Such information may be released to other
governmental entities as needed in connection with the performance of their duties. 30
In 2019, the public necessity statement31 for the public record exemptions provided, in part, that if:
[S]ecurity information were made available to the public, the integrity and efficiency
of the lottery would be jeopardized and the effective and efficient administration of
the lottery would be significantly impaired…The department is authorized to enter
into agreements with other states for the operation and promotion of a multistate
25 Section 119.0725(3), F.S.
26 Id.
27 Section 24.1051(1)(a)1., F.S.
28 Section 24.1051(1)(a)2., 3., and 4., F.S.
29 Section 24.1051(4), F.S.
30 Section 24.1051(1)(c), F.S.
31 Article I, s. 24(c), FLA. CONST ., requires each public record exemption to “state with specificity the public necessity justifying the
exemption.”
STORAGE NAME: h7045c.SAC PAGE: 4
DATE: 2/7/2024
 lottery and without the exemption, the department would be unable to join c ertain
associations and games, thus causing the state to miss opportunities to generate
revenue for education…32
In addition, the public necessity statement provided that:
The release of … sensitive personal information could cause great financial harm
to an individual and his or her family, cause unwarranted damage to the good name
and reputation of such individuals, and increase the risk of identity theft. Without
the exemption, current and potential retailers and vendors may be reluctant to
participate as a department retailer or vendor, and the effective and efficient
administration of the lottery would be significantly impaired. 33
Furthermore, the release of certain confidential and exempt information “could harm the business
operations of entities with which the department wishes to contract, injure those entities in the
marketplace, and decrease the likelihood that such entities would work with the department.”34
Pursuant to the OGSR Act, the exemptions will repeal on October 2, 2024, unless reenacted by the
Legislature.
During the 2023 interim, House and Senate committee staff met jointly with staff from the Department
of the Lottery to discuss the public record exemptions under review. Department staff indicated that
they had not had any difficulty interpreting or applying the exemptions and were not aware of any
litigation concerning the exemptions. Department staff noted the continued necessity for the
exemptions and recommended that the exemptions be reenacted as is. Committee staff inquired as to
whether any duplicity existed between the cybersecurity protections in the department’s exemption
concerning