Contracting with entities of foreign countries of concern prohibited.

(1) As used in this section, the term:

(a) “Controlling interest” means possession of the power to direct or cause the direction of the management or policies of a company, whether through ownership of securities, by contract, or otherwise. A person or entity that directly or indirectly has the right to vote 25 percent or more of the voting interests of the company or is entitled to 25 percent or more of its profits is presumed to possess a controlling interest.

(b) “Department” means the Department of Management Services.

(c) “Foreign country of concern” means the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Republic of Cuba, the Venezuelan regime of Nicolás Maduro, or the Syrian Arab Republic, including any agency of or any other entity of significant control of such foreign country of concern.

(d) “Governmental entity” means any state, county, district, authority, or municipal officer, department, division, board, bureau, commission, or other separate unit of government created or established by law including, but not limited to, the Commission on Ethics, the Public Service Commission, the Office of Public Counsel, and any other public or private agency, person, partnership, corporation, or business entity acting on behalf of any public agency.

(2) A governmental entity may not knowingly enter into a contract with an entity which would give access to an individual’s personal identifying information if:

(a) The entity is owned by the government of a foreign country of concern;

(b) The government of a foreign country of concern has a controlling interest in the entity; or

(c) The entity is organized under the laws of or has its principal place of business in a foreign country of concern.

(3) Beginning July 1, 2025, a governmental entity may not extend or renew a contract with an entity listed in paragraphs (2)(a)-(c) if the contract would give such entity access to an individual’s personal identifying information.

(4)(a) Beginning January 1, 2024, a governmental entity may not accept a bid on, a proposal for, or a reply to, or enter into, a contract with an entity which would grant the entity access to an individual’s personal identifying information unless the entity provides the governmental entity with an affidavit signed by an officer or representative of the entity under penalty of perjury attesting that the entity does not meet any of the criteria in paragraphs (2)(a)-(c).

(b) Beginning July 1, 2025, when an entity extends or renews a contract with a governmental entity which would grant the entity access to an individual’s personal identifying information, the entity must provide the governmental entity with an affidavit signed by an officer or representative of the entity under penalty of perjury attesting that the entity does not meet any of the criteria in paragraphs (2)(a)-(c).

(5) The Attorney General may bring a civil action in any court of competent jurisdiction against an entity that violates this section. Violations of this section may result in:

(a) A civil penalty equal to twice the amount of the contract for which the entity submitted a bid or proposal for, replied to, or entered into;

(b) Ineligibility to enter into, renew, or extend any contract, including any grant agreements, with any governmental entity for up to 5 years;

(c) Ineligibility to receive or renew any license, certification, or credential issued by a governmental entity for up to 5 years; and

(d) Placement on the suspended vendor list pursuant to s. 287.1351.

(6) Any penalties collected under subsection (5) must be deposited into the General Revenue Fund.

(7) The department shall adopt rules to implement this section, including rules establishing the form for the affidavit required under subsection (4).