SEARCH SITE

VIRGINIA LAW PORTAL

SEARCHABLE DATABASES

ACROSS SESSIONS

Developed and maintained by the Division of Legislative Automated Systems.

2008 SESSION

081757736
HOUSE BILL NO. 1096
Offered January 9, 2008
Prefiled January 9, 2008
A BILL to amend and reenact §§ 24.2-444 and 59.1-443.2 of the Code of Virginia, to amend the Code of Virginia by adding in Title 2.2 a chapter numbered 38.1, consisting of sections numbered 2.2-3815 through 2.2-3818, and to repeal §§ 2.2-3808 and 2.2-3808.1 of the Code of Virginia, relating to the Protection of Social Security Numbers Act; penalties.
----------
Patron-- Sickles
----------
Referred to Committee on General Laws
----------

Be it enacted by the General Assembly of Virginia:

1.  That §§ 24.2-444 and 59.1-443.2 of the Code of Virginia are amended and reenacted and that the Code of Virginia is amended by adding in Title 2.2 a chapter numbered 38.1, consisting of sections numbered 2.2-3815 through 2.2-3818, as follows:

CHAPTER 38.1.
PROTECTION OF SOCIAL SECURITY NUMBERS ACT.

§ 2.2-3815. Access to social security numbers prohibited; exceptions.

A. Except as otherwise provided in this chapter, the social security number of any individual contained in a public record shall be confidential and exempt from disclosure under the Freedom of Information Act (§ 2.2-3700 et seq.).

For the purposes of this chapter:

"Agency" means the same as that term is defined in § 2.2-3801.

"Data subject" means the same as that term is defined in § 2.2-3801.

"Public record" means the same as that term is defined in § 2.2-3701.

"Regional agency" means a unit of government organized as provided by law whose members are appointed by the participating local governing bodies, and such unit includes two or more counties, cities, or towns.

B. The provisions of this section shall not be construed to prevent the release of a social security number:

1. In accordance with a proper judicial order;

2. To any federal, state or local law-enforcement or correctional personnel, including a law-enforcement officer, probation officer, parole officer or administrator, or a member of a parole board, seeking information in the course of his official duties;

3. By one agency to another agency in Virginia or to an agency in another state, district, or territory of the United States where such information is requested by such agencies in connection with (i) the application of the data subject therein for a service, privilege, or right under the laws thereof, (ii) to information transmitted to family advocacy representatives of the United States Armed Forces in accordance with subsection N of § 63.2-1503, or (iii) the performance of such agency's official duties; or

4. To any data subject exercising his rights under § 2.2-3806, or if the data subject is less than 18 years of age, to his legal guardian or parent, including a noncustodial parent, unless such parent's parental rights have been terminated or a court of competent jurisdiction has restricted or denied such access.

C. Notwithstanding the foregoing, the last four digits of an individual's social security number may be disclosed by an agency for purposes of confirming or otherwise verifying the identity of an individual to:

1. A representative of a news-gathering organization;

2. A registered private investigator employed by or affiliated with a licensed private security business in accordance with Article 4 (§ 9.1-138 et seq.) of Chapter 1 of Title 9.1;

3. A consumer reporting agency, as defined by the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.);

4. A business entity, its affiliates or wholly-owned subsidiaries, commonly referred to as data aggregators, whose principal purpose is the structured collection of data and records obtained from public and private sources into databases to which access is provided for compensation through subscription agreements with the end user; and

5. A lender of money or vendor or lessor of goods, services, or property, rights or privileges, for which payment from the subject individual has not been received, or any successor to the right, title, or interest of any such lender, vendor, or lessor and any affiliate, associate, or subsidiary of any of them, in connection with the collection of such payment.

§ 2.2-3816. Requiring disclosure of social security number prohibited; exceptions.

A. It shall be unlawful for any agency to require an individual to disclose or furnish his social security account number not previously disclosed or furnished, for any purpose in connection with any activity, or to refuse any service, privilege, or right to an individual wholly or partly because the individual does not disclose or furnish such number, unless the disclosure or furnishing of such number is specifically required by federal or state law.

B. Agency-issued identification cards, student identification cards, or license certificates issued or replaced on or after July 1, 2003, shall not display an individual's entire social security number except as provided in § 46.2-703.

C. Any agency-issued identification card, student identification card, or license certificate that was issued prior to July 1, 2003, and that displays an individual's entire social security number shall be replaced no later than July 1, 2006, except that voter registration cards issued with a social security number and not previously replaced shall be replaced no later than the December 31st following the completion by the state and all localities of the decennial redistricting following the 2010 census. This subsection shall not apply to (i) driver's licenses and special identification cards issued by the Department of Motor Vehicles pursuant to Chapter 3 (§ 46.2-300 et seq.) of Title 46.2 and (ii) road tax registrations issued pursuant to § 46.2-703.

D. The provisions of subsections A and C shall not apply to licenses issued by the State Corporation Commission's Bureau of Insurance until such time as a national insurance producer identification number has been created and implemented in all states. Commencing with the date of such implementation, the licenses issued by the State Corporation Commission's Bureau of Insurance shall be issued in compliance with subsection A. Further, all licenses issued prior to the date of such implementation shall be replaced no later than 12 months following the date of such implementation.

§ 2.2-3817. Agencies' disclosure of certain account information prohibited.

Notwithstanding Chapter 37 (§ 2.2-3700 et seq.) of this title, it shall be unlawful for any agency to disclose the social security number or other identification numbers appearing on driver's licenses or information on credit cards, debit cards, bank accounts, or other electronic billing and payment systems that were supplied to an agency for the purpose of paying fees, fines, taxes, or other charges collected by such agency. The prohibition shall not apply where disclosure of such information is required (i) to conduct or complete the transaction for which such information was submitted or (ii) by other law or court order.

§ 2.2-3818.  Proceedings for enforcement of chapter.

A. Any aggrieved person may institute a proceeding for injunction or mandamus against any agency that has engaged, is engaged, or is about to engage in any acts in violation of the provisions of this chapter. Venue for the petition shall be addressed as follows:

1. In a case involving a local agency, to the general district court or circuit court of the county or city from which the agency has been elected or appointed to serve;

2. In a case involving a regional agency, to the general district or circuit court of the county or city where the principal business office of such agency is located; and

3. In a case involving a state agency, including a public institution of higher education, to the general district court or the circuit court of the residence of the aggrieved party or of the City of Richmond.

B. If the court finds a violation of the provisions of this chapter, the petitioner shall be entitled to recover reasonable costs and attorney fees from the agency if the petitioner substantially prevails on the merits of the case, unless special circumstances would make an award unjust. In making this determination, a court may consider, among other things, the reliance of the agency on an opinion of the Attorney General or a decision of a court that substantially supports the agency's position.

§ 24.2-444. Duties of general registrars and State Board of Elections as to voter registration records; public inspection; exceptions.

A. Registration records shall be kept and preserved by the general registrar in compliance with §§ 2.2-3803, 2.2-3808 2.2-3816, and 24.2-114. The State Board shall provide to each general registrar, for each precinct in his county or city, lists of registered voters for inspection and lists of persons registering pursuant to §§ 24.2-442 and 24.2-443.3. The lists shall contain the name, address, date of birth, gender and all election districts applicable to each registered voter. The lists shall be opened to public inspection at the office of the general registrar when the office is open for business. New lists shall be provided not less than once each year to all localities except those in which an updated list is made available electronically for public inspection, and supplements containing additions, deletions, and changes shall be provided not less than (i) weekly during the 60 days preceding any general election and (ii) monthly at other times. Notwithstanding any other provision of law regarding the retention of records, upon receipt of any new complete list, the general registrar shall destroy the obsolete list and its supplements. The State Board shall provide to each general registrar lists of persons denied registration for public inspection. Such lists may be provided electronically through the Virginia voter registration system and produced in whole or in part upon a request for public inspection.

B. The general registrars shall maintain for at least two years and shall make available for public inspection and copying and, where available, photocopying at a reasonable cost, all records concerning the implementation of programs and activities conducted for the purpose of ensuring the accuracy and currency of the registration records pursuant to §§ 24.2-427, 24.2-428 and 24.2-428.1, including lists of the names and addresses of all persons to whom notices are sent, and information concerning whether each person has responded to the notice as of the date that inspection of the records is made.

C. No list provided by the State Board under subsection A nor any record made available for public inspection under subsection B shall contain any of the following information: (i) an individual's social security number, or any part thereof; (ii) the residence address of an individual who has furnished a post office box address in lieu of his residence address as authorized by § 24.2-418; (iii) the declination by an individual to register to vote and related records; or (iv) the identity of a voter registration agency through which a particular voter is registered. No voter registration records other than the lists provided by the State Board under subsection A and the records made available under subsection B shall be open to public inspection.

§ 59.1-443.2. Restricted use of social security numbers.

A. Except as otherwise specifically provided by law, a person shall not:

1. Intentionally communicate an individual's social security number to the general public;

2. Print an individual's social security number on any card required for the individual to access or receive products or services provided by the person;

3. Require an individual to use his social security number to access an Internet website, unless a password, unique personal identification number or other authentication device is also required to access the site; or

4. Send or cause to be sent or delivered any letter, envelope, or package that displays a social security number on the face of the mailing envelope or package, or from which a social security number is visible, whether on the outside or inside of the mailing envelope or package.

B. This section does not prohibit the collection, use, or release of a social security number as permitted by the laws of the Commonwealth or the United States, or the use of a social security number for internal verification or administrative purposes unless such use is prohibited by a state or federal statute, rule, or regulation.

C. In the case of any (i) health care provider as defined in § 8.01-581.1, (ii) manager of a pharmacy benefit plan, (iii) insurer as defined in § 38.2-100, (iv) corporation providing a health services plan, (v) health maintenance organization providing a health care plan for health care services, or (vi) contractor of any such person, the prohibition contained in subdivision 2 of subsection A shall become effective on January 1, 2006.

D. This section shall not apply to (i) public bodies as defined in § 2.2-3701 or agencies as defined in § 2.2-3801 or (ii) records required by law to be open to the public, and shall not be construed to limit access to records pursuant to the Virginia Freedom of Information Act (§ 2.2-3700 et seq.).

E. No person shall embed an encrypted or unencrypted social security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number as required by this section.

2.  That §§ 2.2-3808 and 2.2-3808.1 of the Code of Virginia are repealed.