SEARCH SITE

VIRGINIA LAW PORTAL

SEARCHABLE DATABASES

ACROSS SESSIONS

Developed and maintained by the Division of Legislative Automated Systems.

2016 SESSION

16103916D
SENATE BILL NO. 645
Offered January 18, 2016
A BILL to amend and reenact §§ 2.2-3701, 2.2-3704, and 2.2-3705.2 of the Code of Virginia and to amend the Code of Virginia by adding a section numbered 2.2-3705.2:1, relating to the Virginia Freedom of Information Act; exempt records concerning critical infrastructure, government infrastructure, or security information.
----------
Patron-- McPike
----------
Referred to Committee on General Laws and Technology
----------

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-3701, 2.2-3704, and 2.2-3705.2 of the Code of Virginia are amended and reenacted and that the Code of Virginia is amended by adding a section numbered 2.2-3705.2:1 as follows:

§ 2.2-3701. Definitions.

As used in this chapter, unless the context requires a different meaning:

"Closed meeting" means a meeting from which the public is excluded.

"Critical infrastructure" means systems and assets, whether physical or virtual, so vital to the Commonwealth, the United States, or both, that the incapacity or destruction of such systems and assets would have a debilitating impact on security, economic security, public health or safety, or any combination thereof.

"Electronic communication" means any audio or combined audio and visual communication method.

"Emergency" means an unforeseen circumstance rendering the notice required by this chapter impossible or impracticable and which circumstance requires immediate action.

"Government infrastructure" means systems and assets, whether physical or virtual, that are owned or operated by the Commonwealth or its political subdivisions, that have not been identified as critical infrastructure, and whose incapacity or destruction would have a significant impact on security, economic security, public health or safety, or any combination thereof.

"Interdependency" means the mutual dependence of one critical or government infrastructure upon another for functionality, the failure of which would cause a debilitating impact on the safety and security of the Commonwealth, the United States, or both. These reciprocal relationships are created by the interactions between the physical, virtual, social, behavioral, and economic elements of critical and government infrastructure.

"Meeting" or "meetings" means the meetings including work sessions, when sitting physically, or through telephonic or video equipment pursuant to § 2.2-3708 or 2.2-3708.1, as a body or entity, or as an informal assemblage of (i) as many as three members or (ii) a quorum, if less than three, of the constituent membership, wherever held, with or without minutes being taken, whether or not votes are cast, of any public body. Neither the gathering of employees of a public body nor the gathering or attendance of two or more members of a public body (i) at any place or function where no part of the purpose of such gathering or attendance is the discussion or transaction of any public business, and such gathering or attendance was not called or prearranged with any purpose of discussing or transacting any business of the public body, or (ii) at a public forum, candidate appearance, or debate, the purpose of which is to inform the electorate and not to transact public business or to hold discussions relating to the transaction of public business, even though the performance of the members individually or collectively in the conduct of public business may be a topic of discussion or debate at such public meeting, shall be deemed a "meeting" subject to the provisions of this chapter.

"Open meeting" or "public meeting" means a meeting at which the public may be present.

"Public body" means any legislative body, authority, board, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards and planning commissions; boards of visitors of public institutions of higher education; and other organizations, corporations or agencies in the Commonwealth supported wholly or principally by public funds. It shall include (i) the Virginia Birth-Related Neurological Injury Compensation Program and its board of directors established pursuant to Chapter 50 (§ 38.2-5000 et seq.) of Title 38.2 and (ii) any committee, subcommittee, or other entity however designated, of the public body created to perform delegated functions of the public body or to advise the public body. It shall not exclude any such committee, subcommittee or entity because it has private sector or citizen members. Corporations organized by the Virginia Retirement System are "public bodies" for purposes of this chapter.

For the purposes of the provisions of this chapter applicable to access to public records, constitutional officers and private police departments as defined in § 9.1-101 shall be considered public bodies and, except as otherwise expressly provided by law, shall have the same obligations to disclose public records as other custodians of public records.

"Public records" means all writings and recordings that consist of letters, words or numbers, or their equivalent, set down by handwriting, typewriting, printing, photostatting, photography, magnetic impulse, optical or magneto-optical form, mechanical or electronic recording or other form of data compilation, however stored, and regardless of physical form or characteristics, prepared or owned by, or in the possession of a public body or its officers, employees or agents in the transaction of public business. Records that are not prepared for or used in the transaction of public business are not public records.

"Regional public body" means a unit of government organized as provided by law within defined boundaries, as determined by the General Assembly, whose members are appointed by the participating local governing bodies, and such unit includes two or more counties or cities.

"Scholastic records" means those records containing information directly related to a student or an applicant for admission and maintained by a public body that is an educational agency or institution or by a person acting for such agency or institution.

"Security information" means information that is (i) not generally available to the public through regulatory disclosure or otherwise and (ii) related to the protection of government infrastructure and critical infrastructure or protected systems, or related to any of the following:

1. An attack, criminal act, either physical or technology-based, or a natural disaster;

2. The ability of government infrastructure or critical infrastructure to resist such attack, criminal act, or natural disaster, including planned or past assessments of vulnerability and risk management planning;

3. Planned or past operational problems regarding government infrastructure or critical infrastructure;

4. Operational, procedural, transportation, and tactical planning or training manuals;

5. Cybersecurity threats or vulnerabilities or security plans and measures of an entity, facility, building structure, information technology system, or software program; or

6. Emergency response and continuity plans.

§ 2.2-3704. Public records to be open to inspection; procedure for requesting records and responding to request; charges; transfer of records for storage, etc.

A. Except as otherwise specifically provided by law, all public records shall be open to inspection and copying by any citizens of the Commonwealth during the regular office hours of the custodian of such records. Access to such records shall not be denied to citizens of the Commonwealth, representatives of newspapers and magazines with circulation in the Commonwealth, and representatives of radio and television stations broadcasting in or into the Commonwealth. The custodian may require the requester to provide his name and legal address. The custodian of such records shall take all necessary precautions for their preservation and safekeeping.

B. A request for public records shall identify the requested records with reasonable specificity. The request need not make reference to this chapter in order to invoke the provisions of this chapter or to impose the time limits for response by a public body. Any Except as provided in § 2.2-3705.2:1, any public body that is subject to this chapter and that is the custodian of the requested records shall promptly, but in all cases within five working days of receiving a request, provide the requested records to the requester or make one of the following responses in writing:

1. The requested records are being entirely withheld because their release is prohibited by law or the custodian has exercised his discretion to withhold the records in accordance with this chapter. Such response shall identify with reasonable particularity the volume and subject matter of withheld records, and cite, as to each category of withheld records, the specific Code section that authorizes the withholding of the records.

2. The requested records are being provided in part and are being withheld in part because the release of part of the records is prohibited by law or the custodian has exercised his discretion to withhold a portion of the records in accordance with this chapter. Such response shall identify with reasonable particularity the subject matter of withheld portions, and cite, as to each category of withheld records, the specific Code section that authorizes the withholding of the records. When a portion of a requested record is withheld, the public body may delete or excise only that portion of the record to which an exemption applies and shall release the remainder of the record.

3. The requested records could not be found or do not exist. However, if the public body that received the request knows that another public body has the requested records, the response shall include contact information for the other public body.

4. It is not practically possible to provide the requested records or to determine whether they are available within the five-work-day period. Such response shall specify the conditions that make a response impossible. If the response is made within five working days, the public body shall have an additional seven work days in which to provide one of the four preceding responses.

C. Any public body may petition the appropriate court for additional time to respond to a request for records when the request is for an extraordinary volume of records or requires an extraordinarily lengthy search, and a response by the public body within the time required by this chapter will prevent the public body from meeting its operational responsibilities. Before proceeding with the petition, however, the public body shall make reasonable efforts to reach an agreement with the requester concerning the production of the records requested.

D. Subject to the provisions of subsection G, no public body shall be required to create a new record if the record does not already exist. However, a public body may abstract or summarize information under such terms and conditions as agreed between the requester and the public body.

E. Failure to respond to a request for records shall be deemed a denial of the request and shall constitute a violation of this chapter.

F. A public body may make reasonable charges not to exceed its actual cost incurred in accessing, duplicating, supplying, or searching for the requested records. No public body shall impose any extraneous, intermediary or surplus fees or expenses to recoup the general costs associated with creating or maintaining records or transacting the general business of the public body. Any duplicating fee charged by a public body shall not exceed the actual cost of duplication. The public body may also make a reasonable charge for the cost incurred in supplying records produced from a geographic information system at the request of anyone other than the owner of the land that is the subject of the request. However, such charges shall not exceed the actual cost to the public body in supplying such records, except that the public body may charge, on a pro rata per acre basis, for the cost of creating topographical maps developed by the public body, for such maps or portions thereof, which encompass a contiguous area greater than 50 acres. All charges for the supplying of requested records shall be estimated in advance at the request of the citizen.

G. Public records maintained by a public body in an electronic data processing system, computer database, or any other structured collection of data shall be made available to a requester at a reasonable cost, not to exceed the actual cost in accordance with subsection F. When electronic or other databases are combined or contain exempt and nonexempt records, the public body may provide access to the exempt records if not otherwise prohibited by law, but shall provide access to the nonexempt records as provided by this chapter.

Public bodies shall produce nonexempt records maintained in an electronic database in any tangible medium identified by the requester, including, where the public body has the capability, the option of posting the records on a website or delivering the records through an electronic mail address provided by the requester, if that medium is used by the public body in the regular course of business. No public body shall be required to produce records from an electronic database in a format not regularly used by the public body. However, the public body shall make reasonable efforts to provide records in any format under such terms and conditions as agreed between the requester and public body, including the payment of reasonable costs. The excision of exempt fields of information from a database or the conversion of data from one available format to another shall not be deemed the creation, preparation or compilation of a new public record.

H. In any case where a public body determines in advance that charges for producing the requested records are likely to exceed $200, the public body may, before continuing to process the request, require the requester to agree to payment of a deposit not to exceed the amount of the advance determination. The deposit shall be credited toward the final cost of supplying the requested records. The period within which the public body shall respond under this section shall be tolled for the amount of time that elapses between notice of the advance determination and the response of the requester.

I. Before processing a request for records, a public body may require the requester to pay any amounts owed to the public body for previous requests for records that remain unpaid 30 days or more after billing.

J. In the event a public body has transferred possession of public records to any entity, including but not limited to any other public body, for storage, maintenance, or archiving, the public body initiating the transfer of such records shall remain the custodian of such records for purposes of responding to requests for public records made pursuant to this chapter and shall be responsible for retrieving and supplying such public records to the requester. In the event a public body has transferred public records for storage, maintenance, or archiving and such transferring public body is no longer in existence, any public body that is a successor to the transferring public body shall be deemed the custodian of such records. In the event no successor entity exists, the entity in possession of the public records shall be deemed the custodian of the records for purposes of compliance with this chapter, and shall retrieve and supply such records to the requester. Nothing in this subsection shall be construed to apply to records transferred to the Library of Virginia for permanent archiving pursuant to the duties imposed by the Virginia Public Records Act (§ 42.1-76 et seq.). In accordance with § 42.1-79, the Library of Virginia shall be the custodian of such permanently archived records and shall be responsible for responding to requests for such records made pursuant to this chapter.

§ 2.2-3705.2. Exclusions to application of chapter; records relating to public safety.

The following records are excluded from the provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law:

1. Confidential records, including victim identity, provided to or obtained by staff in a rape crisis center or a program for battered spouses.

2. Those portions of engineering and construction drawings and plans submitted for the sole purpose of complying with the Building Code in obtaining a building permit that would identify specific trade secrets or other information, the disclosure of which would be harmful to the competitive position of the owner or lessee. However, such information shall be exempt only until the building is completed. Information relating to the safety or environmental soundness of any building shall not be exempt from disclosure.

Those portions of engineering and construction drawings and plans that reveal critical structural components, security equipment and systems, ventilation systems, fire protection equipment, mandatory building emergency equipment or systems, elevators, electrical systems, telecommunications equipment and systems, and other utility equipment and systems submitted for the purpose of complying with the Uniform Statewide Building Code (§ 36-97 et seq.) or the Statewide Fire Prevention Code (§ 27-94 et seq.), the disclosure of which would jeopardize the safety or security of any public or private commercial office, multifamily residential or retail building or its occupants in the event of terrorism or other threat to public safety, to the extent that the owner or lessee of such property, equipment or system in writing (i) invokes the protections of this paragraph; (ii) identifies the drawings, plans, or other materials to be protected; and (iii) states the reasons why protection is necessary.

Nothing in this subdivision shall prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster or other catastrophic event.

3. Documentation or other information that describes the design, function, operation or access control features of any security system, whether manual or automated, which is used to control access to or use of any automated data processing or telecommunications system.

4. Plans and information to prevent or respond to terrorist activity, criminal activity affecting critical infrastructure or government infrastructure, or cyber attacks, the disclosure of which would jeopardize the safety of any person, including (i) critical infrastructure sector or, government infrastructure, and associated structural components; (ii) vulnerability assessments, operational, procedural, transportation, and tactical planning or training manuals, security information that is protected by the federal Critical Infrastructure Information Act of 2002 (6 U.S.C. § 131 et seq.) provided to any state agency or political subdivision of the Commonwealth, or an authorized agent of a state agency or political subdivision, and related staff meeting minutes or other related records; and (iii) engineering or architectural records, or records containing information derived from such records, to the extent such records reveal the location or operation of security equipment and systems, elevators, ventilation, fire protection, emergency, electrical, telecommunications or utility equipment and systems of any public building, structure or information storage facility, or telecommunications or utility equipment or systems; and (iv) information not lawfully available to the public regarding specific cybersecurity threats or vulnerabilities or security plans and measures of an entity, facility, building structure, information technology system, or software program.

The same categories of records of any person or entity submitted to a public body for the purpose of antiterrorism response planning or, cybersecurity planning or protection, or government infrastructure or critical infrastructure security and resilience may be withheld from disclosure if such person or entity in writing (a) invokes the protections of this subdivision, (b) identifies with specificity the records or portions thereof for which protection is sought, and (c) states with reasonable particularity why the protection of such records from public disclosure is necessary to meet the objective of antiterrorism or, cybersecurity planning or protection, or government infrastructure or critical infrastructure security and resilience. Such statement shall be a public record and shall be disclosed upon request. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the structural or environmental soundness of any building, nor shall it prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster, or other catastrophic event.

5. Information that would disclose the security aspects of a system safety program plan adopted pursuant to 49 C.F.R. Part 659 by the Commonwealth's designated Rail Fixed Guideway Systems Safety Oversight agency; and information in the possession of such agency, the release of which would jeopardize the success of an ongoing investigation of a rail accident or other incident threatening railway safety.

6. Engineering and architectural drawings, operational, procedural, tactical planning or training manuals, or staff meeting minutes or other records, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building or structure or the safety of persons using such facility, building or structure.

7. Security plans and specific assessment components of school safety audits, as provided in § 22.1-279.8.

Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the effectiveness of security plans after (i) any school building or property has been subjected to fire, explosion, natural disaster or other catastrophic event, or (ii) any person on school property has suffered or been threatened with any personal injury.

8. [Expired.]

9. Records of the Commitment Review Committee concerning the mental health assessment of an individual subject to commitment as a sexually violent predator under Chapter 9 (§ 37.2-900 et seq.) of Title 37.2; except that in no case shall records identifying the victims of a sexually violent predator be disclosed.

10. Subscriber data, which for the purposes of this subdivision, means the name, address, telephone number, and any other information identifying a subscriber of a telecommunications carrier, provided directly or indirectly by a telecommunications carrier to a public body that operates a 911 or E-911 emergency dispatch system or an emergency notification or reverse 911 system, if the data is in a form not made available by the telecommunications carrier to the public generally. Nothing in this subdivision shall prevent the release of subscriber data generated in connection with specific calls to a 911 emergency system, where the requester is seeking to obtain public records about the use of the system in response to a specific crime, emergency or other event as to which a citizen has initiated a 911 call.

11. Subscriber data, which for the purposes of this subdivision, means the name, address, telephone number, and any other information identifying a subscriber of a telecommunications carrier, collected by a local governing body in accordance with the Enhanced Public Safety Telephone Services Act (§ 56-484.12 et seq.), and other identifying information of a personal, medical, or financial nature provided to a local governing body in connection with a 911 or E-911 emergency dispatch system or an emergency notification or reverse 911 system, if such records are not otherwise publicly available. Nothing in this subdivision shall prevent the release of subscriber data generated in connection with specific calls to a 911 emergency system, where the requester is seeking to obtain public records about the use of the system in response to a specific crime, emergency or other event as to which a citizen has initiated a 911 call.

12. Records of the Virginia Military Advisory Council or any commission created by executive order for the purpose of studying and making recommendations regarding preventing closure or realignment of federal military and national security installations and facilities located in Virginia and relocation of such facilities to Virginia, or a local or regional military affairs organization appointed by a local governing body, to the extent such records (i) contain information relating to strategies under consideration or development by the Council or such commission or organizations to prevent the closure or realignment of federal military installations located in Virginia or the relocation of national security facilities located in Virginia, to limit the adverse economic effect of such realignment, closure, or relocation, or to seek additional tenant activity growth from the Department of Defense or federal government or (ii) disclose trade secrets, as defined in the Uniform Trade Secrets Act (§ 59.1-336 et seq.), provided to the Council or such commission or organizations in connection with their work. In order to invoke the trade secret protection provided by clause (ii), the submitting entity shall, in writing and at the time of submission (a) invoke this exclusion, (b) identify with specificity the information for which such protection is sought, and (c) state the reason why such protection is necessary. Nothing in this subdivision shall be construed to authorize the withholding of all or part of any record, other than a trade secret that has been specifically identified as required by this subdivision, after the Department of Defense or federal agency has issued a final, unappealable decision, or in the event of litigation, a court of competent jurisdiction has entered a final, unappealable order concerning the closure, realignment, or expansion of the military installation or tenant activities, or the relocation of the national security facility, for which records are sought.

13. Documentation or other information as determined by the State Comptroller that describes the design, function, operation, or implementation of internal controls over the Commonwealth's financial processes and systems, and the assessment of risks and vulnerabilities of those controls, including the annual assessment of internal controls mandated by the State Comptroller, the disclosure of which would jeopardize the security of the Commonwealth's financial assets. However, records relating to the investigation of and findings concerning the soundness of any fiscal process shall be disclosed in a form that does not compromise internal controls. Nothing in this subdivision shall be construed to prohibit the Auditor of Public Accounts or the Joint Legislative Audit and Review Commission from reporting internal control deficiencies discovered during the course of an audit.

14. Documentation or other information relating to the Statewide Agencies Radio System (STARS) or any other similar local or regional public safety communications system that (i) describes the design, function, programming, operation, or access control features of the overall system, components, structures, individual networks, and subsystems of the STARS or any other similar local or regional communications system or (ii) relates to radio frequencies assigned to or utilized by STARS or any other similar local or regional communications system, code plugs, circuit routing, addressing schemes, talk groups, fleet maps, encryption, programming maintained by or utilized by STARS or any other similar local or regional public safety communications system; those portions of engineering and construction drawings and plans that reveal critical structural components, interconnectivity, security equipment and systems, network monitoring, network operation center, master sites, ventilation systems, fire protection equipment, mandatory building emergency equipment, electrical systems, and other utility equipment and systems related to STARS or any other similar local or regional public safety communications system; and special event plans, operational plans, storm plans, or other pre-arranged programming, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building, or structure or the safety of any person.

15. Records of a salaried or volunteer Fire/EMS company or Fire/EMS department, to the extent that the records disclose the telephone numbers for cellular telephones, pagers, or comparable portable communication devices provided to its personnel for use in the performance of their official duties.

16. Records of hospitals and nursing homes regulated by the Board of Health pursuant to Chapter 5 (§ 32.1-123 et seq.) of Title 32.1 provided to the Department of Health, to the extent such records reveal the disaster recovery plans or the evacuation plans for such facilities in the event of fire, explosion, natural disaster, or other catastrophic event. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the effectiveness of executed evacuation plans after the occurrence of fire, explosion, natural disaster, or other catastrophic event.

§ 2.2-3705.2:1. Public safety exclusions; required procedure prior to discretionary disclosure.

A. In the event that a custodian decides to exercise his discretion to disclose records excluded under § 2.2-3705.2, the following process shall be followed before the custodian may disclose such records:

1. The custodian shall notify the entity or person that is the subject of the records of his intent to disclose the records. This notification should provide sufficient notice of the records to be released, the identification of the person requesting the records, and the entity's or person's right to object to the release of the information and the process for objecting as described herein.

2. The entity or person that is the subject of the records shall have seven days after receiving the notification in subdivision 1 to respond to the custodian with a written objection to the release of the records, stating the entity's or person's reasons for objecting to the release.

3. If no timely objection is received by the custodian, then he may release the records. If the custodian receives an objection from the entity or person that is the subject of the records, the custodian shall have an additional seven days to decide whether to release the records.

4. The custodian shall then notify the entity or person that is the subject of the records of his decision on release of the records. The custodian shall wait at least seven days after this notification before releasing the records. If during this period the entity or person that is the subject of the records files a petition in the appropriate court seeking relief from the custodian's decision to release the records, then the custodian shall await resolution of the petition before releasing the documents.

B. After receiving the notice provided for in subdivision A 4, the entity or person that is the subject of the records may petition the appropriate court for mandamus or injunction to prevent the release of records described in this section. The provisions of § 2.2-3713 shall govern such petitions for mandamus or injunction, except that in order to prevail, the petitioner shall have the burden of establishing that the risk to public safety from release of the records substantially outweighs the public's interest in obtaining access to the information.