SEARCH SITE

VIRGINIA LAW PORTAL

SEARCHABLE DATABASES

ACROSS SESSIONS

Developed and maintained by the Division of Legislative Automated Systems.

2022 SESSION

22102713D
SENATE BILL NO. 324
Offered January 12, 2022
Prefiled January 11, 2022
A BILL to amend and reenact §§ 2.2-3701, 2.2-3801, and 2.2-3808 of the Code of Virginia, relating to public agencies; privacy of personal information.
----------
Patron-- Vogel
----------
Referred to Committee on General Laws and Technology
----------

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-3701, 2.2-3801, and 2.2-3808 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-3701. Definitions.

As used in this chapter, unless the context requires a different meaning:

"Closed meeting" means a meeting from which the public is excluded.

"Electronic communication" means the use of technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities to transmit or receive information.

"Emergency" means an unforeseen circumstance rendering the notice required by this chapter impossible or impracticable and which circumstance requires immediate action.

"Information" as used in the exclusions established by §§ 2.2-3705.1 through 2.2-3705.7, means the content within a public record that references a specifically identified subject matter, and shall not be interpreted to require the production of information that is not embodied in a public record.

"Meeting" or "meetings" means the meetings including work sessions, when sitting physically, or through electronic communication means pursuant to § 2.2-3708.2, as a body or entity, or as an informal assemblage of (i) as many as three members or (ii) a quorum, if less than three, of the constituent membership, wherever held, with or without minutes being taken, whether or not votes are cast, of any public body. Neither the gathering of employees of a public body nor the gathering or attendance of two or more members of a public body (a) at any place or function where no part of the purpose of such gathering or attendance is the discussion or transaction of any public business, and such gathering or attendance was not called or prearranged with any purpose of discussing or transacting any business of the public body, or (b) at a public forum, candidate appearance, or debate, the purpose of which is to inform the electorate and not to transact public business or to hold discussions relating to the transaction of public business, even though the performance of the members individually or collectively in the conduct of public business may be a topic of discussion or debate at such public meeting, shall be deemed a "meeting" subject to the provisions of this chapter.

"Open meeting" or "public meeting" means a meeting at which the public may be present.

"Public body" means any legislative body, authority, board, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards and planning commissions; governing boards of public institutions of higher education; and other organizations, corporations or agencies in the Commonwealth supported wholly or principally by public funds. It shall include (i) the Virginia Birth-Related Neurological Injury Compensation Program and its board of directors established pursuant to Chapter 50 (§ 38.2-5000 et seq.) of Title 38.2 and (ii) any committee, subcommittee, or other entity however designated, of the public body created to perform delegated functions of the public body or to advise the public body. It shall not exclude any such committee, subcommittee or entity because it has private sector or citizen members. Corporations organized by the Virginia Retirement System are "public bodies" for purposes of this chapter.

For the purposes of the provisions of this chapter applicable to access to public records, constitutional officers and private police departments as defined in § 9.1-101 shall be considered public bodies and, except as otherwise expressly provided by law, shall have the same obligations to disclose public records as other custodians of public records.

"Public records" means all writings and recordings that consist of letters, words or numbers, or their equivalent, set down by handwriting, typewriting, printing, photostatting, photography, magnetic impulse, optical or magneto-optical form, mechanical or electronic recording or other form of data compilation, however stored, and regardless of physical form or characteristics, prepared or owned by, or in the possession of a public body or its officers, employees or agents in the transaction of public business. "Public records" does not include "personal information" as defined in § 2.2-3801.

"Regional public body" means a unit of government organized as provided by law within defined boundaries, as determined by the General Assembly, which unit includes two or more localities.

"Scholastic records" means those records containing information directly related to a student or an applicant for admission and maintained by a public body that is an educational agency or institution or by a person acting for such agency or institution.

"Trade secret" means the same as that term is defined in the Uniform Trade Secrets Act (§ 59.1-336 et seq.).

§ 2.2-3801. Definitions.

As used in this chapter, unless the context requires a different meaning:

"Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship.

"Data subject" means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system.

"Disseminate" means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means.

"Information system" means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject.

"Personal information" means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring directly or indirectly personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, including any entity organized under § 501(c) of the federal Internal Revenue Code, or admission to an institution. "Personal information" shall not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely any data subject nor does the term include real estate assessment information.

"Proper purpose" includes the sharing or dissemination of data or information among and between agencies in order to (i) streamline administrative processes to improve the efficiency and efficacy of services, access to services, eligibility determinations for services, and service delivery; (ii) reduce paperwork and administrative burdens on applicants for and recipients of public services; (iii) improve the efficiency and efficacy of the management of public programs; (iv) prevent fraud and improve auditing capabilities; (v) conduct outcomes-related research; (vi) develop quantifiable data to aid in policy development and decision making to promote the most efficient and effective use of resources; and (vii) perform data analytics regarding any of the purposes set forth in this definition.

"Purge" means to obliterate information completely from the transient, permanent, or archival records of an agency.

§ 2.2-3808. Collection, disclosure, or display of social security number.

A. It shall be unlawful for any agency to:

1. Require an individual to disclose or furnish his social security number not previously disclosed or furnished, for any purpose in connection with any activity, or to refuse any service, privilege, or right to an individual wholly or partly because the individual does not disclose or furnish such number, unless the disclosure or furnishing of such number is specifically required by state law in effect prior to January 1, 1975, or is specifically authorized or required by federal law; or

2. Collect from an individual his social security number or any portion thereof unless the collection of such number is (i) authorized or required by state or federal law and (ii) essential for the performance of that agency's duties. Nothing in this subdivision shall be construed to prohibit the collection of a social security number for the sole purpose of complying with the Virginia Debt Collection Act (§ 2.2-4800 et seq.) or the Setoff Debt Collection Act (§ 58.1-520 et seq.);

3. Require an entity organized under § 501(c) of the Internal Revenue Code to provide the agency with personal information;

4. Require any bidder, offeror, or contractor of an agency to provide personal information; or

5. Disclose personal information without the express, written permission of every person who is identifiable from the potential release of such personal information, including persons identifiable as members, supporters, volunteers, or donors.

B. Agency-issued identification cards, student identification cards, or license certificates issued or replaced on or after July 1, 2003, shall not display an individual's entire social security number except as provided in § 46.2-703.

C. Any agency-issued identification card, student identification card, or license certificate that was issued prior to July 1, 2003, and that displays an individual's entire social security number shall be replaced no later than July 1, 2006, except that voter registration cards issued with a social security number and not previously replaced shall be replaced no later than the December 31st following the completion by the state and all localities of the decennial redistricting following the 2010 census. This subsection shall not apply to (i) driver's licenses and special identification cards issued by the Department of Motor Vehicles pursuant to Chapter 3 (§ 46.2-300 et seq.) of Title 46.2 and (ii) road tax registrations issued pursuant to § 46.2-703.

D. No agency, as defined in § 42.1-77, shall send or deliver or cause to be sent or delivered, any letter, envelope, or package that displays a social security number on the face of the mailing envelope or package or from which a social security number is visible, whether on the outside or inside of the mailing envelope or package.

E. The provisions of subsections A and C shall not be applicable to licenses:

1. Licenses issued by the State Corporation Commission's Bureau of Insurance until such time as a national insurance producer identification number has been created and implemented in all states. Commencing with the date of such implementation, the licenses issued by the State Corporation Commission's Bureau of Insurance shall be issued in compliance with subsection A of this section. Further, all licenses issued prior to the date of such implementation shall be replaced no later than 12 months following the date of such implementation;

2. Any lawful warrant for personal information issued by a court of competent jurisdiction; or

3. Any lawful request for discovery of personal information in litigation if (i) the requester demonstrates a compelling need for the personal information by clear and convincing evidence and (ii) the requester obtains a protective order barring disclosure of personal information to any person not directly involved in the litigation. As used in this subdivision, "person" means an individual, partnership, corporation, association, governmental entity, or other legal entity.

F. A person alleging a violation of this section may bring a civil action for appropriate injunctive relief. A court rendering judgment in favor of a complainant pursuant to this subsection shall award all or a portion of the costs of litigation, including reasonable attorney's fees and witness fees, to the complainant.

G. A person who knowingly violates this section is guilty of a misdemeanor punishable by imprisonment of up to 90 days, a fine up to $1,000, or both.

H. The requirements of this section shall not apply to the Campaign Finance Disclosure Act of 2006 (§ 24.2-945 et seq.).