SB132: Government Data Collection and Dissemination Practices Act; disclosure of personal information.

SENATE BILL NO. 132
Offered January 9, 2008
Prefiled January 3, 2008
A BILL to amend and reenact §§ 2.2-3801, 2.2-3808, 2.2-3809, and 16.1-77 of the Code of Virginia, relating to the Government Data Collection and Dissemination Practices Act; personal information; definition; collection of same; penalty for violation; jurisdiction of district courts.
Patron-- Houck

Referred to Committee on General Laws and Technology

Be it enacted by the General Assembly of Virginia:

1.  That §§ 2.2-3801, 2.2-3808, 2.2-3809, and 16.1-77 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-3801. Definitions.

As used in this chapter, unless the context requires a different meaning:

1. "Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship.

"Data subject" means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system.

"Disseminate" means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means.

"Information system" means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject.

2. "Personal information" means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or that (ii) affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. "Personal information" shall not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely any data subject nor does the term include real estate assessment information.

3. "Data subject" means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system.

4. "Disseminate" means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means.

5. "Purge" means to obliterate information completely from the transient, permanent, or archival records of an organization.

6. "Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship.

§ 2.2-3808. Collection, disclosure, or display of social security number.

A. It shall be unlawful for No agency shall require an individual to furnish or disclose his social security number or driver's license number unless the furnishing or disclosure of such number is (i) expressly authorized by state or federal law and (ii) essential for the performance of that agency's duties.  Nor shall any agency to require an individual to disclose or furnish his social security account number not previously disclosed or furnished, for any purpose in connection with any activity, or to refuse any service, privilege or right to an individual wholly or partly because the individual does not disclose or furnish such number, unless the disclosure or furnishing of such number is specifically required by federal or state law.

B. Agency-issued identification cards, student identification cards, or license certificates issued or replaced on or after July 1, 2003, shall not display an individual's entire social security number except as provided in § 46.2-703.

C. Any agency-issued identification card, student identification card, or license certificate that was issued prior to July 1, 2003, and that displays an individual's entire social security number shall be replaced no later than July 1, 2006, except that voter registration cards issued with a social security number and not previously replaced shall be replaced no later than the December 31st following the completion by the state and all localities of the decennial redistricting following the 2010 census. This subsection shall not apply to (i) driver's licenses and special identification cards issued by the Department of Motor Vehicles pursuant to Chapter 3 (§ 46.2-300 et seq.) of Title 46.2 and (ii) road tax registrations issued pursuant to § 46.2-703.

D. The provisions of subsections A and C of this section shall not be applicable to licenses issued by the State Corporation Commission's Bureau of Insurance until such time as a national insurance producer identification number has been created and implemented in all states. Commencing with the date of such implementation, the licenses issued by the State Corporation Commission's Bureau of Insurance shall be issued in compliance with subsection A of this section. Further, all licenses issued prior to the date of such implementation shall be replaced no later than 12 months following the date of such implementation.

§ 2.2-3809. Injunctive relief; civil penalty; attorneys' fees.

Any aggrieved person may institute a proceeding for injunction or mandamus against any person or agency that has engaged, is engaged, or is about to engage in any acts or practices in violation of the provisions of this chapter. The proceeding shall be brought in the district or circuit court of any county or city wherein the person where the aggrieved person resides or where the agency made defendant resides or has a place of business.

In the case of any successful proceeding by an aggrieved party, the person or agency enjoined or made subject to a writ of mandamus by the court shall be liable for the costs of the action together with reasonable attorneys' fees as determined by the court.

In addition, if the court finds that a violation of subsection A of § 2.2-3808 was willfully and knowingly made by a specific public officer, appointee, or employee of any agency, the court may impose upon such individual a civil penalty of not less than $250 nor more than $1,000, which amount shall be paid into the State Literary Fund. For a second or subsequent violation, such civil penalty shall be not less than $1,000 nor more than $2,500. For a violation of subsection A of § 2.2-3808 by any agency, the court may impose a civil penalty of not less than $250 nor more than $1,000, which amount shall be paid into the State Literary Fund. For a second or subsequent violation, such civil penalty shall be not less than $1,000 nor more than $2,500.

§ 16.1-77. Civil jurisdiction of general district courts.

Except as provided in Article 5 (§ 16.1-122.1 et seq.) of this chapter, each general district court shall have, within the limits of the territory it serves, civil jurisdiction as follows:

(1) Exclusive original jurisdiction of any claim to specific personal property or to any debt, fine or other money, or to damages for breach of contract or for injury done to property, real or personal, or for any injury to the person that would be recoverable by action at law or suit in equity, when the amount of such claim does not exceed $4,500 exclusive of interest and any attorney's fees contracted for in the instrument, and concurrent jurisdiction with the circuit courts having jurisdiction in such territory of any such claim when the amount thereof exceeds $4,500 but does not exceed $15,000, exclusive of interest and any attorney's fees contracted for in the instrument. However, this $15,000 limit shall not apply with respect to distress warrants under the provisions of § 55-230, cases involving liquidated damages for violations of vehicle weight limits pursuant to § 46.2-1135, nor cases involving forfeiture of a bond pursuant to § 19.2-143.

(2) Jurisdiction to try and decide attachment cases when the amount of the plaintiff's claim does not exceed $15,000 exclusive of interest and any attorney's fees contracted for in the instrument.

(3) Jurisdiction of actions of unlawful entry or detainer as provided in Article 13 (§ 8.01-124 et seq.) of Chapter 3 of Title 8.01, and in Chapter 13 (§ 55-217 et seq.) of Title 55, and the maximum jurisdictional limits prescribed in subdivision (1) shall not apply to any claim, counter-claim or cross-claim in an action for damages sustained or rent proved to be owing where the premises were used by the occupant primarily for business, commercial or agricultural purposes. Any counter-claim or cross-claim shall arise out of the same use of the property for business, commercial or agricultural purposes.

(4) Except where otherwise specifically provided, all jurisdiction, power and authority over any civil action or proceeding conferred upon any general district court judge or magistrate under or by virtue of any provisions of the Code of Virginia.

(5) Jurisdiction to try and decide suits in interpleader involving personal property where the amount of money or value of the property is not more than the maximum jurisdictional limits of the general district court. The action shall be brought in accordance with the procedures for interpleader as set forth in § 8.01-364. However, the general district court shall not have any power to issue injunctions. Actions in interpleader may be brought by either the stakeholder or any of the claimants. The initial pleading shall be either by motion for judgment or by warrant in debt. The initial pleading shall briefly set forth the circumstances of the claim and shall name as defendant all parties in interest who are not parties plaintiff.

(6) Jurisdiction to try and decide any cases pursuant to § 2.2-3713 of the Virginia Freedom of Information Act (§ 2.2-3700 et seq.) or § 2.2-3809 of the Government Data Collection and Dissemination Practices Act, for writs of mandamus or for injunctions.

(7) Concurrent jurisdiction with the circuit courts having jurisdiction in such territory to adjudicate habitual offenders pursuant to the provisions of Article 9 (§ 46.2-355.1 et seq.) of Chapter 3 of Title 46.2.

(8) Jurisdiction to try and decide cases alleging a civil violation described in § 18.2-76.

2.  That the provisions of this act shall become effective on July 1, 2009, except that the third and fourth enactments of this act shall become effective on July 1, 2008.

3.  That every state agency subject to the provisions of the Government Data Collection and Dissemination Practices Act (§ 2.2-3800 et seq.) shall conduct an analysis and review of its collection and use of social security numbers, to be completed by October 1, 2008.  Each such agency shall submit, no later than October 1, 2008, to the chairmen of the Freedom of Information Advisory Council and the Joint Commission on Technology and Science, on forms developed by the Council and the Commission, (i) a list of (a) all state or federal statutes authorizing or requiring the collection of social security numbers by such agency and (b) instances where social security numbers are voluntarily collected or (ii) in the absence of statutory authority to collect social security numbers, written justification explaining why continued collection is essential to its transaction of public business.  In conducting such a review, each agency shall be encouraged to consider whether such collection and use is essential for its transaction of public business and to find alternative means of identifying individuals.  The chairmen of the Council and the Commission may withhold from public disclosure any such lists or portions of lists as legislative working papers, if it deems that the public dissemination of such lists or portions of lists would cause a potential invasion of privacy.

4.  That every county and city, and any town with a population in excess of 15,000 shall, no later than September 10, 2008, provide the Virginia Municipal League or the Virginia Association of Counties, as appropriate, information on a form agreed upon by the Virginia Municipal League, the Virginia Association of Counties and staff of the Freedom of Information Advisory Council and the Joint Commission on Technology and Science identifying (a) all state or federal statutes authorizing or requiring the collection of social security numbers by such county, city or town and (b) instances where social security numbers are voluntarily collected or (ii) in the absence of statutory authority to collect social security numbers, written justification explaining why continued collection is essential to its transaction of public business.  In conducting such a review, each such county, city or town shall be encouraged to consider whether such collection and use is essential for its transaction of public business and to find alternative means of identifying individuals.  The information required by this enactment shall be submitted no later than October 1, 2008 to the chairmen of the Freedom of Information Advisory Council and the Joint Commission on Technology and Science, on forms developed by the Council and the Commission.