SB1239: Personal Information Privacy Act; makes several amendments to Act.

SENATE BILL NO. 1239
Offered January 12, 2011
Prefiled January 12, 2011
A BILL to amend and reenact §§ 59.1-443.2 and 59.1-444 of the Code of Virginia, relating to the Personal Information Privacy Act.
Patron-- Ticer

Referred to Committee on Commerce and Labor

Be it enacted by the General Assembly of Virginia:

1.  That §§ 59.1-443.2 and 59.1-444 of the Code of Virginia are amended and reenacted as follows:

§ 59.1-443.2. Restricted use of social security numbers.

A. Except as otherwise specifically provided by law, a person shall not:

1. Intentionally communicate another individual's social security number to the general public;

2. Print an individual's social security number on any card required for the individual to access or receive products or services provided by the person;

3. Require an individual to use his social security number to access an Internet website, unless a password, unique personal identification number or other authentication device is also required to access the site; or

4. Send or cause to be sent or delivered any letter, envelope, or package that displays a social security number on the face of the mailing envelope or package, or from which a social security number is visible, whether on the outside or inside of the mailing envelope or package.; or

5. Require an individual to provide his social security number to access or receive goods or services if the individual is also required to provide a credit card number, debit card number, or other payment device number to access or receive those same goods and services, other than merely for the payment of those goods or services.

B. This section does not prohibit the collection, use, or release of a social security number as permitted by the laws of the Commonwealth or the United States, or the use of a social security number for internal verification or administrative purposes unless such use is prohibited by a state or federal statute, rule, or regulation.

C. In the case of any (i) health care provider as defined in § 8.01-581.1, (ii) manager of a pharmacy benefit plan, (iii) insurer as defined in § 38.2-100, (iv) corporation providing a health services plan, (v) health maintenance organization providing a health care plan for health care services, or (vi) contractor of any such person, the prohibition contained in subdivision 2 of subsection A shall become effective on January 1, 2006.

D. This section shall not apply to (i) public bodies as defined in § 2.2-3701 or (ii) records required by law to be open to the public, and shall not be construed to limit access to records pursuant to the Virginia Freedom of Information Act (§ 2.2-3700 et seq.).

E. No person shall embed an encrypted or unencrypted social security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number as required by this section.

§ 59.1-444. Damages.

A. A person aggrieved by a violation of any provision of this chapter, except § 59.1-443.2, § 59.1-442 or 59.1-443.1 shall be entitled to institute an action to recover damages in the amount of $100 per violation. In addition, if the aggrieved party prevails, he may be awarded reasonable attorney's attorney fees and court costs. Actions under this section subsection shall be brought in the general district court for the city or county in which the transaction or other violation that gave rise to the action occurred. A violation of the provisions of § 59.1-443.2 is a prohibited practice under the Virginia Consumer Protection Act (§ 59.1-196 et seq.).

B. A person aggrieved by a violation of § 59.1-443.2 shall be entitled to initiate an action to recover actual damages, or $500, whichever is greater. If the trier of fact finds that the violation was willful, the trier of fact may increase damages to an amount not to exceed three times the actual damages sustained, or $1,000, whichever is greater. Notwithstanding any other provision of law to the contrary, in addition to any damages awarded, such person may also be awarded reasonable attorney fees and court costs. A violation of the provisions of § 59.1-443.2 is a prohibited practice under the Virginia Consumer Protection Act (§ 59.1-196 et seq.).