Virginia SB 640: Child abuse or neglect; centralized hotline for reports or complaints, etc.

Bill Text

2026 SESSION

INTRODUCED

26104930D

SENATE BILL NO. 640

Offered January 14, 2026

Prefiled January 14, 2026

A BILL to amend and reenact §§ 2.2-3803, 2.2-3815, 22.1-272.1, 22.1-291.3, 63.2-100, 63.2-105, 63.2-203, 63.2-1501, 63.2-1502, 63.2-1503, 63.2-1508, 63.2-1509, 63.2-1512, and 63.2-1530 of the Code of Virginia and Chapter 604 of the Acts of Assembly of 2017; to amend the Code of Virginia by adding sections numbered 63.2-203.1, 63.2-319.1, and 63.2-1510.1; and to repeal § 63.2-1510 of the Code of Virginia, relating to Department of Social Services; corrective action plans and assumption of temporary control of local boards and local departments; centralized intake system for reports or complaints of child abuse or neglect.

—————

Patrons—Pillion, Boysko, Carroll Foy, Ebbin, Suetterlein and VanValkenburg

—————

Referred to Committee on Rehabilitation and Social Services

—————

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-3803, 2.2-3815, 22.1-272.1, 22.1-291.3, 63.2-100, 63.2-105, 63.2-203, 63.2-1501, 63.2-1502, 63.2-1503, 63.2-1508, 63.2-1509, 63.2-1512, and 63.2-1530 of the Code of Virginia are amended and reenacted and that the Code of Virginia is amended by adding sections numbered 63.2-203.1, 63.2-319.1, and 63.2-1510.1 as follows:

§ 2.2-3803. Administration of systems including personal information; internet privacy policy; exceptions.

A. Any agency maintaining an information system that includes personal information shall:

1. Collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency;

2. Collect information to the greatest extent feasible from the data subject directly, or through the sharing of data with other agencies, in order to accomplish a proper purpose of the agency;

3. Establish categories for maintaining personal information to operate in conjunction with confidentiality requirements and access controls;

4. Maintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject;

5. Make no dissemination to another system without (i) specifying requirements for security and usage including limitations on access thereto, and (ii) receiving reasonable assurances that those requirements and limitations will be observed. This subdivision shall not apply, however, to a dissemination made by an agency to an agency in another state, district or territory of the United States where the personal information is requested by the agency of such other state, district or territory in connection with the application of the data subject therein for a service, privilege or right under the laws thereof, nor shall this apply to information transmitted to family advocacy representatives of the United States Armed Forces in accordance with subsection N M of § 63.2-1503;

6. Maintain a list of all persons or organizations having regular access to personal information in the information system;

7. Maintain for a period of three years or until such time as the personal information is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system, including the identity of any persons or organizations not having regular access authority but excluding access by the personnel of the agency wherein data is put to service for the purpose for which it is obtained;

8. Take affirmative action to establish rules of conduct and inform each person involved in the design, development, operation, or maintenance of the system, or the collection or use of any personal information contained therein, about all the requirements of this chapter, the rules and procedures, including penalties for noncompliance, of the agency designed to assure compliance with such requirements;

9. Establish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security; and

10. Collect no personal information concerning the political or religious beliefs, affiliations, and activities of data subjects that is maintained, used, or disseminated in or by any information system operated by any agency unless authorized explicitly by statute or ordinance. Nothing in this subdivision shall be construed to allow an agency to disseminate to federal government authorities information concerning the religious beliefs and affiliations of data subjects for the purpose of compiling a list, registry, or database of individuals based on religious affiliation, national origin, or ethnicity, unless such dissemination is specifically required by state or federal law.

B. Every public body, as defined in § 2.2-3701, that has an Internet internet website associated with that public body shall develop an Internet internet privacy policy and an Internet internet privacy