Virginia HB 1161: Government, Data Collection & Dissemination Practices Act; dissemin. of personal to federal gov't.

Bill Text

2026 SESSION

INTRODUCED

26105209D

HOUSE BILL NO. 1161

Offered January 14, 2026

Prefiled January 14, 2026

A BILL to amend and reenact §§ 2.2-3800, 2.2-3801, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia, relating to Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties.

—————

Patrons—Tran, Lopez, Price, Shin, Bennett-Parker, Callsen, Cousins, Helmer, Maldonado, Martinez, Reaser and Schmidt

—————

Referred to Committee on General Laws

—————

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-3800, 2.2-3801, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-3800. Short title; findings; principles of information practice.

A. This chapter may be cited as the "Government Data Collection and Dissemination Practices Act."

B. The General Assembly finds that:

1. An individual's privacy is directly affected by the extensive collection, maintenance, use, and dissemination of personal information;

2. The increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices;

3. An individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems; and

4. In order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals.

C. Recordkeeping agencies and political subdivisions of the Commonwealth and political subdivisions shall adhere to the following principles of information practice to ensure safeguards for personal privacy:

1. There shall be no personal information system whose existence is secret.

2. Information shall not be collected unless the need for it has been clearly established in advance.

3. Information shall be appropriate and relevant to the purpose for which it has been collected.

4. Information shall not be obtained by fraudulent or unfair means.

5. Information shall not be used unless it is accurate and current.

6. There shall be a prescribed procedure for an individual to learn the purpose for which information has been recorded and particulars about its use and dissemination.

7. There shall be a clearly prescribed and uncomplicated procedure for an individual to correct, erase, or amend inaccurate, obsolete, or irrelevant information.

8. Any agency holding personal information shall assure its reliability and take precautions to prevent its misuse.

9. There shall be a clearly prescribed procedure to prevent personal information collected for one purpose from being used or disseminated for another purpose unless such use or dissemination is authorized or required by law.

10. The Commonwealth or any No agency or political subdivision thereof of the Commonwealth shall not collect personal information except as explicitly or implicitly authorized by law.

11. Any agency or political subdivision of the Commonwealth shall disseminate personal information only:

a. To the extent necessary to comply with state or federal law, including the federal Health Insurance Portability and Accountability Act (42 U.S.C. § 1320d et seq.), as amended;

b. To the extent necessary to carry out the administration of a state or federal program pursuant to state or federal law;

c. To comply with a subpoena, court order, or administrative proceeding;

d. To the extent necessary to ensure fulfillment of the obligations of a purchase or contract made in accordance with the Virginia Public Procurement Act (§ 2.2-4300 et seq.); or

e. When the data subject has given consent.

§ 2.2-3801. Definitions.

As used in this chapter, unless the context requires a different meaning:

"Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationshi