Virginia Code 2.2-3806: Rights of data subjects
A. Any agency maintaining personal information shall:
Terms Used In Virginia Code 2.2-3806
- Agency: means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. See Virginia Code 2.2-3801
- Data subject: means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system. See Virginia Code 2.2-3801
- Disseminate: means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means. See Virginia Code 2.2-3801
- Freedom of Information Act: A federal law that mandates that all the records created and kept by federal agencies in the executive branch of government must be open for public inspection and copying. The only exceptions are those records that fall into one of nine exempted categories listed in the statute. Source: OCC
- Includes: means includes, but not limited to. See Virginia Code 1-218
- Information system: means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. See Virginia Code 2.2-3801
- Person: includes any individual, corporation, partnership, association, cooperative, limited liability company, trust, joint venture, government, political subdivision, or any other legal or commercial entity and any successor, representative, agent, agency, or instrumentality thereof. See Virginia Code 1-230
- Personal information: means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. See Virginia Code 2.2-3801
- State: when applied to a part of the United States, includes any of the 50 states, the District of Columbia, the Commonwealth of Puerto Rico, Guam, the Northern Mariana Islands, and the United States Virgin Islands. See Virginia Code 1-245
1. Inform an individual who is asked to supply personal information about himself whether he is legally required, or may refuse, to supply the information requested, and also of any specific consequences that are known to the agency of providing or not providing the information.
2. Give notice to a data subject of the possible dissemination of part or all of this information to another agency, nongovernmental organization or system not having regular access authority, and indicate the use for which it is intended, and the specific consequences for the individual, which are known to the agency, of providing or not providing the information. However documented permission for dissemination in the hands of the other agency or organization shall satisfy the requirement of this subdivision. The notice may be given on applications or other data collection forms prepared by data subjects.
3. Upon request and proper identification of any data subject, or of his authorized agent, grant the data subject or agent the right to inspect, in a form comprehensible to him:
a. All personal information about that data subject except as provided in subdivision 1 of § 2.2-3705.1, subdivision A 1 of § 2.2-3705.4, and subdivision 1 of § 2.2-3705.5.
b. The nature of the sources of the information.
c. The names of recipients, other than those with regular access authority, of personal information about the data subject including the identity of all persons and organizations involved and their relationship to the system when not having regular access authority, except that if the recipient has obtained the information as part of an ongoing criminal investigation such that disclosure of the investigation would jeopardize law-enforcement action, then no disclosure of such access shall be made to the data subject.
4. Comply with the following minimum conditions of disclosure to data subjects:
a. An agency shall make disclosures to data subjects required under this chapter, during normal business hours, in accordance with the procedures set forth in subsections B and C of § 2.2-3704 for responding to requests under the Virginia Freedom of Information Act (§ 2.2-3700 et seq.) or within a time period as may be mutually agreed upon by the agency and the data subject.
b. The disclosures to data subjects required under this chapter shall be made (i) in person, if he appears in person and furnishes proper identification, or (ii) by mail, if he has made a written request, with proper identification. Copies of the documents containing the personal information sought by a data subject shall be furnished to him or his representative at reasonable charges for document search and duplication in accordance with subsection F of § 2.2-3704.
c. The data subject shall be permitted to be accompanied by a person of his choosing, who shall furnish reasonable identification. An agency may require the data subject to furnish a written statement granting the agency permission to discuss the individual’s file in such person’s presence.
5. If the data subject gives notice that he wishes to challenge, correct, or explain information about him in the information system, the following minimum procedures shall be followed:
a. The agency maintaining the information system shall investigate, and record the current status of that personal information.
b. If, after such investigation, the information is found to be incomplete, inaccurate, not pertinent, not timely, or not necessary to be retained, it shall be promptly corrected or purged.
c. If the investigation does not resolve the dispute, the data subject may file a statement of not more than 200 words setting forth his position.
d. Whenever a statement of dispute is filed, the agency maintaining the information system shall supply any previous recipient with a copy of the statement and, in any subsequent dissemination or use of the information in question, clearly note that it is disputed and supply the statement of the data subject along with the information.
e. The agency maintaining the information system shall clearly and conspicuously disclose to the data subject his rights to make such a request.
f. Following any correction or purging of personal information the agency shall furnish to past recipients notification that the item has been purged or corrected whose receipt shall be acknowledged.
B. Nothing in this chapter shall be construed to require an agency to disseminate any recommendation or letter of reference from or to a third party that is a part of the personnel file of any data subject nor to disseminate any test or examination used, administered or prepared by any public body for purposes of evaluation of (i) any student or any student’s performance, (ii) any seeker’s qualifications or aptitude for employment, retention, or promotion, or (iii) qualifications for any license or certificate issued by any public body.
As used in this subsection, “test or examination” includes (i) any scoring key for any such test or examination and (ii) any other document that would jeopardize the security of the test or examination. Nothing contained in this subsection shall prohibit the release of test scores or results as provided by law, or to limit access to individual records as provided by law; however, the subject of the employment tests shall be entitled to review and inspect all documents relative to his performance on those employment tests.
When, in the reasonable opinion of the public body, any such test or examination no longer has any potential for future use, and the security of future tests or examinations will not be jeopardized, the test or examination shall be made available to the public. Minimum competency tests administered to public school children shall be made available to the public contemporaneously with statewide release of the scores of those taking such tests, but in no event shall such tests be made available to the public later than six months after the administration of such tests.
C. Neither any provision of this chapter nor any provision of the Freedom of Information Act (§ 2.2-3700 et seq.) shall be construed to deny public access to records of the position, job classification, official salary or rate of pay of, and to records of the allowances or reimbursements for expenses paid to any public officer, official or employee at any level of state, local or regional government in the Commonwealth. The provisions of this subsection shall not apply to records of the official salaries or rates of pay of public employees whose annual rate of pay is $10,000 or less.
D. Nothing in this section or in this chapter shall be construed to require an agency to disseminate information derived from tax returns prohibited from release pursuant to § 58.1-3.
1976, c. 597, § 2.1-382; 1978, c. 810; 1979, cc. 683, 688, 689; 1983, c. 372; 1995, c. 400; 2001, c. 844; 2004, c. 690; 2007, c. 232; 2017, c. 778.