{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/18.2-186.6.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/18.2-186.6.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/18.2-186.6.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/18.2-186.6.html"}],"law_id":64651,"edition_id":1,"section_id":64651,"structure_id":14590,"section_number":"18.2-186.6","catch_line":"Breach of personal information notification","history":"2008, cc. 566, 801; 2017, cc. 419, 427; 2019, c. 484; 2020, c. 264.","full_text":"A\n\nAs used in this section:\n\t\t\t“Breach of the security of the system” means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth. Good faith acquisition of personal information by an employee or agent of an individual or entity for the purposes of the individual or entity is not a breach of the security of the system, provided that the personal information is not used for a purpose other than a lawful purpose of the individual or entity or subject to further unauthorized disclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity” includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities or any other legal entity, whether for profit or not for profit.\n\t\t\t“Financial institution” has the meaning given that term in 15 U.S.C. \u00a7 6809(3).\n\t\t\t“Individual” means a natural person.\n\t\t\t“Notice” means:1\n\nWritten notice to the last known postal address in the records of the individual or entity;2\n\nTelephone notice;3\n\nElectronic notice; or4\n\nSubstitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the individual or the entity does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of all of the following:\n\t\t\t\ta. E-mail notice if the individual or the entity has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall not be considered a debt communication as defined by the Fair Debt Collection Practices Act in 15 U.S.C. \u00a7 1692a.\n\t\t\t\tNotice required by this section shall include a description of the following:1\n\nThe incident in general terms;2\n\nThe type of personal information that was subject to the unauthorized access and acquisition;3\n\nThe general acts of the individual or entity to protect the personal information from further unauthorized access;4\n\nA telephone number that the person may call for further information and assistance, if one exists; and5\n\nAdvice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.\n\t\t\t\t\t“Personal information” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted:1\n\nSocial security number;2\n\nDriver’s license number or state identification card number issued in lieu of a driver’s license number;3\n\nFinancial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial accounts;4\n\nPassport number; or5\n\nMilitary identification number.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Redact” means alteration or truncation of data such that no more than the following are accessible as part of the personal information:1\n\nFive digits of a social security number; or2\n\nThe last four digits of a driver’s license number, state identification card number, or account number.B\n\nIf unencrypted or unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any resident of the Commonwealth, an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the individual or entity notifies a law-enforcement agency, the law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security.C\n\nAn individual or entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such a breach has caused or will cause identity theft or other fraud to any resident of the Commonwealth.D\n\nAn individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the personal information was accessed and acquired by an unauthorized person or the individual or entity reasonably believes the personal information was accessed and acquired by an unauthorized person.E\n\nIn the event an individual or entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing, distribution, and content of the notice.F\n\nAn entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information that are consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if it notifies residents of the Commonwealth in accordance with its procedures in the event of a breach of the security of the system.G\n\nAn entity that is subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and maintains procedures for notification of a breach of the security of the system in accordance with the provision of that Act and any rules, regulations, or guidelines promulgated thereto shall be deemed to be in compliance with this section.H\n\nAn entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the entity’s primary or functional state or federal regulator shall be in compliance with this section.I\n\nExcept as provided by subsections J and K, pursuant to the enforcement duties and powers of the Office of the Attorney General, the Attorney General may bring an action to address violations of this section. The Office of the Attorney General may impose a civil penalty not to exceed $150,000 per breach of the security of the system or a series of breaches of a similar nature that are discovered in a single investigation. Nothing in this section shall limit an individual from recovering direct economic damages from a violation of this section.J\n\nA violation of this section by a state-chartered or licensed financial institution shall be enforceable exclusively by the financial institution’s primary state regulator.K\n\nNothing in this section shall apply to an individual or entity regulated by the State Corporation Commission’s Bureau of Insurance.L\n\nThe provisions of this section shall not apply to criminal intelligence systems subject to the restrictions of 28 C.F.R. Part 23 that are maintained by law-enforcement agencies of the Commonwealth and the organized Criminal Gang File of the Virginia Criminal Information Network (VCIN), established pursuant to Chapter 2 (§ 52-12 et seq.) of Title 52.M\n\nNotwithstanding any other provision of this section, any employer or payroll service provider that owns or licenses computerized data relating to income tax withheld pursuant to Article 16 (§ 58.1-460 et seq.) of Chapter 3 of Title 58.1 shall notify the Office of the Attorney General without unreasonable delay after the discovery or notification of unauthorized access and acquisition of unencrypted and unredacted computerized data containing a taxpayer identification number in combination with the income tax withheld for that taxpayer that compromises the confidentiality of such data and that creates a reasonable belief that an unencrypted and unredacted version of such information was accessed and acquired by an unauthorized person, and causes, or the employer or payroll provider reasonably believes has caused or will cause, identity theft or other fraud. With respect to employers, this subsection applies only to information regarding the employer’s employees, and does not apply to information regarding the employer’s customers or other non-employees.\n\t\t\tSuch employer or payroll service provider shall provide the Office of the Attorney General with the name and federal employer identification number of the employer as defined in § 58.1-460 that may be affected by the compromise in confidentiality. Upon receipt of such notice, the Office of the Attorney General shall notify the Department of Taxation of the compromise in confidentiality. The notification required under this subsection that does not otherwise require notification under this section shall not be subject to any other notification, requirement, exemption, or penalty contained in this section.","order_by":null,"text":{"0":{"id":235251,"text":"As used in this section:\n\t\t\t“Breach of the security of the system” means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth. Good faith acquisition of personal information by an employee or agent of an individual or entity for the purposes of the individual or entity is not a breach of the security of the system, provided that the personal information is not used for a purpose other than a lawful purpose of the individual or entity or subject to further unauthorized disclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity” includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities or any other legal entity, whether for profit or not for profit.\n\t\t\t“Financial institution” has the meaning given that term in 15 U.S.C. \u00a7 6809(3).\n\t\t\t“Individual” means a natural person.\n\t\t\t“Notice” means:","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"A1"},"1":{"id":235252,"text":"Written notice to the last known postal address in the records of the individual or entity;","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A","next_prefix":"A2"},"2":{"id":235253,"text":"Telephone notice;","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A3"},"3":{"id":235254,"text":"Electronic notice; or","type":"section","prefixes":["A","3"],"prefix":"3","entire_prefix":"A3","prefix_anchor":"A3","level":2,"prior_prefix":"A2","next_prefix":"A4"},"4":{"id":235255,"text":"Substitute notice, if the individual or the entity required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the individual or the entity does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of all of the following:\n\t\t\t\ta. E-mail notice if the individual or the entity has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the individual or the entity if the individual or the entity maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall not be considered a debt communication as defined by the Fair Debt Collection Practices Act in 15 U.S.C. \u00a7 1692a.\n\t\t\t\tNotice required by this section shall include a description of the following:","type":"section","prefixes":["A","4"],"prefix":"4","entire_prefix":"A4","prefix_anchor":"A4","level":2,"prior_prefix":"A3","next_prefix":"A41"},"5":{"id":235256,"text":"The incident in general terms;","type":"section","prefixes":["A","4","1"],"prefix":"1","entire_prefix":"A41","prefix_anchor":"A41","level":3,"prior_prefix":"A4","next_prefix":"A42"},"6":{"id":235257,"text":"The type of personal information that was subject to the unauthorized access and acquisition;","type":"section","prefixes":["A","4","2"],"prefix":"2","entire_prefix":"A42","prefix_anchor":"A42","level":3,"prior_prefix":"A41","next_prefix":"A43"},"7":{"id":235258,"text":"The general acts of the individual or entity to protect the personal information from further unauthorized access;","type":"section","prefixes":["A","4","3"],"prefix":"3","entire_prefix":"A43","prefix_anchor":"A43","level":3,"prior_prefix":"A42","next_prefix":"A44"},"8":{"id":235259,"text":"A telephone number that the person may call for further information and assistance, if one exists; and","type":"section","prefixes":["A","4","4"],"prefix":"4","entire_prefix":"A44","prefix_anchor":"A44","level":3,"prior_prefix":"A43","next_prefix":"A45"},"9":{"id":235260,"text":"Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.\n\t\t\t\t\t“Personal information” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted:","type":"section","prefixes":["A","4","5"],"prefix":"5","entire_prefix":"A45","prefix_anchor":"A45","level":3,"prior_prefix":"A44","next_prefix":"A1"},"10":{"id":235261,"text":"Social security number;","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A45","next_prefix":"A2"},"11":{"id":235262,"text":"Driver’s license number or state identification card number issued in lieu of a driver’s license number;","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A3"},"12":{"id":235263,"text":"Financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial accounts;","type":"section","prefixes":["A","3"],"prefix":"3","entire_prefix":"A3","prefix_anchor":"A3","level":2,"prior_prefix":"A2","next_prefix":"A4"},"13":{"id":235264,"text":"Passport number; or","type":"section","prefixes":["A","4"],"prefix":"4","entire_prefix":"A4","prefix_anchor":"A4","level":2,"prior_prefix":"A3","next_prefix":"A5"},"14":{"id":235265,"text":"Military identification number.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Redact” means alteration or truncation of data such that no more than the following are accessible as part of the personal information:","type":"section","prefixes":["A","5"],"prefix":"5","entire_prefix":"A5","prefix_anchor":"A5","level":2,"prior_prefix":"A4","next_prefix":"A1"},"15":{"id":235266,"text":"Five digits of a social security number; or","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A5","next_prefix":"A2"},"16":{"id":235267,"text":"The last four digits of a driver’s license number, state identification card number, or account number.","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"B"},"17":{"id":235268,"text":"If unencrypted or unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual or entity reasonably believes has caused or will cause, identity theft or another fraud to any resident of the Commonwealth, an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the individual or entity notifies a law-enforcement agency, the law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A2","next_prefix":"C"},"18":{"id":235269,"text":"An individual or entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such a breach has caused or will cause identity theft or other fraud to any resident of the Commonwealth.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B","next_prefix":"D"},"19":{"id":235270,"text":"An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the personal information was accessed and acquired by an unauthorized person or the individual or entity reasonably believes the personal information was accessed and acquired by an unauthorized person.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C","next_prefix":"E"},"20":{"id":235271,"text":"In the event an individual or entity provides notice to more than 1,000 persons at one time pursuant to this section, the individual or entity shall notify, without unreasonable delay, the Office of the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing, distribution, and content of the notice.","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D","next_prefix":"F"},"21":{"id":235272,"text":"An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information that are consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if it notifies residents of the Commonwealth in accordance with its procedures in the event of a breach of the security of the system.","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E","next_prefix":"G"},"22":{"id":235273,"text":"An entity that is subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and maintains procedures for notification of a breach of the security of the system in accordance with the provision of that Act and any rules, regulations, or guidelines promulgated thereto shall be deemed to be in compliance with this section.","type":"section","prefixes":["G"],"prefix":"G","entire_prefix":"G","prefix_anchor":"G","level":1,"prior_prefix":"F","next_prefix":"H"},"23":{"id":235274,"text":"An entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the entity’s primary or functional state or federal regulator shall be in compliance with this section.","type":"section","prefixes":["H"],"prefix":"H","entire_prefix":"H","prefix_anchor":"H","level":1,"prior_prefix":"G","next_prefix":"I"},"24":{"id":235275,"text":"Except as provided by subsections J and K, pursuant to the enforcement duties and powers of the Office of the Attorney General, the Attorney General may bring an action to address violations of this section. The Office of the Attorney General may impose a civil penalty not to exceed $150,000 per breach of the security of the system or a series of breaches of a similar nature that are discovered in a single investigation. Nothing in this section shall limit an individual from recovering direct economic damages from a violation of this section.","type":"section","prefixes":["I"],"prefix":"I","entire_prefix":"I","prefix_anchor":"I","level":1,"prior_prefix":"H","next_prefix":"J"},"25":{"id":235276,"text":"A violation of this section by a state-chartered or licensed financial institution shall be enforceable exclusively by the financial institution’s primary state regulator.","type":"section","prefixes":["J"],"prefix":"J","entire_prefix":"J","prefix_anchor":"J","level":1,"prior_prefix":"I","next_prefix":"K"},"26":{"id":235277,"text":"Nothing in this section shall apply to an individual or entity regulated by the State Corporation Commission’s Bureau of Insurance.","type":"section","prefixes":["K"],"prefix":"K","entire_prefix":"K","prefix_anchor":"K","level":1,"prior_prefix":"J","next_prefix":"L"},"27":{"id":235278,"text":"The provisions of this section shall not apply to criminal intelligence systems subject to the restrictions of 28 C.F.R. Part 23 that are maintained by law-enforcement agencies of the Commonwealth and the organized Criminal Gang File of the Virginia Criminal Information Network (VCIN), established pursuant to Chapter 2 (§ 52-12 et seq.) of Title 52.","type":"section","prefixes":["L"],"prefix":"L","entire_prefix":"L","prefix_anchor":"L","level":1,"prior_prefix":"K","next_prefix":"M"},"28":{"id":235279,"text":"Notwithstanding any other provision of this section, any employer or payroll service provider that owns or licenses computerized data relating to income tax withheld pursuant to Article 16 (§ 58.1-460 et seq.) of Chapter 3 of Title 58.1 shall notify the Office of the Attorney General without unreasonable delay after the discovery or notification of unauthorized access and acquisition of unencrypted and unredacted computerized data containing a taxpayer identification number in combination with the income tax withheld for that taxpayer that compromises the confidentiality of such data and that creates a reasonable belief that an unencrypted and unredacted version of such information was accessed and acquired by an unauthorized person, and causes, or the employer or payroll provider reasonably believes has caused or will cause, identity theft or other fraud. With respect to employers, this subsection applies only to information regarding the employer’s employees, and does not apply to information regarding the employer’s customers or other non-employees.\n\t\t\tSuch employer or payroll service provider shall provide the Office of the Attorney General with the name and federal employer identification number of the employer as defined in § 58.1-460 that may be affected by the compromise in confidentiality. Upon receipt of such notice, the Office of the Attorney General shall notify the Department of Taxation of the compromise in confidentiality. The notification required under this subsection that does not otherwise require notification under this section shall not be subject to any other notification, requirement, exemption, or penalty contained in this section.","type":"section","prefixes":["M"],"prefix":"M","entire_prefix":"M","prefix_anchor":"M","level":1,"prior_prefix":"L"}},"ancestry":[{"id":14590,"edition_id":1,"name":"False Representations to Obtain Property or Credit","identifier":"5","label":"article","depth":3,"order_by":1,"parent_id":13358,"metadata":{},"date_created":"2026-06-26 03:48:47","date_modified":"2026-06-26 03:48:47","permalink":{"id":166089,"object_type":"structure","relational_id":14590,"identifier":"5","token":"18.2\/6\/5","url":"\/18.2\/6\/5\/","edition_id":1,"permalink":0,"preferred":1}},{"id":13358,"edition_id":1,"name":"Crimes Involving Fraud","identifier":"6","label":"chapter","depth":2,"order_by":1,"parent_id":12972,"metadata":{},"date_created":"2026-06-26 03:44:42","date_modified":"2026-06-26 03:44:42","permalink":{"id":165933,"object_type":"structure","relational_id":13358,"identifier":"6","token":"18.2\/6","url":"\/18.2\/6\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12972,"edition_id":1,"name":"Crimes and Offenses Generally","identifier":"18.2","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:44:05","date_modified":"2026-06-26 03:44:05","permalink":{"id":164139,"object_type":"structure","relational_id":12972,"identifier":"18.2","token":"18.2","url":"\/18.2\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":70856,"structure_id":14590,"section_number":"18.2-186","catch_line":"False statements to obtain property or credit","url":"\/18.2-186\/","token":"18.2\/6\/5\/18.2-186","metadata":false},{"id":70659,"structure_id":14590,"section_number":"18.2-186.1","catch_line":"Repealed","url":"\/18.2-186.1\/","token":"18.2\/6\/5\/18.2-186.1","metadata":false},{"id":75819,"structure_id":14590,"section_number":"18.2-186.2","catch_line":"False statements or failure to disclose material facts in order to obtain aid or benefits under any local, state or federal housing assistance program","url":"\/18.2-186.2\/","token":"18.2\/6\/5\/18.2-186.2","metadata":false},{"id":73403,"structure_id":14590,"section_number":"18.2-186.3","catch_line":"Identity theft; penalty; restitution; victim assistance","url":"\/18.2-186.3\/","token":"18.2\/6\/5\/18.2-186.3","metadata":false},{"id":68386,"structure_id":14590,"section_number":"18.2-186.3:1","catch_line":"Identity fraud; consumer reporting agencies; police reports","url":"\/18.2-186.3_1\/","token":"18.2\/6\/5\/18.2-186.3_1","metadata":false},{"id":86000,"structure_id":14590,"section_number":"18.2-186.4","catch_line":"Use of a person's identity with the intent to coerce, intimidate, or harass; penalty","url":"\/18.2-186.4\/","token":"18.2\/6\/5\/18.2-186.4","metadata":false},{"id":74122,"structure_id":14590,"section_number":"18.2-186.4:1","catch_line":"Internet publication of personal information of certain public officials","url":"\/18.2-186.4_1\/","token":"18.2\/6\/5\/18.2-186.4_1","metadata":false},{"id":63464,"structure_id":14590,"section_number":"18.2-186.5","catch_line":"Expungement of false identity information from police and court records; Identity Theft Passport","url":"\/18.2-186.5\/","token":"18.2\/6\/5\/18.2-186.5","metadata":false},{"id":64651,"structure_id":14590,"section_number":"18.2-186.6","catch_line":"Breach of personal information notification","url":"\/18.2-186.6\/","token":"18.2\/6\/5\/18.2-186.6","metadata":false},{"id":56090,"structure_id":14590,"section_number":"18.2-187","catch_line":"Repealed","url":"\/18.2-187\/","token":"18.2\/6\/5\/18.2-187","metadata":false},{"id":64355,"structure_id":14590,"section_number":"18.2-187.1","catch_line":"Obtaining or attempting to obtain oil, electric, gas, water, telephone, telegraph, cable television or electronic communication service without payment; penalty; civil liability","url":"\/18.2-187.1\/","token":"18.2\/6\/5\/18.2-187.1","metadata":false},{"id":72422,"structure_id":14590,"section_number":"18.2-187.2","catch_line":"Audiovisual recording of motion pictures unlawful; penalty","url":"\/18.2-187.2\/","token":"18.2\/6\/5\/18.2-187.2","metadata":false},{"id":64840,"structure_id":14590,"section_number":"18.2-188","catch_line":"Defrauding hotels, motels, campgrounds, boardinghouses, etc","url":"\/18.2-188\/","token":"18.2\/6\/5\/18.2-188","metadata":false},{"id":61566,"structure_id":14590,"section_number":"18.2-188.1","catch_line":"Defrauding person having a lien on an animal; penalty","url":"\/18.2-188.1\/","token":"18.2\/6\/5\/18.2-188.1","metadata":false},{"id":78241,"structure_id":14590,"section_number":"18.2-189","catch_line":"Defrauding keeper of motor vehicles or watercraft","url":"\/18.2-189\/","token":"18.2\/6\/5\/18.2-189","metadata":false},{"id":76832,"structure_id":14590,"section_number":"18.2-190","catch_line":"Fraudulent misrepresentation as to breed of bull or cattle","url":"\/18.2-190\/","token":"18.2\/6\/5\/18.2-190","metadata":false}],"previous_section":{"id":63464,"structure_id":14590,"section_number":"18.2-186.5","catch_line":"Expungement of false identity information from police and court records; Identity Theft Passport","url":"\/18.2-186.5\/","token":"18.2\/6\/5\/18.2-186.5","metadata":false},"next_section":{"id":56090,"structure_id":14590,"section_number":"18.2-187","catch_line":"Repealed","url":"\/18.2-187\/","token":"18.2\/6\/5\/18.2-187","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/18.2-186.6\/","history_text":"

This law was first created in 2008. The record of its establishment is cataloged in chapters 566<\/a> and 801<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. It has been modified 3 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 2017, chapters 419<\/a> and 427<\/a>; in 2019, chapter 484<\/a>; in 2020, chapter 264<\/a>.<\/p>","references":[{"id":55551,"section_number":"2.2-2036","catch_line":"Definitions","order_by":null,"url":"\/2.2-2036\/"},{"id":86812,"section_number":"22.1-287.02","catch_line":"Students' personally identifiable information","order_by":null,"url":"\/22.1-287.02\/"},{"id":55458,"section_number":"59.1-579","catch_line":"Responsibility according to role; controller and processor","order_by":null,"url":"\/59.1-579\/"},{"id":76095,"section_number":"6.2-1720","catch_line":"Regulations; agreements between Commission and Registry","order_by":null,"url":"\/6.2-1720\/"}],"refers_to":[{"id":60818,"section_number":"52-12","catch_line":"Establishment of State Police communication system","order_by":null,"url":"\/52-12\/"},{"id":72120,"section_number":"58.1-460","catch_line":"Definitions","order_by":null,"url":"\/58.1-460\/"}],"permalink":{"id":166123,"object_type":"law","relational_id":64651,"identifier":"18.2-186.6","token":"18.2\/6\/5\/18.2-186.6","url":"\/18.2-186.6\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/18.2-186.6\/","token":"18.2\/6\/5\/18.2-186.6","dublin_core":{"Title":"Breach of personal information notification","Type":"Text","Format":"text\/html","Identifier":"\u00a7 18.2-186.6","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> As used in this section:\n\t\t\t“Breach of the security of the system<\/span>” means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information<\/span> maintained by an individual<\/span> or entity<\/span> as part of a database of personal information<\/span> regarding multiple individuals<\/span> and that causes, or the individual<\/span> or entity<\/span> reasonably believes has caused, or will cause, identity theft or other fraud<\/span> to any resident of the Commonwealth. Good faith acquisition of personal information<\/span> by an employee or agent of an individual<\/span> or entity<\/span> for the purposes of the individual<\/span> or entity<\/span> is not a breach of the security of the system<\/span>, provided that the personal information<\/span> is not used for a purpose other than a lawful purpose of the individual<\/span> or entity<\/span> or subject to further unauthorized disclosure.\n\t\t\t“Encrypted<\/span>” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity<\/span>” includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies, or instrumentalities or any other legal entity<\/span>, whether for profit or not for profit.\n\t\t\t“Financial institution” has the meaning given that term in 15 U.S.C. \u00a7 6809(3).\n\t\t\t“Individual<\/span>” means a natural person.\n\t\t\t“Notice” means: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Written notice to the last known postal address in the records of the individual<\/span> or entity<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Telephone notice; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Electronic notice; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Substitute notice, if the individual<\/span> or the entity<\/span> required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the individual<\/span> or the entity<\/span> does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of all of the following:\n\t\t\t\ta. E-mail notice if the individual<\/span> or the entity<\/span> has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the individual<\/span> or the entity<\/span> if the individual<\/span> or the entity<\/span> maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall not be considered a debt communication as defined by the Fair Debt Collection Practices Act in 15 U.S.C. \u00a7 1692a.\n\t\t\t\tNotice required by this section shall include a description of the following: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> The incident in general terms; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> The type of personal information<\/span> that was subject to the unauthorized access and acquisition; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> The general acts of the individual<\/span> or entity<\/span> to protect the personal information<\/span> from further unauthorized access; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> A telephone number that the person may call for further information and assistance, if one exists; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.\n\t\t\t\t\t“Personal information<\/span>” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted<\/span> nor redacted: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Social security number; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Driver’s license number or state identification card number issued in lieu of a driver’s license number; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Financial account number, or credit card or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial accounts; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Passport number; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Military identification number.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Redact<\/span>” means alteration or truncation of data such that no more than the following are accessible as part of the personal information<\/span>: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Five digits of a social security number; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> The last four digits of a driver’s license number, state identification card number, or account number. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> If unencrypted or unredacted personal information<\/span> was or is reasonably believed to have been accessed and acquired by an unauthorized person and causes, or the individual<\/span> or entity<\/span> reasonably believes has caused or will cause, identity theft or another fraud<\/span> to any resident of the Commonwealth, an individual<\/span> or entity<\/span> that owns or licenses computerized data that includes personal information<\/span> shall disclose any breach of the security of the system<\/span> following discovery<\/span> or notification of the breach of the security of the system<\/span> to the Office of the Attorney General<\/span> and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the individual<\/span> or entity<\/span> to determine the scope of the breach of the security of the system<\/span> and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the individual<\/span> or entity<\/span> notifies a law<\/span>-enforcement agency, the law<\/span>-enforcement agency determines and advises the individual<\/span> or entity<\/span> that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law<\/span>-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> An individual<\/span> or entity<\/span> shall disclose the breach of the security of the system<\/span> if encrypted<\/span> information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key and the individual<\/span> or entity<\/span> reasonably believes that such a breach has caused or will cause identity theft or other fraud<\/span> to any resident of the Commonwealth. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> An individual<\/span> or entity<\/span> that maintains computerized data that includes personal information<\/span> that the individual<\/span> or entity<\/span> does not own or license shall notify the owner or licensee of the information of any breach of the security of the system<\/span> without unreasonable delay following discovery<\/span> of the breach of the security of the system<\/span>, if the personal information<\/span> was accessed and acquired by an unauthorized person or the individual<\/span> or entity<\/span> reasonably believes the personal information<\/span> was accessed and acquired by an unauthorized person. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> In the event an individual<\/span> or entity<\/span> provides notice to more than 1,000 persons at one time pursuant to this section, the individual<\/span> or entity<\/span> shall notify, without unreasonable delay, the Office of the Attorney General<\/span> and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing, distribution, and content of the notice. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

F.<\/span> An entity<\/span> that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information<\/span> that are consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if it notifies residents of the Commonwealth in accordance with its procedures in the event of a breach of the security of the system<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

G.<\/span> An entity<\/span> that is subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and maintains procedures for notification of a breach of the security of the system<\/span> in accordance with the provision of that Act and any rules, regulations, or guidelines promulgated thereto shall be deemed to be in compliance with this section. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

H.<\/span> An entity<\/span> that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, or guidelines established by the entity<\/span>’s primary or functional state or federal regulator shall be in compliance with this section. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

I.<\/span> Except as provided by subsections J and K, pursuant to the enforcement duties and powers of the Office of the Attorney General<\/span>, the Attorney General<\/span> may bring an action to address violations of this section. The Office of the Attorney General<\/span> may impose a civil penalty<\/span> not to exceed $150,000 per breach of the security of the system<\/span> or a series of breaches of a similar nature that are discovered in a single investigation. Nothing in this section shall limit an individual<\/span> from recovering direct economic damages<\/span> from a violation of this section. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

J.<\/span> A violation of this section by a state-chartered or licensed financial institution shall be enforceable exclusively by the financial institution’s primary state regulator. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

K.<\/span> Nothing in this section shall apply to an individual<\/span> or entity<\/span> regulated by the State Corporation Commission’s Bureau of Insurance. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

L.<\/span> The provisions of this section shall not apply to criminal intelligence systems subject to the restrictions of 28 C.F.R. Part 23 that are maintained by law<\/span>-enforcement agencies of the Commonwealth and the organized Criminal Gang File of the Virginia Criminal Information Network (VCIN), established pursuant to Chapter 2 (§ 52-12<\/a> et seq.) of Title 52. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

M.<\/span> Notwithstanding any other provision of this section, any employer or payroll service provider that owns or licenses computerized data relating to income tax withheld pursuant to Article 16 (§ 58.1-460<\/a> et seq.) of Chapter 3 of Title 58.1 shall notify the Office of the Attorney General<\/span> without unreasonable delay after the discovery<\/span> or notification of unauthorized access and acquisition of unencrypted and unredacted computerized data containing a taxpayer identification number in combination with the income tax withheld for that taxpayer that compromises the confidentiality of such data and that creates a reasonable belief that an unencrypted and unredacted version of such information was accessed and acquired by an unauthorized person, and causes, or the employer or payroll provider reasonably believes has caused or will cause, identity theft or other fraud<\/span>. With respect to employers, this subsection applies only to information regarding the employer’s employees, and does not apply to information regarding the employer’s customers or other non-employees.\n\t\t\tSuch employer or payroll service provider shall provide the Office of the Attorney General<\/span> with the name and federal employer identification number of the employer as defined in § 58.1-460<\/a> that may be affected by the compromise in confidentiality. Upon receipt of such notice, the Office of the Attorney General<\/span> shall notify the Department of Taxation of the compromise in confidentiality. The notification required under this subsection that does not otherwise require notification under this section shall not be subject to any other notification, requirement, exemption, or penalty<\/span> contained in this section. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nBREACH OF PERSONAL INFORMATION NOTIFICATION (\u00a7 18.2-186.6)\n\nA. As used in this section:\n\t\t\t“Breach of the security of the system” means the unauthorized\naccess and acquisition of unencrypted and unredacted computerized data that\ncompromises the security or confidentiality of personal information maintained\nby an individual or entity as part of a database of personal information\nregarding multiple individuals and that causes, or the individual or entity\nreasonably believes has caused, or will cause, identity theft or other fraud to\nany resident of the Commonwealth. Good faith acquisition of personal information\nby an employee or agent of an individual or entity for the purposes of the\nindividual or entity is not a breach of the security of the system, provided\nthat the personal information is not used for a purpose other than a lawful\npurpose of the individual or entity or subject to further unauthorized\ndisclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of\nan algorithmic process into a form in which there is a low probability of\nassigning meaning without the use of a confidential process or key, or the\nsecuring of the information by another method that renders the data elements\nunreadable or unusable.\n\t\t\t“Entity” includes corporations, business trusts, estates,\npartnerships, limited partnerships, limited liability partnerships, limited\nliability companies, associations, organizations, joint ventures, governments,\ngovernmental subdivisions, agencies, or instrumentalities or any other legal\nentity, whether for profit or not for profit.\n\t\t\t“Financial institution” has the meaning given that term in 15\nU.S.C. \u00a7 6809(3).\n\t\t\t“Individual” means a natural person.\n\t\t\t“Notice” means:\n\n 1. Written notice to the last known postal address in the records of the\n individual or entity;\n\n 2. Telephone notice;\n\n 3. Electronic notice; or\n\n 4. Substitute notice, if the individual or the entity required to provide\n notice demonstrates that the cost of providing notice will exceed $50,000, the\n affected class of Virginia residents to be notified exceeds 100,000 residents,\n or the individual or the entity does not have sufficient contact information\n or consent to provide notice as described in subdivisions 1, 2, or 3 of this\n definition. Substitute notice consists of all of the following:\n \t\t\t\ta. E-mail notice if the individual or the entity has e-mail addresses for\n the members of the affected class of residents;\n \t\t\t\tb. Conspicuous posting of the notice on the website of the individual or\n the entity if the individual or the entity maintains a website; and\n \t\t\t\tc. Notice to major statewide media.\n \t\t\t\tNotice required by this section shall not be considered a debt\n communication as defined by the Fair Debt Collection Practices Act in 15\n U.S.C. \u00a7 1692a.\n \t\t\t\tNotice required by this section shall include a description of the\n following:\n\n 1. The incident in general terms;\n\n 2. The type of personal information that was subject to the unauthorized\n access and acquisition;\n\n 3. The general acts of the individual or entity to protect the personal\n information from further unauthorized access;\n\n 4. A telephone number that the person may call for further information and\n assistance, if one exists; and\n\n 5. Advice that directs the person to remain vigilant by reviewing account\n statements and monitoring free credit reports.\n \t\t\t\t\t“Personal information” means the first name or first\n initial and last name in combination with and linked to any one or more of\n the following data elements that relate to a resident of the Commonwealth,\n when the data elements are neither encrypted nor redacted:\n\n 1. Social security number;\n\n 2. Driver’s license number or state identification card number issued in\n lieu of a driver’s license number;\n\n 3. Financial account number, or credit card or debit card number, in\n combination with any required security code, access code, or password that\n would permit access to a resident’s financial accounts;\n\n 4. Passport number; or\n\n 5. Military identification number.\n \t\t\t\tThe term does not include information that is lawfully obtained from\n publicly available information, or from federal, state, or local government\n records lawfully made available to the general public.\n \t\t\t\t“Redact” means alteration or truncation of data such that no\n more than the following are accessible as part of the personal information:\n\n 1. Five digits of a social security number; or\n\n 2. The last four digits of a driver’s license number, state\n identification card number, or account number.\n\nB. If unencrypted or unredacted personal information was or is reasonably\nbelieved to have been accessed and acquired by an unauthorized person and\ncauses, or the individual or entity reasonably believes has caused or will\ncause, identity theft or another fraud to any resident of the Commonwealth, an\nindividual or entity that owns or licenses computerized data that includes\npersonal information shall disclose any breach of the security of the system\nfollowing discovery or notification of the breach of the security of the system\nto the Office of the Attorney General and any affected resident of the\nCommonwealth without unreasonable delay. Notice required by this section may be\nreasonably delayed to allow the individual or entity to determine the scope of\nthe breach of the security of the system and restore the reasonable integrity of\nthe system. Notice required by this section may be delayed if, after the\nindividual or entity notifies a law-enforcement agency, the law-enforcement\nagency determines and advises the individual or entity that the notice will\nimpede a criminal or civil investigation, or homeland or national security.\nNotice shall be made without unreasonable delay after the law-enforcement agency\ndetermines that the notification will no longer impede the investigation or\njeopardize national or homeland security.\n\nC. An individual or entity shall disclose the breach of the security of the\nsystem if encrypted information is accessed and acquired in an unencrypted form,\nor if the security breach involves a person with access to the encryption key\nand the individual or entity reasonably believes that such a breach has caused\nor will cause identity theft or other fraud to any resident of the Commonwealth.\n\nD. An individual or entity that maintains computerized data that includes\npersonal information that the individual or entity does not own or license shall\nnotify the owner or licensee of the information of any breach of the security of\nthe system without unreasonable delay following discovery of the breach of the\nsecurity of the system, if the personal information was accessed and acquired by\nan unauthorized person or the individual or entity reasonably believes the\npersonal information was accessed and acquired by an unauthorized person.\n\nE. In the event an individual or entity provides notice to more than 1,000\npersons at one time pursuant to this section, the individual or entity shall\nnotify, without unreasonable delay, the Office of the Attorney General and all\nconsumer reporting agencies that compile and maintain files on consumers on a\nnationwide basis, as defined in 15 U.S.C. § 1681a (p), of the timing,\ndistribution, and content of the notice.\n\nF. An entity that maintains its own notification procedures as part of an\ninformation privacy or security policy for the treatment of personal information\nthat are consistent with the timing requirements of this section shall be deemed\nto be in compliance with the notification requirements of this section if it\nnotifies residents of the Commonwealth in accordance with its procedures in the\nevent of a breach of the security of the system.\n\nG. An entity that is subject to Title V of the Gramm-Leach-Bliley Act (15 U.S.C.\n§ 6801 et seq.) and maintains procedures for notification of a breach of\nthe security of the system in accordance with the provision of that Act and any\nrules, regulations, or guidelines promulgated thereto shall be deemed to be in\ncompliance with this section.\n\nH. An entity that complies with the notification requirements or procedures\npursuant to the rules, regulations, procedures, or guidelines established by the\nentity’s primary or functional state or federal regulator shall be in\ncompliance with this section.\n\nI. Except as provided by subsections J and K, pursuant to the enforcement duties\nand powers of the Office of the Attorney General, the Attorney General may bring\nan action to address violations of this section. The Office of the Attorney\nGeneral may impose a civil penalty not to exceed $150,000 per breach of the\nsecurity of the system or a series of breaches of a similar nature that are\ndiscovered in a single investigation. Nothing in this section shall limit an\nindividual from recovering direct economic damages from a violation of this\nsection.\n\nJ. A violation of this section by a state-chartered or licensed financial\ninstitution shall be enforceable exclusively by the financial\ninstitution’s primary state regulator.\n\nK. Nothing in this section shall apply to an individual or entity regulated by\nthe State Corporation Commission’s Bureau of Insurance.\n\nL. The provisions of this section shall not apply to criminal intelligence\nsystems subject to the restrictions of 28 C.F.R. Part 23 that are maintained by\nlaw-enforcement agencies of the Commonwealth and the organized Criminal Gang\nFile of the Virginia Criminal Information Network (VCIN), established pursuant\nto Chapter 2 (§ 52-12 et seq.) of Title 52.\n\nM. Notwithstanding any other provision of this section, any employer or payroll\nservice provider that owns or licenses computerized data relating to income tax\nwithheld pursuant to Article 16 (§ 58.1-460 et seq.) of Chapter 3 of Title\n58.1 shall notify the Office of the Attorney General without unreasonable delay\nafter the discovery or notification of unauthorized access and acquisition of\nunencrypted and unredacted computerized data containing a taxpayer\nidentification number in combination with the income tax withheld for that\ntaxpayer that compromises the confidentiality of such data and that creates a\nreasonable belief that an unencrypted and unredacted version of such information\nwas accessed and acquired by an unauthorized person, and causes, or the employer\nor payroll provider reasonably believes has caused or will cause, identity theft\nor other fraud. With respect to employers, this subsection applies only to\ninformation regarding the employer’s employees, and does not apply to\ninformation regarding the employer’s customers or other non-employees.\n\t\t\tSuch employer or payroll service provider shall provide the Office of the\nAttorney General with the name and federal employer identification number of the\nemployer as defined in § 58.1-460 that may be affected by the compromise in\nconfidentiality. Upon receipt of such notice, the Office of the Attorney General\nshall notify the Department of Taxation of the compromise in confidentiality.\nThe notification required under this subsection that does not otherwise require\nnotification under this section shall not be subject to any other notification,\nrequirement, exemption, or penalty contained in this section.\n\nHISTORY: 2008, cc. 566, 801; 2017, cc. 419, 427; 2019, c. 484; 2020, c. 264.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}