{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/2.2-3803.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/2.2-3803.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/2.2-3803.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/2.2-3803.html"}],"law_id":58950,"edition_id":1,"section_id":58950,"structure_id":13559,"section_number":"2.2-3803","catch_line":"Administration of systems including personal information; Internet privacy policy; exceptions","history":"1976, c. 597, \u00a7 2.1-380; 1978, c. 409, \u00a7 2.1-384.1; 1989, c. 547; 2000, cc. 405, 500, 911; 2001, c. 844; 2002, c. 747; 2006, cc. 159, 590; 2017, c. 376; 2018, cc. 597, 679; 2019, c. 774; 2020, c. 738.","full_text":"A\n\nAny agency maintaining an information system that includes personal information shall:1\n\nCollect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency;2\n\nCollect information to the greatest extent feasible from the data subject directly, or through the sharing of data with other agencies, in order to accomplish a proper purpose of the agency;3\n\nEstablish categories for maintaining personal information to operate in conjunction with confidentiality requirements and access controls;4\n\nMaintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject;5\n\nMake no dissemination to another system without (i) specifying requirements for security and usage including limitations on access thereto, and (ii) receiving reasonable assurances that those requirements and limitations will be observed. This subdivision shall not apply, however, to a dissemination made by an agency to an agency in another state, district or territory of the United States where the personal information is requested by the agency of such other state, district or territory in connection with the application of the data subject therein for a service, privilege or right under the laws thereof, nor shall this apply to information transmitted to family advocacy representatives of the United States Armed Forces in accordance with subsection N of § 63.2-1503;6\n\nMaintain a list of all persons or organizations having regular access to personal information in the information system;7\n\nMaintain for a period of three years or until such time as the personal information is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system, including the identity of any persons or organizations not having regular access authority but excluding access by the personnel of the agency wherein data is put to service for the purpose for which it is obtained;8\n\nTake affirmative action to establish rules of conduct and inform each person involved in the design, development, operation, or maintenance of the system, or the collection or use of any personal information contained therein, about all the requirements of this chapter, the rules and procedures, including penalties for noncompliance, of the agency designed to assure compliance with such requirements;9\n\nEstablish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security; and10\n\nCollect no personal information concerning the political or religious beliefs, affiliations, and activities of data subjects that is maintained, used, or disseminated in or by any information system operated by any agency unless authorized explicitly by statute or ordinance. Nothing in this subdivision shall be construed to allow an agency to disseminate to federal government authorities information concerning the religious beliefs and affiliations of data subjects for the purpose of compiling a list, registry, or database of individuals based on religious affiliation, national origin, or ethnicity, unless such dissemination is specifically required by state or federal law.B\n\nEvery public body, as defined in § 2.2-3701, that has an Internet website associated with that public body shall develop an Internet privacy policy and an Internet privacy policy statement that explains the policy to the public. The policy shall be consistent with the requirements of this chapter. The statement shall be made available on the public body’s website in a conspicuous manner. The Secretary of Administration or his designee shall provide guidelines for developing the policy and the statement, and each public body shall tailor the policy and the statement to reflect the information practices of the individual public body. At minimum, the policy and the statement shall address (i) what information, including personally identifiable information, will be collected, if any; (ii) whether any information will be automatically collected simply by accessing the website and, if so, what information; (iii) whether the website automatically places a computer file, commonly referred to as a “cookie,” on the Internet user’s computer and, if so, for what purpose; and (iv) how the collected information is being used or will be used.C\n\nNotwithstanding the provisions of subsection A, the Virginia Retirement System may disseminate information as to the retirement status or benefit eligibility of any employee covered by the Virginia Retirement System, the Judicial Retirement System, the State Police Officers’ Retirement System, or the Virginia Law Officers’ Retirement System, to the chief executive officer or personnel officers of the state or local agency by which he is employed.D\n\nNotwithstanding the provisions of subsection A, the Department of Social Services may disseminate client information to the Department of Taxation for the purposes of providing specified tax information as set forth in clause (ii) of subsection C of § 58.1-3.E\n\nNotwithstanding the provisions of subsection A, the State Council of Higher Education for Virginia may disseminate student information to agencies acting on behalf or in place of the U.S. government to gain access to data on wages earned outside the Commonwealth or through federal employment, for the purposes of complying with § 23.1-204.1.","order_by":null,"text":{"0":{"id":216176,"text":"Any agency maintaining an information system that includes personal information shall:","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"A1"},"1":{"id":216177,"text":"Collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency;","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A","next_prefix":"A2"},"2":{"id":216178,"text":"Collect information to the greatest extent feasible from the data subject directly, or through the sharing of data with other agencies, in order to accomplish a proper purpose of the agency;","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A3"},"3":{"id":216179,"text":"Establish categories for maintaining personal information to operate in conjunction with confidentiality requirements and access controls;","type":"section","prefixes":["A","3"],"prefix":"3","entire_prefix":"A3","prefix_anchor":"A3","level":2,"prior_prefix":"A2","next_prefix":"A4"},"4":{"id":216180,"text":"Maintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject;","type":"section","prefixes":["A","4"],"prefix":"4","entire_prefix":"A4","prefix_anchor":"A4","level":2,"prior_prefix":"A3","next_prefix":"A5"},"5":{"id":216181,"text":"Make no dissemination to another system without (i) specifying requirements for security and usage including limitations on access thereto, and (ii) receiving reasonable assurances that those requirements and limitations will be observed. This subdivision shall not apply, however, to a dissemination made by an agency to an agency in another state, district or territory of the United States where the personal information is requested by the agency of such other state, district or territory in connection with the application of the data subject therein for a service, privilege or right under the laws thereof, nor shall this apply to information transmitted to family advocacy representatives of the United States Armed Forces in accordance with subsection N of § 63.2-1503;","type":"section","prefixes":["A","5"],"prefix":"5","entire_prefix":"A5","prefix_anchor":"A5","level":2,"prior_prefix":"A4","next_prefix":"A6"},"6":{"id":216182,"text":"Maintain a list of all persons or organizations having regular access to personal information in the information system;","type":"section","prefixes":["A","6"],"prefix":"6","entire_prefix":"A6","prefix_anchor":"A6","level":2,"prior_prefix":"A5","next_prefix":"A7"},"7":{"id":216183,"text":"Maintain for a period of three years or until such time as the personal information is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information in a system, including the identity of any persons or organizations not having regular access authority but excluding access by the personnel of the agency wherein data is put to service for the purpose for which it is obtained;","type":"section","prefixes":["A","7"],"prefix":"7","entire_prefix":"A7","prefix_anchor":"A7","level":2,"prior_prefix":"A6","next_prefix":"A8"},"8":{"id":216184,"text":"Take affirmative action to establish rules of conduct and inform each person involved in the design, development, operation, or maintenance of the system, or the collection or use of any personal information contained therein, about all the requirements of this chapter, the rules and procedures, including penalties for noncompliance, of the agency designed to assure compliance with such requirements;","type":"section","prefixes":["A","8"],"prefix":"8","entire_prefix":"A8","prefix_anchor":"A8","level":2,"prior_prefix":"A7","next_prefix":"A9"},"9":{"id":216185,"text":"Establish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security; and","type":"section","prefixes":["A","9"],"prefix":"9","entire_prefix":"A9","prefix_anchor":"A9","level":2,"prior_prefix":"A8","next_prefix":"A10"},"10":{"id":216186,"text":"Collect no personal information concerning the political or religious beliefs, affiliations, and activities of data subjects that is maintained, used, or disseminated in or by any information system operated by any agency unless authorized explicitly by statute or ordinance. Nothing in this subdivision shall be construed to allow an agency to disseminate to federal government authorities information concerning the religious beliefs and affiliations of data subjects for the purpose of compiling a list, registry, or database of individuals based on religious affiliation, national origin, or ethnicity, unless such dissemination is specifically required by state or federal law.","type":"section","prefixes":["A","10"],"prefix":"10","entire_prefix":"A10","prefix_anchor":"A10","level":2,"prior_prefix":"A9","next_prefix":"B"},"11":{"id":216187,"text":"Every public body, as defined in § 2.2-3701, that has an Internet website associated with that public body shall develop an Internet privacy policy and an Internet privacy policy statement that explains the policy to the public. The policy shall be consistent with the requirements of this chapter. The statement shall be made available on the public body’s website in a conspicuous manner. The Secretary of Administration or his designee shall provide guidelines for developing the policy and the statement, and each public body shall tailor the policy and the statement to reflect the information practices of the individual public body. At minimum, the policy and the statement shall address (i) what information, including personally identifiable information, will be collected, if any; (ii) whether any information will be automatically collected simply by accessing the website and, if so, what information; (iii) whether the website automatically places a computer file, commonly referred to as a “cookie,” on the Internet user’s computer and, if so, for what purpose; and (iv) how the collected information is being used or will be used.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A10","next_prefix":"C"},"12":{"id":216188,"text":"Notwithstanding the provisions of subsection A, the Virginia Retirement System may disseminate information as to the retirement status or benefit eligibility of any employee covered by the Virginia Retirement System, the Judicial Retirement System, the State Police Officers’ Retirement System, or the Virginia Law Officers’ Retirement System, to the chief executive officer or personnel officers of the state or local agency by which he is employed.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B","next_prefix":"D"},"13":{"id":216189,"text":"Notwithstanding the provisions of subsection A, the Department of Social Services may disseminate client information to the Department of Taxation for the purposes of providing specified tax information as set forth in clause (ii) of subsection C of § 58.1-3.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C","next_prefix":"E"},"14":{"id":216190,"text":"Notwithstanding the provisions of subsection A, the State Council of Higher Education for Virginia may disseminate student information to agencies acting on behalf or in place of the U.S. government to gain access to data on wages earned outside the Commonwealth or through federal employment, for the purposes of complying with § 23.1-204.1.","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D"}},"ancestry":[{"id":13559,"edition_id":1,"name":"Government Data Collection and Dissemination Practices Act","identifier":"38","label":"chapter","depth":4,"order_by":1,"parent_id":12751,"metadata":{},"date_created":"2026-06-26 03:45:14","date_modified":"2026-06-26 03:45:14","permalink":{"id":176597,"object_type":"structure","relational_id":13559,"identifier":"38","token":"2.2\/II\/B\/38","url":"\/2.2\/II\/B\/38\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12751,"edition_id":1,"name":"Transaction of Public Business","identifier":"B","label":"part","depth":3,"order_by":1,"parent_id":12750,"metadata":{},"date_created":"2026-06-26 03:43:51","date_modified":"2026-06-26 03:43:51","permalink":{"id":176445,"object_type":"structure","relational_id":12751,"identifier":"B","token":"2.2\/II\/B","url":"\/2.2\/II\/B\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12750,"edition_id":1,"name":"Administration of State Government","identifier":"II","label":"subtitle","depth":2,"order_by":1,"parent_id":12749,"metadata":{},"date_created":"2026-06-26 03:43:51","date_modified":"2026-06-26 03:43:51","permalink":{"id":176253,"object_type":"structure","relational_id":12750,"identifier":"II","token":"2.2\/II","url":"\/2.2\/II\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12749,"edition_id":1,"name":"Administration of Government","identifier":"2.2","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:51","date_modified":"2026-06-26 03:43:51","permalink":{"id":171453,"object_type":"structure","relational_id":12749,"identifier":"2.2","token":"2.2","url":"\/2.2\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":69409,"structure_id":13559,"section_number":"2.2-3800","catch_line":"Short title; findings; principles of information practice","url":"\/2.2-3800\/","token":"2.2\/II\/B\/38\/2.2-3800","metadata":false},{"id":54522,"structure_id":13559,"section_number":"2.2-3801","catch_line":"Definitions","url":"\/2.2-3801\/","token":"2.2\/II\/B\/38\/2.2-3801","metadata":false},{"id":62575,"structure_id":13559,"section_number":"2.2-3802","catch_line":"Systems to which chapter inapplicable","url":"\/2.2-3802\/","token":"2.2\/II\/B\/38\/2.2-3802","metadata":false},{"id":58950,"structure_id":13559,"section_number":"2.2-3803","catch_line":"Administration of systems including personal information; Internet privacy policy; exceptions","url":"\/2.2-3803\/","token":"2.2\/II\/B\/38\/2.2-3803","metadata":false},{"id":55705,"structure_id":13559,"section_number":"2.2-3804","catch_line":"Military recruiters to have access to student information, school buildings, etc","url":"\/2.2-3804\/","token":"2.2\/II\/B\/38\/2.2-3804","metadata":false},{"id":59280,"structure_id":13559,"section_number":"2.2-3805","catch_line":"Dissemination of reports","url":"\/2.2-3805\/","token":"2.2\/II\/B\/38\/2.2-3805","metadata":false},{"id":58445,"structure_id":13559,"section_number":"2.2-3806","catch_line":"Rights of data subjects","url":"\/2.2-3806\/","token":"2.2\/II\/B\/38\/2.2-3806","metadata":false},{"id":69841,"structure_id":13559,"section_number":"2.2-3807","catch_line":"Agencies to report concerning systems operated or developed; publication of information","url":"\/2.2-3807\/","token":"2.2\/II\/B\/38\/2.2-3807","metadata":false},{"id":86548,"structure_id":13559,"section_number":"2.2-3808","catch_line":"Collection, disclosure, or display of social security number; personal identifying information of donors; penalty","url":"\/2.2-3808\/","token":"2.2\/II\/B\/38\/2.2-3808","metadata":false},{"id":62639,"structure_id":13559,"section_number":"2.2-3808.1","catch_line":"Agencies' disclosure of certain account information prohibited","url":"\/2.2-3808.1\/","token":"2.2\/II\/B\/38\/2.2-3808.1","metadata":false},{"id":71106,"structure_id":13559,"section_number":"2.2-3808.2","catch_line":"Repealed","url":"\/2.2-3808.2\/","token":"2.2\/II\/B\/38\/2.2-3808.2","metadata":false},{"id":80323,"structure_id":13559,"section_number":"2.2-3809","catch_line":"Injunctive relief; civil penalty; attorneys' fees","url":"\/2.2-3809\/","token":"2.2\/II\/B\/38\/2.2-3809","metadata":false}],"previous_section":{"id":62575,"structure_id":13559,"section_number":"2.2-3802","catch_line":"Systems to which chapter inapplicable","url":"\/2.2-3802\/","token":"2.2\/II\/B\/38\/2.2-3802","metadata":false},"next_section":{"id":55705,"structure_id":13559,"section_number":"2.2-3804","catch_line":"Military recruiters to have access to student information, school buildings, etc","url":"\/2.2-3804\/","token":"2.2\/II\/B\/38\/2.2-3804","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/2.2-3803\/","history_text":"

This law was first created in 1976. The record of its establishment is cataloged in chapter 597 of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. Unfortunately, the 1976 \u201cActs\u201d aren\u2019t available online. It has been modified 10 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 1978, chapter 409; in 1989, chapter 547; in 2000, chapters 405<\/a>, 500<\/a>, and 911<\/a>; in 2001, chapter 844<\/a>; in 2002, chapter 747<\/a>; in 2006, chapters 159<\/a> and 590<\/a>; in 2017, chapter 376<\/a>; in 2018, chapters 597<\/a> and 679<\/a>; in 2019, chapter 774<\/a>; in 2020, chapter 738<\/a>.<\/p>","references":[{"id":68718,"section_number":"2.2-2477","catch_line":"Virginia Career Readiness Certificate Program","order_by":null,"url":"\/2.2-2477\/"},{"id":65741,"section_number":"24.2-444","catch_line":"Duties of general registrars and Department of Elections as to voter registration records; public inspection; exceptions","order_by":null,"url":"\/24.2-444\/"}],"refers_to":[{"id":62411,"section_number":"2.2-3701","catch_line":"Definitions","order_by":null,"url":"\/2.2-3701\/"},{"id":72876,"section_number":"23.1-204.1","catch_line":"Postgraduation employment rates","order_by":null,"url":"\/23.1-204.1\/"},{"id":69022,"section_number":"63.2-1503","catch_line":"Local departments to establish child-protective services; duties","order_by":null,"url":"\/63.2-1503\/"}],"permalink":{"id":176611,"object_type":"law","relational_id":58950,"identifier":"2.2-3803","token":"2.2\/II\/B\/38\/2.2-3803","url":"\/2.2-3803\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/2.2-3803\/","token":"2.2\/II\/B\/38\/2.2-3803","dublin_core":{"Title":"Administration of systems including personal information; Internet privacy policy; exceptions","Type":"Text","Format":"text\/html","Identifier":"\u00a7 2.2-3803","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> Any agency<\/span> maintaining an information system<\/span> that includes personal information<\/span> shall: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Collect, maintain, use, and disseminate<\/span> only that personal information<\/span> permitted or required by law<\/span> to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose<\/span> of the agency<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Collect information to the greatest extent feasible from the data subject<\/span> directly, or through the sharing of data with other agencies, in order<\/span> to accomplish a proper purpose<\/span> of the agency<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Establish categories for maintaining personal information<\/span> to operate in conjunction with confidentiality requirements and access controls; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Maintain information in the system with accuracy, completeness, timeliness, and pertinence as necessary to ensure fairness in determinations relating to a data subject<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Make no dissemination to another system without (i) specifying requirements for security and usage including limitations on access thereto, and (ii) receiving reasonable assurances that those requirements and limitations will be observed. This subdivision shall not apply, however, to a dissemination made by an agency<\/span> to an agency<\/span> in another state, district or territory of the United States where the personal information<\/span> is requested by the agency<\/span> of such other state, district or territory in connection with the application of the data subject<\/span> therein for a service, privilege<\/span> or right under the laws<\/span> thereof, nor shall this apply to information transmitted to family advocacy representatives of the United States Armed Forces in accordance with subsection N of § 63.2-1503<\/a>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

6.<\/span> Maintain a list of all persons or organizations having regular access to personal information<\/span> in the information system<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

7.<\/span> Maintain for a period of three years or until such time as the personal information<\/span> is purged, whichever is shorter, a complete and accurate record, including identity and purpose, of every access to any personal information<\/span> in a system, including the identity of any persons or organizations not having regular access authority but excluding access by the personnel of the agency<\/span> wherein data is put to service for the purpose for which it is obtained; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

8.<\/span> Take affirmative action to establish rules of conduct and inform each person involved in the design, development, operation, or maintenance of the system, or the collection or use of any personal information<\/span> contained therein, about all the requirements of this chapter, the rules and procedures, including penalties for noncompliance, of the agency<\/span> designed to assure compliance with such requirements; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

9.<\/span> Establish appropriate safeguards to secure the system from any reasonably foreseeable threat to its security; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

10.<\/span> Collect no personal information<\/span> concerning the political or religious beliefs, affiliations, and activities of data subjects<\/span> that is maintained, used, or disseminated in or by any information system<\/span> operated by any agency<\/span> unless authorized explicitly by statute<\/span> or ordinance<\/span>. Nothing in this subdivision shall be construed to allow an agency<\/span> to disseminate<\/span> to federal government authorities information concerning the religious beliefs and affiliations of data subjects<\/span> for the purpose of compiling a list, registry, or database of individuals based on religious affiliation, national origin, or ethnicity, unless such dissemination is specifically required by state or federal law<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> Every public body, as defined in § 2.2-3701<\/a>, that has an Internet website associated with that public body shall develop an Internet privacy policy and an Internet privacy policy statement that explains the policy to the public. The policy shall be consistent with the requirements of this chapter. The statement shall be made available on the public body’s website in a conspicuous manner. The Secretary of Administration or his designee shall provide guidelines for developing the policy and the statement, and each public body shall tailor the policy and the statement to reflect the information practices of the individual public body. At minimum, the policy and the statement shall address (i) what information, including personally identifiable information, will be collected, if any; (ii) whether any information will be automatically collected simply by accessing the website and, if so, what information; (iii) whether the website automatically places a computer file, commonly referred to as a “cookie,” on the Internet user’s computer and, if so, for what purpose; and (iv) how the collected information is being used or will be used. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> Notwithstanding the provisions of subsection A, the Virginia Retirement System may disseminate<\/span> information as to the retirement status or benefit eligibility of any employee covered by the Virginia Retirement System, the Judicial Retirement System, the State Police Officers’ Retirement System, or the Virginia Law<\/span> Officers’ Retirement System, to the chief executive officer or personnel officers of the state or local agency<\/span> by which he is employed. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> Notwithstanding the provisions of subsection A, the Department of Social Services may disseminate<\/span> client information to the Department of Taxation for the purposes of providing specified tax information as set forth in clause (ii) of subsection C of § 58.1-3<\/a>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> Notwithstanding the provisions of subsection A, the State Council of Higher Education for Virginia may disseminate<\/span> student information to agencies acting on behalf or in place of the U.S. government to gain access to data on wages earned outside the Commonwealth or through federal employment, for the purposes of complying with § 23.1-204.1<\/a>. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nADMINISTRATION OF SYSTEMS INCLUDING PERSONAL INFORMATION; INTERNET PRIVACY\nPOLICY; EXCEPTIONS (\u00a7 2.2-3803)\n\nA. Any agency maintaining an information system that includes personal\ninformation shall:\n\n 1. Collect, maintain, use, and disseminate only that personal information\n permitted or required by law to be so collected, maintained, used, or\n disseminated, or necessary to accomplish a proper purpose of the agency;\n\n 2. Collect information to the greatest extent feasible from the data subject\n directly, or through the sharing of data with other agencies, in order to\n accomplish a proper purpose of the agency;\n\n 3. Establish categories for maintaining personal information to operate in\n conjunction with confidentiality requirements and access controls;\n\n 4. Maintain information in the system with accuracy, completeness, timeliness,\n and pertinence as necessary to ensure fairness in determinations relating to a\n data subject;\n\n 5. Make no dissemination to another system without (i) specifying requirements\n for security and usage including limitations on access thereto, and (ii)\n receiving reasonable assurances that those requirements and limitations will\n be observed. This subdivision shall not apply, however, to a dissemination\n made by an agency to an agency in another state, district or territory of the\n United States where the personal information is requested by the agency of\n such other state, district or territory in connection with the application of\n the data subject therein for a service, privilege or right under the laws\n thereof, nor shall this apply to information transmitted to family advocacy\n representatives of the United States Armed Forces in accordance with\n subsection N of § 63.2-1503;\n\n 6. Maintain a list of all persons or organizations having regular access to\n personal information in the information system;\n\n 7. Maintain for a period of three years or until such time as the personal\n information is purged, whichever is shorter, a complete and accurate record,\n including identity and purpose, of every access to any personal information in\n a system, including the identity of any persons or organizations not having\n regular access authority but excluding access by the personnel of the agency\n wherein data is put to service for the purpose for which it is obtained;\n\n 8. Take affirmative action to establish rules of conduct and inform each\n person involved in the design, development, operation, or maintenance of the\n system, or the collection or use of any personal information contained\n therein, about all the requirements of this chapter, the rules and procedures,\n including penalties for noncompliance, of the agency designed to assure\n compliance with such requirements;\n\n 9. Establish appropriate safeguards to secure the system from any reasonably\n foreseeable threat to its security; and\n\n 10. Collect no personal information concerning the political or religious\n beliefs, affiliations, and activities of data subjects that is maintained,\n used, or disseminated in or by any information system operated by any agency\n unless authorized explicitly by statute or ordinance. Nothing in this\n subdivision shall be construed to allow an agency to disseminate to federal\n government authorities information concerning the religious beliefs and\n affiliations of data subjects for the purpose of compiling a list, registry,\n or database of individuals based on religious affiliation, national origin, or\n ethnicity, unless such dissemination is specifically required by state or\n federal law.\n\nB. Every public body, as defined in § 2.2-3701, that has an Internet\nwebsite associated with that public body shall develop an Internet privacy\npolicy and an Internet privacy policy statement that explains the policy to the\npublic. The policy shall be consistent with the requirements of this chapter.\nThe statement shall be made available on the public body’s website in a\nconspicuous manner. The Secretary of Administration or his designee shall\nprovide guidelines for developing the policy and the statement, and each public\nbody shall tailor the policy and the statement to reflect the information\npractices of the individual public body. At minimum, the policy and the\nstatement shall address (i) what information, including personally identifiable\ninformation, will be collected, if any; (ii) whether any information will be\nautomatically collected simply by accessing the website and, if so, what\ninformation; (iii) whether the website automatically places a computer file,\ncommonly referred to as a “cookie,” on the Internet user’s\ncomputer and, if so, for what purpose; and (iv) how the collected information is\nbeing used or will be used.\n\nC. Notwithstanding the provisions of subsection A, the Virginia Retirement\nSystem may disseminate information as to the retirement status or benefit\neligibility of any employee covered by the Virginia Retirement System, the\nJudicial Retirement System, the State Police Officers’ Retirement System,\nor the Virginia Law Officers’ Retirement System, to the chief executive\nofficer or personnel officers of the state or local agency by which he is\nemployed.\n\nD. Notwithstanding the provisions of subsection A, the Department of Social\nServices may disseminate client information to the Department of Taxation for\nthe purposes of providing specified tax information as set forth in clause (ii)\nof subsection C of § 58.1-3.\n\nE. Notwithstanding the provisions of subsection A, the State Council of Higher\nEducation for Virginia may disseminate student information to agencies acting on\nbehalf or in place of the U.S. government to gain access to data on wages earned\noutside the Commonwealth or through federal employment, for the purposes of\ncomplying with § 23.1-204.1.\n\nHISTORY: 1976, c. 597, \u00a7 2.1-380; 1978, c. 409, \u00a7 2.1-384.1; 1989, c. 547;\n2000, cc. 405, 500, 911; 2001, c. 844; 2002, c. 747; 2006, cc. 159, 590; 2017,\nc. 376; 2018, cc. 597, 679; 2019, c. 774; 2020, c. 738.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}