                                 CODE OF VIRGINIA

ADMINISTRATION OF SYSTEMS INCLUDING PERSONAL INFORMATION; INTERNET PRIVACY
POLICY; EXCEPTIONS (§ 2.2-3803)

A. Any agency maintaining an information system that includes personal
information shall:

   1. Collect, maintain, use, and disseminate only that personal information
   permitted or required by law to be so collected, maintained, used, or
   disseminated, or necessary to accomplish a proper purpose of the agency;

   2. Collect information to the greatest extent feasible from the data subject
   directly, or through the sharing of data with other agencies, in order to
   accomplish a proper purpose of the agency;

   3. Establish categories for maintaining personal information to operate in
   conjunction with confidentiality requirements and access controls;

   4. Maintain information in the system with accuracy, completeness, timeliness,
   and pertinence as necessary to ensure fairness in determinations relating to a
   data subject;

   5. Make no dissemination to another system without (i) specifying requirements
   for security and usage including limitations on access thereto, and (ii)
   receiving reasonable assurances that those requirements and limitations will
   be observed. This subdivision shall not apply, however, to a dissemination
   made by an agency to an agency in another state, district or territory of the
   United States where the personal information is requested by the agency of
   such other state, district or territory in connection with the application of
   the data subject therein for a service, privilege or right under the laws
   thereof, nor shall this apply to information transmitted to family advocacy
   representatives of the United States Armed Forces in accordance with
   subsection N of &#xA7; 63.2-1503;

   6. Maintain a list of all persons or organizations having regular access to
   personal information in the information system;

   7. Maintain for a period of three years or until such time as the personal
   information is purged, whichever is shorter, a complete and accurate record,
   including identity and purpose, of every access to any personal information in
   a system, including the identity of any persons or organizations not having
   regular access authority but excluding access by the personnel of the agency
   wherein data is put to service for the purpose for which it is obtained;

   8. Take affirmative action to establish rules of conduct and inform each
   person involved in the design, development, operation, or maintenance of the
   system, or the collection or use of any personal information contained
   therein, about all the requirements of this chapter, the rules and procedures,
   including penalties for noncompliance, of the agency designed to assure
   compliance with such requirements;

   9. Establish appropriate safeguards to secure the system from any reasonably
   foreseeable threat to its security; and

   10. Collect no personal information concerning the political or religious
   beliefs, affiliations, and activities of data subjects that is maintained,
   used, or disseminated in or by any information system operated by any agency
   unless authorized explicitly by statute or ordinance. Nothing in this
   subdivision shall be construed to allow an agency to disseminate to federal
   government authorities information concerning the religious beliefs and
   affiliations of data subjects for the purpose of compiling a list, registry,
   or database of individuals based on religious affiliation, national origin, or
   ethnicity, unless such dissemination is specifically required by state or
   federal law.

B. Every public body, as defined in &#xA7; 2.2-3701, that has an Internet
website associated with that public body shall develop an Internet privacy
policy and an Internet privacy policy statement that explains the policy to the
public. The policy shall be consistent with the requirements of this chapter.
The statement shall be made available on the public body&#8217;s website in a
conspicuous manner. The Secretary of Administration or his designee shall
provide guidelines for developing the policy and the statement, and each public
body shall tailor the policy and the statement to reflect the information
practices of the individual public body. At minimum, the policy and the
statement shall address (i) what information, including personally identifiable
information, will be collected, if any; (ii) whether any information will be
automatically collected simply by accessing the website and, if so, what
information; (iii) whether the website automatically places a computer file,
commonly referred to as a &#8220;cookie,&#8221; on the Internet user&#8217;s
computer and, if so, for what purpose; and (iv) how the collected information is
being used or will be used.

C. Notwithstanding the provisions of subsection A, the Virginia Retirement
System may disseminate information as to the retirement status or benefit
eligibility of any employee covered by the Virginia Retirement System, the
Judicial Retirement System, the State Police Officers&#8217; Retirement System,
or the Virginia Law Officers&#8217; Retirement System, to the chief executive
officer or personnel officers of the state or local agency by which he is
employed.

D. Notwithstanding the provisions of subsection A, the Department of Social
Services may disseminate client information to the Department of Taxation for
the purposes of providing specified tax information as set forth in clause (ii)
of subsection C of &#xA7; 58.1-3.

E. Notwithstanding the provisions of subsection A, the State Council of Higher
Education for Virginia may disseminate student information to agencies acting on
behalf or in place of the U.S. government to gain access to data on wages earned
outside the Commonwealth or through federal employment, for the purposes of
complying with &#xA7; 23.1-204.1.

HISTORY: 1976, c. 597, § 2.1-380; 1978, c. 409, § 2.1-384.1; 1989, c. 547;
2000, cc. 405, 500, 911; 2001, c. 844; 2002, c. 747; 2006, cc. 159, 590; 2017,
c. 376; 2018, cc. 597, 679; 2019, c. 774; 2020, c. 738.