Bill Text: VA SB965 | 2015 | Regular Session | Enrolled
Bill Title: Government Data Collection and Dissemination Practices Act; limitation on collection.
Spectrum: Bipartisan Bill
Status: (Vetoed) 2015-04-30 - Governor: Vetoed by Governor [SB965 Detail]
Download: Virginia-2015-SB965-Enrolled.html
|
Be it enacted by the General Assembly of Virginia: 1. That §§2.2-3800 and 2.2-3801 of the Code of Virginia are amended and reenacted and that the Code of Virginia is amended by adding a section numbered 2.2-3808.3 as follows: §2.2-3800. Short title; findings; principles of information practice. A. This chapter may be cited as the "Government Data Collection and Dissemination Practices Act." B. The General Assembly finds that: 1. An individual's privacy is directly affected by the extensive collection, maintenance, use and dissemination of personal information; 2. The increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices; 3. An individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems; and 4. In order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals. C. Recordkeeping agencies of the Commonwealth and political subdivisions shall adhere to the following principles of information practice to ensure safeguards for personal privacy: 1. There shall be no personal information system whose existence is secret. 2. Information shall not be collected unless the need for it has been clearly established in advance. 3. Information shall be appropriate and relevant to the purpose for which it has been collected. 4. Information shall not be obtained by fraudulent or unfair means. 5. Information shall not be used unless it is accurate and current. 6. There shall be a prescribed procedure for an individual to learn the purpose for which information has been recorded and particulars about its use and dissemination. 7. There shall be a clearly prescribed and uncomplicated procedure for an individual to correct, erase or amend inaccurate, obsolete or irrelevant information. 8. Any agency holding personal information shall assure its reliability and take precautions to prevent its misuse. 9. There shall be a clearly prescribed procedure to prevent personal information collected for one purpose from being used for another purpose. 10. The Commonwealth or any agency or political subdivision thereof shall not collect personal information except as explicitly or implicitly authorized by law. 11. Unless a criminal or administrative warrant has been issued, law-enforcement and regulatory agencies shall not use any surveillance technology to collect or maintain personal information where such data is of unknown relevance and is not intended for prompt evaluation and potential use respecting suspected criminal activity or terrorism by any individual or organization. §2.2-3801. Definitions. As used in this chapter, unless the context requires a different meaning: "Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship. "Data subject" means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system. "Disseminate" means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means. "Information system" means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. "Personal information" means all information that
(i) describes, locates or indexes anything about an individual including, but
not limited to, his social security number, driver's license number, vehicle
license plate number, agency-issued identification number, student
identification number, real or personal property holdings derived from tax
returns, and his education, financial transactions, medical history, ancestry,
religion, political ideology, criminal or employment record, or (ii) affords a
basis for inferring personal characteristics, such as finger and voice prints,
photographs, or things done by or to such individual; and the record of his
presence, registration, or membership in an organization or activity, presence
at any place, or admission to an institution. "Personal
information" "Purge" means to obliterate information completely from the transient, permanent, or archival records of an agency. "Surveillance technology" means technology used to observe people, places or activities or to collect personal information, without the subject's knowledge or consent." §2.2-3808.3. Use of license plate readers by law-enforcement agencies; limitations. Notwithstanding the restrictions in §2.2-3800, law-enforcement agencies shall be allowed to collect information from license plate readers, provided such information (i) is held for no more than seven days and (ii) is not subject to any outside inquiries or internal usage, except in the investigation of a crime or missing persons report. After seven days, the information shall be purged from the system unless it is being utilized in an ongoing investigation. As used in this section, "license plate reader" means a law-enforcement system that optically scans vehicle license plates. |
