Virginia legislation · 2026 Regular Session
Virginia HB1161: An Act to amend and reenact §§ 2.2-3800, 2.2-3801, 2.2-3802, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia, relating to Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties.
Status: Chaptered, April 13, 2026
Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. Provides that any agency or political subdivision of the Commonwealth shall only disseminate personal information (i) to the extent necessary to comply with state or federal law, including the federal Health Insurance Portability and Accountability Act; (ii) to the extent necessary to carry out the administration of a state or federal program pursuant to state or federal law; (iii) to comply with a subpoena, court order, or administrative proceeding; (iv) to the extent necessary to ensure fulfillment of the obligations of a purchase or contract made in accordance with the Virginia Public Procurement Act or a memorandum of understanding or management agreement made in accordance with the Restructured Higher Education Financial and Administrative Operations Act; (v) when the data subject has given consent; or (vi) to the extent necessary to accomplish a proper purpose of the agency. The bill also prohibits an agency or political subdivision from selling personal information. The bill authorizes a court, in the case of a willful and knowing violation, to subject a specific public officer, appointee, or employee of any agency to civil penalties.
What the bill says
An Act to amend and reenact §§ 2.2-3800, 2.2-3801, 2.2-3802, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia, relating to Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. [H 1161] Approved April 13, 2026 1. That §§ 2.2-3800, 2.2-3801, 2.2-3802, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia are amended and reenacted as findings; principles of information practice. A. This chapter may be cited as the "Government Data Collection and Dissemination Practices Act." B. The General Assembly fin.
From the enrolled text, April 13, 2026:
An Act to amend and reenact §§ 2.2-3800, 2.2-3801, 2.2-3802, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia, relating to Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. [H 1161] Approved April 13, 2026 1. That §§ 2.2-3800, 2.2-3801, 2.2-3802, 2.2-3803, 2.2-3806, and 2.2-3809 of the Code of Virginia are amended and reenacted as findings; principles of information practice. A. This chapter may be cited as the "Government Data Collection and Dissemination Practices Act." B. The General Assembly finds 2. The increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices; 3. An individual's opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems; and 4. In order to preserve the rights guaranteed a citizen in a free society, legislation is necessary to establish procedures to govern information systems containing records on individuals. C. Recordkeeping agencies and political subdivisions of the Commonwealth [DELETED: and] [DELETED: political] [DELETED: subdivisions] shall adhere to the following principles of information practice to ensure safeguards for personal privacy: 1. There shall be no personal information system whose existence is secret. 2. Information shall not be collected unless the need …