As used in this chapter, unless the context requires a different meaning: “Agency” means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. “Agency” shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship. “Data subject” means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system. “Disseminate” means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means. “Information system” means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. “Personal information” means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver’s license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. “Personal information” shall not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely any data subject nor does the term include real estate assessment information. “Purge” means to obliterate information completely from the transient, permanent, or archival records of an agency.
1976, c. 597, § 2.1-379; 1983, c. 372; 1999, c. 41; 2001, c. 844; 2003, c. 272; 2006, c. 474; 2008, cc. 840, 843; 2009, cc. 849, 867.