VirginiaHB11612026 Regular SessionHouseWALLET

Government. Data Collection & Dissemin. Practices Act; dissemin. of personal info. to federal gov't.

Sponsored By: Kathy K.L. Tran (Democratic)

Became Law

Summary

Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. Provides that any agency or political subdivision of the Commonwealth shall only disseminate personal information (i) to the extent necessary to comply with state or federal law, including the federal Health Insurance Portability and Accountability Act; (ii) to the extent necessary to carry out the administration of a state or federal program pursuant to state or federal law; (iii) to comply with a subpoena, court order, or administrative proceeding; (iv) to the extent necessary to ensure fulfillment of the obligations of a purchase or contract made in accordance with the Virginia Public Procurement Act or a memorandum of understanding or management agreement made in accordance with the Restructured Higher Education Financial and Administrative Operations Act; (v) when the data subject has given consent; or (vi) to the extent necessary to accomplish a proper purpose of the agency. The bill also prohibits an agency or political subdivision from selling personal information. The bill authorizes a court, in the case of a willful and knowing violation, to subject a specific public officer, appointee, or employee of any agency to civil penalties.

Your PRIA Score

Score Hidden

Personalized for You

How does this bill affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Bill Overview

Analyzed Economic Effects

12 provisions identified: 7 benefits, 1 costs, 4 mixed.

You can see and fix your records

You can ask an agency what personal data it has about you and who got it. The agency must tell you if giving data is required and warn you about possible sharing, including with federal agencies. You may inspect your records in person or by mail and get copies for a cost-based fee. If data is wrong, the agency must correct or delete it, or let you add a statement up to 200 words. The agency must tell past recipients when it corrects or deletes your data.

Penalties and lawsuits for privacy violations

If this law is violated, an aggrieved person can go to court to stop it and recover court costs and attorney fees if they win. Courts can fine officers or agencies for willful violations. For individuals, fines generally range from a few hundred dollars up to $2,500 per offense, with higher penalties for repeat violations. Fines are paid into the State Literary Fund.

Stronger limits on government use of your data

State and local agencies may collect personal data only when a law allows it. They can share your data only for six reasons: to follow a law (including HIPAA), run a program, obey a court order or subpoena, meet a contract, with your consent, or for a proper agency purpose. Agencies cannot sell your personal information. Agencies must avoid secret data systems and keep data tied to a clear purpose. The law covers many data types, including IDs, health and school records, finances, biometrics, photos, video, religion, voting history, and more.

Public employers can see your retirement status

If you are in VRS, the Judicial Retirement System, the State Police Officers' Retirement System, or the Virginia Law Officers' Retirement System, your employer’s leadership or HR can get your retirement status and benefit eligibility. This helps benefit administration but reduces personal privacy.

Student wages shared for federal reporting

SCHEV can share student information with agencies acting for the U.S. government to get wage records earned outside Virginia or in federal jobs. This helps the state meet reporting rules. It also increases sharing of students’ earnings data beyond Virginia.

DSS shares certain client tax data

The Department of Social Services may give client information to the Virginia Department of Taxation to provide specific tax data set by law. This can help verify and administer tax rules. It also means more sharing of client information between agencies.

Public employee pay info stays public

The public can see job titles, classifications, official pay rates, and expense reimbursements for public officers and employees. This does not apply to workers who earn $10,000 or less a year.

Contractors must follow state privacy rules

If a company runs a government personal‑data system, it must follow these privacy rules for that work. A consumer reporting agency meets this law for contracted services if it fully follows the federal Fair Credit Reporting Act for those services.

Public websites must post privacy policies

Every public body with a website must post a clear privacy policy. It must say what data is collected, whether data is collected automatically, if cookies are used, and how the data is used. The Secretary of Administration provides guidance to help agencies write these policies.

Tighter security and logs for agency data

Agencies that keep personal data must set access controls, train staff, and protect systems from threats. They must log who accesses your data for three years or until the data is deleted. Agencies should collect information directly from you when possible and keep it accurate and current. Agencies cannot collect political or religious beliefs unless a law allows it, and cannot send religion data to the federal government to build lists unless required by law.

Certain records are exempt from privacy rules

Some systems do not follow these privacy rules. Examples include court records, many criminal-justice files, the sex-offender and certain minors registries, juvenile-justice systems, many licensing records, and police investigation systems. These systems use other laws and may have fewer limits.

Limits on tests and reference letters

Agencies do not have to share letters of reference or tests and scoring keys if release would harm test security. If a test will not be used again and release is safe, it can be made public. Minimum competency tests must be made public when scores are released statewide or within six months.

Sponsors & Cosponsors

Sponsor

  • Kathy K.L. Tran

    Democratic • House

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 286 • No: 132

House vote 3/11/2026

Senate substitute agreed to by House

Yes: 67 • No: 32

Senate vote 3/10/2026

General Laws and Technology Substitute agreed to

Yes: 0 • No: 0

Senate vote 3/10/2026

Passed Senate with substitute

Yes: 21 • No: 19

Senate vote 3/6/2026

Constitutional reading dispensed Block Vote (on 2nd reading)

Yes: 39 • No: 0

Senate vote 3/6/2026

Passed by for the day Block Vote (Voice Vote)

Yes: 0 • No: 0

Senate vote 3/4/2026

Reported from General Laws and Technology with substitute

Yes: 9 • No: 6

House vote 2/12/2026

Read third time and passed House

Yes: 66 • No: 32

House vote 2/3/2026

Delegate Williams Floor amendments passed by

Yes: 62 • No: 34

House vote 1/29/2026

Reported from General Laws

Yes: 15 • No: 6

House vote 1/27/2026

Subcommittee recommends reporting

Yes: 7 • No: 3

Actions Timeline

  1. Acts of Assembly Chapter text (CHAP0748)

    4/13/2026Governor
  2. Approved by Governor-Chapter 748 (effective 7/1/2026)

    4/13/2026Governor
  3. Governor's Action Deadline 11:59 p.m., April 13, 2026

    3/31/2026Governor
  4. Enrolled Bill communicated to Governor on March 31, 2026

    3/31/2026House
  5. Signed by Speaker

    3/31/2026House
  6. Bill text as passed House and Senate (HB1161ER)

    3/30/2026House
  7. Enrolled

    3/30/2026House
  8. Signed by President

    3/30/2026Senate
  9. Senate substitute agreed to by House (67-Y 32-N 0-A)

    3/11/2026House
  10. Passed Senate with substitute (21-Y 19-N 0-A)

    3/10/2026Senate
  11. General Laws and Technology Substitute agreed to

    3/10/2026Senate
  12. Engrossed by Senate - committee substitute

    3/10/2026Senate
  13. Read third time

    3/10/2026Senate
  14. Passed by for the day

    3/9/2026Senate
  15. Passed by for the day Block Vote (Voice Vote)

    3/6/2026Senate
  16. Constitutional reading dispensed Block Vote (on 2nd reading) (39-Y 0-N 0-A)

    3/6/2026Senate
  17. Rules suspended

    3/6/2026Senate
  18. Committee substitute printed 26108358D-S1

    3/5/2026Senate
  19. Senate committee offered

    3/4/2026Senate
  20. Reported from General Laws and Technology with substitute (9-Y 6-N)

    3/4/2026Senate
  21. Referred to Committee on General Laws and Technology

    2/13/2026Senate
  22. Constitutional reading dispensed (on 1st reading)

    2/13/2026Senate
  23. Read third time and passed House (66-Y 32-N 0-A)

    2/12/2026House
  24. Read second time and engrossed

    2/11/2026House
  25. Passed by for the day

    2/10/2026House

Bill Text

Related Bills

Back to State Legislation