2.2-3806 - Rights of data subjects.
§ 2.2-3806. Rights of data subjects.
A. Any agency maintaining personal information shall:
1. Inform an individual who is asked to supply personal information abouthimself whether he is legally required, or may refuse, to supply theinformation requested, and also of any specific consequences that are knownto the agency of providing or not providing the information.
2. Give notice to a data subject of the possible dissemination of part or allof this information to another agency, nongovernmental organization or systemnot having regular access authority, and indicate the use for which it isintended, and the specific consequences for the individual, which are knownto the agency, of providing or not providing the information. Howeverdocumented permission for dissemination in the hands of the other agency ororganization shall satisfy the requirement of this subdivision. The noticemay be given on applications or other data collection forms prepared by datasubjects.
3. Upon request and proper identification of any data subject, or of hisauthorized agent, grant the data subject or agent the right to inspect, in aform comprehensible to him:
a. All personal information about that data subject except as provided insubdivision 1 of § 2.2-3705.1, subdivision 1 of § 2.2-3705.4, and subdivision1 of § 2.2-3705.5.
b. The nature of the sources of the information.
c. The names of recipients, other than those with regular access authority,of personal information about the data subject including the identity of allpersons and organizations involved and their relationship to the system whennot having regular access authority, except that if the recipient hasobtained the information as part of an ongoing criminal investigation suchthat disclosure of the investigation would jeopardize law-enforcement action,then no disclosure of such access shall be made to the data subject.
4. Comply with the following minimum conditions of disclosure to datasubjects:
a. An agency shall make disclosures to data subjects required under thischapter, during normal business hours, in accordance with the procedures setforth in subsections B and C of § 2.2-3704 for responding to requests underthe Virginia Freedom of Information Act (§ 2.2-3700 et seq.) or within a timeperiod as may be mutually agreed upon by the agency and the data subject.
b. The disclosures to data subjects required under this chapter shall be made(i) in person, if he appears in person and furnishes proper identification,or (ii) by mail, if he has made a written request, with properidentification. Copies of the documents containing the personal informationsought by a data subject shall be furnished to him or his representative atreasonable charges for document search and duplication in accordance withsubsection F of § 2.2-3704.
c. The data subject shall be permitted to be accompanied by a person of hischoosing, who shall furnish reasonable identification. An agency may requirethe data subject to furnish a written statement granting the agencypermission to discuss the individual's file in such person's presence.
5. If the data subject gives notice that he wishes to challenge, correct, orexplain information about him in the information system, the followingminimum procedures shall be followed:
a. The agency maintaining the information system shall investigate, andrecord the current status of that personal information.
b. If, after such investigation, the information is found to be incomplete,inaccurate, not pertinent, not timely, or not necessary to be retained, itshall be promptly corrected or purged.
c. If the investigation does not resolve the dispute, the data subject mayfile a statement of not more than 200 words setting forth his position.
d. Whenever a statement of dispute is filed, the agency maintaining theinformation system shall supply any previous recipient with a copy of thestatement and, in any subsequent dissemination or use of the information inquestion, clearly note that it is disputed and supply the statement of thedata subject along with the information.
e. The agency maintaining the information system shall clearly andconspicuously disclose to the data subject his rights to make such a request.
f. Following any correction or purging of personal information the agencyshall furnish to past recipients notification that the item has been purgedor corrected whose receipt shall be acknowledged.
B. Nothing in this chapter shall be construed to require an agency todisseminate any recommendation or letter of reference from or to a thirdparty that is a part of the personnel file of any data subject nor todisseminate any test or examination used, administered or prepared by anypublic body for purposes of evaluation of (i) any student or any student'sperformance, (ii) any seeker's qualifications or aptitude for employment,retention, or promotion, or (iii) qualifications for any license orcertificate issued by any public body.
As used in this subsection, "test or examination" includes (i) any scoringkey for any such test or examination and (ii) any other document that wouldjeopardize the security of the test or examination. Nothing contained in thissubsection shall prohibit the release of test scores or results as providedby law, or to limit access to individual records as provided by law; however,the subject of the employment tests shall be entitled to review and inspectall documents relative to his performance on those employment tests.
When, in the reasonable opinion of the public body, any such test orexamination no longer has any potential for future use, and the security offuture tests or examinations will not be jeopardized, the test or examinationshall be made available to the public. Minimum competency tests administeredto public school children shall be made available to the publiccontemporaneously with statewide release of the scores of those taking suchtests, but in no event shall such tests be made available to the public laterthan six months after the administration of such tests.
C. Neither any provision of this chapter nor any provision of the Freedom ofInformation Act (§ 2.2-3700 et seq.) shall be construed to deny public accessto records of the position, job classification, official salary or rate ofpay of, and to records of the allowances or reimbursements for expenses paidto any public officer, official or employee at any level of state, local orregional government in the Commonwealth. The provisions of this subsectionshall not apply to records of the official salaries or rates of pay of publicemployees whose annual rate of pay is $10,000 or less.
D. Nothing in this section or in this chapter shall be construed to requirean agency to disseminate information derived from tax returns in violation of§§ 2.2-3705.7 and 58.1-3.
(1976, c. 597, § 2.1-382; 1978, c. 810; 1979, cc. 683, 688, 689; 1983, c.372; 1995, c. 400; 2001, c. 844; 2004, c. 690; 2007, c. 232.)