Law / United States / 
Virginia
Personal Information Privacy Act: restricted use of social security numbers
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- Except as otherwise specifically provided by law, do not intentionally communicate another individual's social security number to the general public (section 59.1-443.2(A)(1)).
- Do not print an individual's social security number on any card required for the individual to access or receive products or services you provide (section 59.1-443.2(A)(2)).
- Do not require an individual to use a social security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required to access the site (section 59.1-443.2(A)(3)).
- Do not send or cause to be sent or delivered a letter, envelope or package that displays a social security number on the face of the mailing envelope or package, or from which one is visible, whether on the outside or inside (section 59.1-443.2(A)(4)).
- Do not embed an encrypted or unencrypted social security number in or on a card or document, including by a bar code, chip, magnetic strip or other technology, in place of removing it as the section requires (section 59.1-443.2(E)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
A violation of section 59.1-443.2 is a prohibited practice under the Virginia Consumer Protection Act (sections 59.1-200(A)(43) and 59.1-444). Under that Act, on a finding of a willful violation the Attorney General or an attorney for the Commonwealth or a locality may recover for the Literary Fund a civil penalty of not more than $2,500 per violation (section 59.1-206(A)); the $2,500 ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Statutory damages
Through the Virginia Consumer Protection Act (section 59.1-444, last sentence): a person who suffers loss may recover actual damages or $500, whichever is greater (section 59.1-204(A)); if the trier of fact finds the violation willful it may increase damages to not more than three times actual damages or $1,000, whichever is greater, and attorneys' fees and court costs may be added (section 59.1-204(A) and (B)). The $100 per violation action in section 59.1-444 does not reach section 59.1-443.2.
- As of
- Currency
- USD
- Per person minimum
- 500
Who enforces it
Enforcement body
Virginia Attorney General, an attorney for the Commonwealth, or the attorney for any city, county or town, who may cause an action to be brought in circuit court to enjoin a violation of the Consumer Protection Act (section 59.1-203).
Settledness
- As of
- Open questions
- Does an individual whose social security number is displayed on a mailing 'suffer loss' within section 59.1-204(A), the Consumer Protection Act's requirement for a private action, without a further injury such as identity theft?
What this law does
Except as otherwise specifically provided by law, a person may not intentionally communicate another individual's social security number to the general public, print it on a card required to access or receive products or services, require its use to access an Internet website without another authentication device, or send a mailing that displays it.
No person may embed an encrypted or unencrypted social security number in or on a card or document, including by a bar code, chip, magnetic strip or other technology, in place of removing it. The section does not prohibit the collection, use or release of a social security number as permitted by the laws of the Commonwealth or the United States, or its use for internal verification or administrative purposes unless a state or federal statute, rule or regulation prohibits that use.
Section 59.1-443.2(C) of the Code of Virginia made the prohibition on printing a social security number on a card required to access products or services effective on for a health care provider, a manager of a pharmacy benefit plan, an insurer, a corporation providing a health services plan, a health maintenance organization providing a health care plan, or a contractor of any of them. The section does not apply to public bodies.
A violation of section 59.1-443.2 is a prohibited practice under the Virginia Consumer Protection Act. On a finding of a willful violation under the Consumer Protection Act, the Attorney General or an attorney for the Commonwealth or a locality may recover a civil penalty of not more than $2,500 per violation. A person who suffers loss as the result of a violation of the Consumer Protection Act may recover actual damages or $500, whichever is greater.
Chapter 562 of the 2008 Acts of Assembly (Senate Bill 133), relating to access to social security numbers, amended and reenacted section 59.1-443.2. Chapter 820 of the 2008 Acts of Assembly (House Bill 633), relating to access to social security numbers, amended and reenacted section 59.1-443.2. The section took effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.