Virginia's Breach Notification Law: Section 18.2-186.6, a Public-Sector Medical Statute and Two Tax Data Rules

Va. Code § 18.2-186.6 and Its Definitions

Virginia placed its breach statute in Title 18.2, Crimes and Offenses Generally, in the chapter on crimes involving fraud. It was added by two identical 2008 acts, chapter 566 (SB 307, approved March 11, 2008) and chapter 801 (HB 1469, approved April 2, 2008), each titled as relating to "identity theft prevention; notice of breach of information system." The Attorney General's Database Breach Notification Requirements sheet gives July 1, 2008 as the effective date. Despite its location, nothing in section 18.2-186.6 creates a crime; its remedies are civil.

The section's definitions build a narrow trigger. A "breach of the security of the system" requires "unauthorized access and acquisition" of unencrypted and unredacted computerized data, maintained "as part of a database of personal information regarding multiple individuals," that compromises security or confidentiality and that "causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth." Access without acquisition is not enough, and the fraud element is part of the definition rather than an exception to it.

"Entity" is defined broadly to include corporations, trusts, partnerships, limited liability companies, associations, joint ventures, "governments, governmental subdivisions, agencies, or instrumentalities," whether for profit or not. Individuals are also covered, since the duties run to "an individual or entity that owns or licenses computerized data."

Personal information is a first name or first initial and last name "in combination with and linked to" one of five elements:

• Social Security number
• Driver's license number or state identification card number
• Financial account, credit card or debit card number with any required security code, access code or password
• Passport number
• Military identification number

The last two were added by chapter 484 of the 2019 Acts (HB 2396, approved March 18, 2019), and the Attorney General's sheet notes them as reportable from July 1, 2019. The list has no medical, biometric, or online credential element. The redaction standard is also unusual: data counts as redacted if no more than five digits of a Social Security number, or the last four digits of a license, state identification or account number, are accessible.

Without Unreasonable Delay: Timing and Law Enforcement Holds

Subsection B sets no number of days. Disclosure follows "discovery or notification of the breach" and must be made "without unreasonable delay." Two delays are allowed. Notice "may be reasonably delayed" to let the entity determine the scope of the breach and restore the reasonable integrity of the system. Notice may also be delayed if, after the entity notifies a law enforcement agency, that agency "determines and advises" that notice will impede a criminal or civil investigation or homeland or national security. The statute does not require the agency's advice to be in writing. Once the agency determines notice will no longer impede the investigation, notice follows without unreasonable delay.

Subsection C reaches encrypted data in two situations: where it is accessed and acquired in unencrypted form, and where the breach involves a person with access to the encryption key and the entity reasonably believes identity theft or fraud has resulted or will result. Subsection D governs a party that maintains data it does not own or license. It notifies the owner or licensee without unreasonable delay following discovery, and its trigger is access and acquisition alone, without the fraud element.

Notice may be written, by telephone, or electronic. Substitute notice (email where available, a conspicuous website posting, and notice to major statewide media) is available if notice would cost more than $50,000, if more than 100,000 Virginia residents must be notified, or if contact information or consent is lacking. Every notice must describe five things: the incident in general terms; the type of personal information involved; the general acts taken to protect it from further access; a telephone number for assistance, if one exists; and "advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports." The statute adds that a breach notice is not a debt communication under the Fair Debt Collection Practices Act.

Notice to the Attorney General and Consumer Reporting Agencies

Attorney General notice is not tied to a head count in Virginia. Subsection B directs disclosure "to the Office of the Attorney General and any affected resident of the Commonwealth" in the same sentence, so any breach that requires resident notice also requires notice to the Office. Subsection E adds a second layer when notice goes to more than 1,000 persons at one time: the entity must notify, without unreasonable delay, the Office and all nationwide consumer reporting agencies "of the timing, distribution, and content of the notice."

The Attorney General's requirements sheet, updated July 1, 2019, asks for a cover letter on letterhead, the approximate date of the incident and how it was discovered, its cause, the number of Virginia residents affected, the remedial steps taken, the employer's federal employer identification number where employee tax data is involved, and a sample of the notice sent to residents, "to include any possible offers of free credit monitoring." Notifications go to the Computer Crime Section of the Office of the Attorney General in Richmond.

The Separate Medical Information Statute, § 32.1-127.1:05

Virginia's medical breach rule is narrower in reach than its title suggests. Section 32.1-127.1:05, added by chapter 852 of the 2010 Acts (HB 1039), defines "entity" as authorities, boards, commissions and agencies of the Commonwealth and its political subdivisions, including cities, counties, school boards and boards of visitors of public universities, and "other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds." A private business that is not principally publicly funded is outside the definition.

Within that public sphere, medical information means a name linked to information about medical or mental health history, condition, treatment or diagnosis, or to a health insurance policy or subscriber number, insurer identifier, or application and claims history including appeals. The trigger contains no fraud element: notice is owed whenever unencrypted or unredacted medical information "was or is reasonably believed to have been accessed and acquired by an unauthorized person." Notice goes to the Office of the Attorney General, the Commissioner of Health, the subject of the information and affected residents, and above 1,000 persons the Attorney General and Commissioner also receive the timing, distribution and content of the notice.

Subsection F removes two groups: HIPAA covered entities and business associates subject to the HITECH breach rules, and non-HIPAA entities subject to the Federal Trade Commission's Health Breach Notification Rule. The section has no penalty or enforcement subsection of its own.

Employer Tax Information and Tax Return Preparers

The employer rule is in section 18.2-186.6 itself. Subsection M, added in 2017 by two identical acts relating to "a notification requirement for breach of payroll data" (chapter 419, HB 2113, and chapter 427, SB 1033, both approved March 13, 2017), applies to "any employer or payroll service provider that owns or licenses computerized data relating to income tax withheld." It requires notice to the Office of the Attorney General after unauthorized access and acquisition of a taxpayer identification number "in combination with the income tax withheld for that taxpayer," where identity theft or fraud has resulted or is reasonably believed likely. For employers it covers only employees' information. The notice must give the employer's name and federal employer identification number, and the Office then notifies the Department of Taxation. A notice owed only under subsection M is not subject to the section's other requirements, exemptions or penalties.

Section 58.1-341.2 covers a different group. Added by chapter 283 of the 2018 Acts (HB 183) and chapter 360 (SB 271), it requires any signing income tax return preparer who prepares Virginia individual returns to notify "the Department," which section 58.1-1 defines as the Department of Taxation, after unauthorized access and acquisition of return information that causes or is reasonably believed to cause identity theft or fraud. The preparer supplies the name and taxpayer identification number of each affected taxpayer and its own preparer tax identification number, and a firm files on behalf of its employee preparers. The Department's Report a Data Breach page separately asks businesses with compromised payroll records to call the Department as well as notify the Attorney General.

Attorney General Enforcement and Civil Penalties

Subsection I gives the Attorney General authority to bring an action "pursuant to the enforcement duties and powers of the Office" and to "impose a civil penalty not to exceed $150,000 per breach of the security of the system or a series of breaches of a similar nature that are discovered in a single investigation." The same subsection preserves individual claims: "Nothing in this section shall limit an individual from recovering direct economic damages from a violation of this section."

Three carve-outs shape who the Attorney General can pursue. Under subsection J, a violation by a state-chartered or licensed financial institution "shall be enforceable exclusively by the financial institution's primary state regulator." Under subsection K, the section does not apply to an individual or entity regulated by the State Corporation Commission's Bureau of Insurance; that exclusion came with chapter 264 of the 2020 Acts (HB 1334), which also enacted an insurance data security article in Title 38.2. Under it, section 38.2-625 requires a licensee to notify "the Commissioner" no later than three business days after determining a cybersecurity event occurred if, among other triggers, 250 or more Virginia consumers are involved. Under subsection L, certain law enforcement criminal intelligence systems are excluded.

Three deemed-compliance routes complete the section: an entity following its own notification procedures consistent with the statute's timing (subsection F), an entity subject to Title V of the Gramm-Leach-Bliley Act that maintains notification procedures under it (subsection G), and an entity complying with the notification rules of its primary or functional state or federal regulator (subsection H).

On the record of enforcement, the Office's published materials fetched for this post include a September 30, 2020 release announcing that Virginia joined a 43-state coalition and California in a $39.5 million settlement with Anthem over its 2014 breach, with $1,404,487.61 as Virginia's share for nearly 3.8 million affected Virginians. The release does not identify the statutes the states relied on, and the settlement agreement it links could not be retrieved, so it is not described here as an action under section 18.2-186.6. No action expressly brought under that section was found in the materials that could be opened.

Frequently Asked Questions