As used in this chapter, unless the context requires a different meaning:

"Agency" means any agency, authority, board, department, division, commission, institution, bureau, or like governmental entity of the Commonwealth or of any unit of local government including counties, cities, towns, regional governments, and the departments thereof, and includes constitutional officers, except as otherwise expressly provided by law. "Agency" shall also include any entity, whether public or private, with which any of the foregoing has entered into a contractual relationship for the operation of a system of personal information to accomplish an agency function. Any such entity included in this definition by reason of a contractual relationship shall only be deemed an agency as relates to services performed pursuant to that contractual relationship, provided that if any such entity is a consumer reporting agency, it shall be deemed to have satisfied all of the requirements of this chapter if it fully complies with the requirements of the Federal Fair Credit Reporting Act as applicable to services performed pursuant to such contractual relationship.

"Consent" means a clear affirmative act signifying a data subject's freely given, specific, informed, and unambiguous agreement to disseminate personal information relating to the data subject. "Consent" may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.

"Data subject" means an individual about whom personal information is indexed or may be located under his name, personal number, or other identifiable particulars, in an information system.

"Disseminate" means to release, transfer, or otherwise communicate information orally, in writing, or by electronic means.

"Information system" means the total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject.

"Personal information" means all information that (i) describes, locates, or indexes anything about an individual, including his social security number, U.S. Citizenship and Immigration Services (USCIS) alien registration number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, tax identification number, and his education, financial transactions, medical history, ancestry, national origin, religion, political ideology, voting history, criminal or employment record, and immigration status, or (ii) affords a basis for inferring personal characteristics, such as fingerprints, voiceprints, faceprints, eye retinas, irises, or other unique biological patterns or characteristics, physical or digital photographs, videos, or audio, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. "Personal information" does not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely any data subject nor does the term include real estate assessment information.

"Private entity" means any natural person, corporation, general partnership, limited liability company, limited partnership, joint venture, business trust, public benefit corporation, nonprofit entity, or other business entity.

"Proper purpose" includes the sharing or dissemination of data or information among and between agencies, or, as applicable, private entities, in order to (i) streamline administrative processes to improve the efficiency and efficacy of services, access to services, eligibility determinations for services, and service delivery; (ii) reduce paperwork and administrative burdens on applicants for and recipients of public services; (iii) improve the efficiency and efficacy of the management of public programs; (iv) prevent fraud and improve auditing capabilities; (v) conduct outcomes-related research; (vi) develop quantifiable data to aid in policy development and decision making to promote the most efficient and effective use of resources; and (vii) perform data analytics regarding any of the purposes set forth in this definition.

"Purge" means to obliterate information completely from the transient, permanent, or archival records of an agency.

1976, c. 597, § 2.1-379; 1983, c. 372; 1999, c. 41; 2001, c. 844; 2003, c. 272; 2006, c. 474; 2008, cc. 840, 843; 2009, cc. 849, 867; 2018, cc. 597, 679; 2026, c. 748.