Be it enacted by the General Assembly of Virginia:

1. That §§2.2-3705.1 and 2.2-3808 of the Code of Virginia are amended and reenacted as follows:

§2.2-3705.1. Exclusions to application of chapter; exclusions of general application to public bodies.

The following information contained in a public record is excluded from the mandatory disclosure provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law. Redaction of information excluded under this section from a public record shall be conducted in accordance with §2.2-3704.01.

1. Personnel information concerning identifiable individuals, except that access shall not be denied to the person who is the subject thereof. Any person who is the subject of such information and who is 18 years of age or older may waive, in writing, the protections afforded by this subdivision. If the protections are so waived, such information shall be disclosed. Nothing in this subdivision shall be construed to authorize the withholding of any resumes or applications submitted by persons who are appointed by the Governor pursuant to §2.2-106 or 2.2-107.

No provision of this chapter or any provision of Chapter 38 (§ 2.2-3800 et seq.) shall be construed as denying public access to (i) contracts between a public body and its officers or employees, other than contracts settling public employee employment disputes held confidential as personnel records under §2.2-3705.1; (ii) records of the name, position, job classification, official salary, or rate of pay of, and records of the allowances or reimbursements for expenses paid to, any officer, official, or employee of a public body; or (iii) the compensation or benefits paid by any corporation organized by the Virginia Retirement System or its officers or employees. The provisions of this subdivision, however, shall not require public access to records of the official salaries or rates of pay of public employees whose annual rate of pay is $10,000 or less.

2. Written advice of legal counsel to state, regional or local public bodies or the officers or employees of such public bodies, and any other information protected by the attorney-client privilege.

3. Legal memoranda and other work product compiled specifically for use in litigation or for use in an active administrative investigation concerning a matter that is properly the subject of a closed meeting under §2.2-3711.

4. Any test or examination used, administered or prepared by any public body for purposes of evaluation of (i) any student or any student's performance, (ii) any employee or employment seeker's qualifications or aptitude for employment, retention, or promotion, or (iii) qualifications for any license or certificate issued by a public body.

As used in this subdivision, "test or examination" shall include (a) any scoring key for any such test or examination and (b) any other document that would jeopardize the security of the test or examination. Nothing contained in this subdivision shall prohibit the release of test scores or results as provided by law, or limit access to individual records as provided by law. However, the subject of such employment tests shall be entitled to review and inspect all records relative to his performance on such employment tests.

When, in the reasonable opinion of such public body, any such test or examination no longer has any potential for future use, and the security of future tests or examinations will not be jeopardized, the test or examination shall be made available to the public. However, minimum competency tests administered to public school children shall be made available to the public contemporaneously with statewide release of the scores of those taking such tests, but in no event shall such tests be made available to the public later than six months after the administration of such tests.

5. Records recorded in or compiled exclusively for use in closed meetings lawfully held pursuant to §2.2-3711. However, no record that is otherwise open to inspection under this chapter shall be deemed exempt by virtue of the fact that it has been reviewed or discussed in a closed meeting.

6. Vendor proprietary information software that may be in the public records of a public body. For the purpose of this subdivision, "vendor proprietary information software" means computer programs acquired from a vendor for purposes of processing data for agencies or political subdivisions of the Commonwealth.

7. Computer software developed by or for a state agency, public institution of higher education in the Commonwealth, or political subdivision of the Commonwealth.

8. Appraisals and cost estimates of real property subject to a proposed purchase, sale, or lease, prior to the completion of such purchase, sale, or lease.

9. Information concerning reserves established in specific claims administered by the Department of the Treasury through its Division of Risk Management as provided in Article 5 (§2.2-1832 et seq.) of Chapter 18, or by any county, city, or town; and investigative notes, correspondence and information furnished in confidence with respect to an investigation of a claim or a potential claim against a public body's insurance policy or self-insurance plan. However, nothing in this subdivision shall prevent the disclosure of information taken from inactive reports upon expiration of the period of limitations for the filing of a civil suit.

10. Personal contact information furnished to a public body or any of its members for the purpose of receiving electronic communications from the public body or any of its members, unless the recipient of such electronic communications indicates his approval for the public body to disclose such information. However, access shall not be denied to the person who is the subject of the record. As used in this subdivision, "personal contact information" means the information provided to the public body or any of its members for the purpose of receiving electronic communications from the public body or any of its members and includes home or business (i) address, (ii) email address, or (iii) telephone number or comparable number assigned to any other electronic communication device.

11. Communications and materials required to be kept confidential pursuant to §2.2-4119 of the Virginia Administrative Dispute Resolution Act (§2.2-4115 et seq.).

12. Information relating to the negotiation and award of a specific contract where competition or bargaining is involved and where the release of such information would adversely affect the bargaining position or negotiating strategy of the public body. Such information shall not be withheld after the public body has made a decision to award or not to award the contract. In the case of procurement transactions conducted pursuant to the Virginia Public Procurement Act (§2.2-4300 et seq.), the provisions of this subdivision shall not apply, and any release of information relating to such transactions shall be governed by the Virginia Public Procurement Act.

13. Account numbers or routing information for any credit card, debit card, or other account with a financial institution of any person or public body. However, access shall not be denied to the person who is the subject of the information. For the purposes of this subdivision, "financial institution" means any organization authorized to do business under state or federal laws relating to financial institutions, including, without limitation, banks and trust companies, savings banks, savings and loan companies or associations, and credit unions.

14. Names and data of any kind that directly or indirectly identify an individual as a member, supporter, or volunteer of, or donor of financial or nonfinancial support to, any entity exempt from federal income tax pursuant to §501(c) of the Internal Revenue Code, except for those entities established by or for, or in support of, a public body as authorized by state law, not to include a nonprofit foundation designed to support an institution of higher education or other educational or cultural institution subject to Title 23.1.

§2.2-3808. Collection, disclosure, or display of social security number; personal identifying information of donors; penalty.

A. It shall be unlawful for any agency to:

1. Require an individual to disclose or furnish his social security number not previously disclosed or furnished, for any purpose in connection with any activity, or to refuse any service, privilege, or right to an individual wholly or partly because the individual does not disclose or furnish such number, unless the disclosure or furnishing of such number is specifically required by state law in effect prior to January 1, 1975, or is specifically authorized or required by federal law; or

2. Collect from an individual his social security number or any portion thereof unless the collection of such number is (i) authorized or required by state or federal law and (ii) essential for the performance of that agency's duties. Nothing in this subdivision shall be construed to prohibit the collection of a social security number for the sole purpose of complying with the Virginia Debt Collection Act (§2.2-4800 et seq.) or the Setoff Debt Collection Act (§58.1-520 et seq.);

3. Require any individual or any entity organized under § 501(c) of the Internal Revenue Code to provide the agency with personal donor information;

4. Require any bidder, offeror, contractor, or grantee of an agency to provide the agency with personal donor information; or

5. Disclose personal donor information without the express, written permission of every individual who is identifiable from the potential release of such personal donor information, including individuals identifiable as members, supporters, or volunteers of, or donors to, the agency.

B. Agency-issued identification cards, student identification cards, or license certificates issued or replaced on or after July 1, 2003, shall not display an individual's entire social security number except as provided in §46.2-703.

C. Any agency-issued identification card, student identification card, or license certificate that was issued prior to July 1, 2003, and that displays an individual's entire social security number shall be replaced no later than July 1, 2006, except that voter registration cards issued with a social security number and not previously replaced shall be replaced no later than the December 31st following the completion by the state and all localities of the decennial redistricting following the 2010 census. This subsection shall not apply to (i) driver's licenses and special identification cards issued by the Department of Motor Vehicles pursuant to Chapter 3 (§46.2-300 et seq.) of Title 46.2 and (ii) road tax registrations issued pursuant to §46.2-703.

D. No agency, as defined in §42.1-77, shall send or deliver or cause to be sent or delivered, any letter, envelope, or package that displays a social security number on the face of the mailing envelope or package or from which a social security number is visible, whether on the outside or inside of the mailing envelope or package.

E. The provisions of subsections A and C shall not be applicable to licenses:

1. Any license issued by the State Corporation Commission's Bureau of Insurance until such time as a national insurance producer identification number has been created and implemented in all states. Commencing with the date of such implementation, the licenses issued by the State Corporation Commission's Bureau of Insurance shall be issued in compliance with subsection A of this section. Further, all licenses issued prior to the date of such implementation shall be replaced no later than 12 months following the date of such implementation;

2. Any lawful warrant for personal donor information issued by a court of competent jurisdiction;

3. Any lawful request for discovery of personal donor information in litigation if (i) the requester demonstrates a compelling need for the personal donor information by clear and convincing evidence and (ii) the requester obtains a protective order barring disclosure of personal donor information to any person not directly involved in the litigation. As used in this subdivision, "person" means an individual, partnership, corporation, association, governmental entity, or other legal entity;

4. Any admission of relevant personal donor information as evidence before a court of competent jurisdiction;

5. Any lawful investigation or enforcement action conducted pursuant to subsection C or D of §57-59; or

6. Any form prescribed by the Virginia Conflict of Interest and Ethics Advisory Council.

F. A person alleging a violation of this section may bring a civil action for appropriate injunctive relief. A court rendering judgment in favor of a complainant pursuant to this subsection shall award all or a portion of the costs of litigation, including reasonable attorney fees and witness fees, to the complainant.

G. A person who knowingly violates this section is guilty of a misdemeanor punishable by imprisonment of up to 90 days, a fine up to $1,000, or both.

H. Nothing in this section shall apply to the Campaign Finance Disclosure Act of 2006 (§24.2-945 et seq.).

I. As used in this section, "personal donor information" means names and data of any kind collected for the purpose of directly or indirectly identifying an individual as a member, supporter, or volunteer of, or donor of financial or nonfinancial support to, any entity exempt from federal income tax pursuant to §501(c) of the Internal Revenue Code.