Be it enacted by the General Assembly of Virginia:

1. That §46.2-208 of the Code of Virginia is amended and reenacted as follows:

§46.2-208. Records of Department; when open for inspection; release of privileged information.

A. The following information shall be considered privileged and unless otherwise provided for in this title shall not be released except as provided in subsection B:

1. Personal information as defined in §2.2-3801;

2. Driver information, defined as all data that relates to driver's license status and driver activity;

3. Special identification card information, defined as all data that relates to identification card status; and

4. Vehicle information, including all descriptive vehicle data and title, registration, and vehicle activity data, but excluding crash data.

B. The Commissioner shall release such information only under the following conditions:

1. Notwithstanding other provisions of this section, medical information included in personal information shall be released only to a physician, physician assistant, or nurse practitioner in accordance with a proceeding under §§46.2-321 and 46.2-322.

2, 3. [Repealed.]

4. Upon the request of (i) the subject of the information, (ii) the parent of a minor who is the subject of the information, (iii) the guardian of the subject of the information, (iv) the authorized agent or representative of the subject of the information, or (v) the owner of the vehicle that is the subject of the information, the Commissioner shall provide him with the requested information and a complete explanation of it. Requests for such information need not be made in writing or in person and may be made orally or by telephone, provided that the Department is satisfied that there is adequate verification of the requester's identity. When so requested in writing by (a) the subject of the information, (b) the parent of a minor who is the subject of the information, (c) the guardian of the subject of the information, (d) the authorized agent or representative of the subject of the information, or (e) the owner of the vehicle that is the subject of the information, the Commissioner shall verify and, if necessary, correct the personal information provided and furnish driver, special identification card, or vehicle information. If the requester is requesting such information in the scope of his official business as counsel from a public defender's office or as counsel appointed by a court, such records shall be provided free of charge.

5. Upon the written request of any insurance carrier or surety, or authorized agent of either, the Commissioner shall furnish to such requester information in the record of any person subject to the provisions of this title. The transcript shall include any record of any conviction of a violation of any provision of any statute or ordinance relating to the operation or ownership of a motor vehicle or of any injury or damage in which he was involved and a report filed pursuant to §46.2-373. No such report of any conviction or crash shall be made after 60 months from the date of the conviction or crash unless the Commissioner or court used the conviction or crash as a reason for the suspension or revocation of a driver's license or driving privilege, in which case the revocation or suspension and any conviction or crash pertaining thereto shall not be reported after 60 months from the date that the driver's license or driving privilege has been reinstated. The response of the Commissioner under this subdivision shall not be admissible in evidence in any court proceedings.

6. Upon the written request of any business organization or its authorized agent, in the conduct of its business, the Commissioner shall compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records. Personal information provided under this subdivision shall be used solely for the purpose of pursuing remedies that require locating an individual.

7. Upon the written request of any business organization or its authorized agent, the Commissioner shall provide vehicle information to the requester. Disclosures made under this subdivision shall not include any personal information, driver information, or special identification card information and shall not be subject to the limitations contained in subdivision 6.

8. Upon the written request of any motor vehicle rental or leasing company or its authorized agent, the Commissioner shall (i) compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records and (ii) provide the requester with driver information of any person subject to the provisions of this title. Such information shall include any record of any conviction of a violation of any provision of any statute or ordinance relating to the operation or ownership of a motor vehicle or of any injury or damage in which the subject of the information was involved and a report of which was filed pursuant to §46.2-373. No such information shall include any record of any conviction or crash more than 60 months after the date of such conviction or crash unless the Commissioner or court used the conviction or crash as a reason for the suspension or revocation of a driver's license or driving privilege, in which case the revocation or suspension and any conviction or crash pertaining thereto shall cease to be included in such information after 60 months from the date on which the driver's license or driving privilege was reinstated. The response of the Commissioner under this subdivision shall not be admissible in evidence in any court proceedings.

9. Upon the request of any federal, state, or local governmental entity, local government group self-insurance pool, law-enforcement officer, attorney for the Commonwealth, or court, or the authorized agent of any of the foregoing, the Commissioner shall compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records. The Commissioner shall also provide driver, special identification card, and vehicle information as requested pursuant to this subdivision. The Commissioner may release other appropriate information to the governmental entity upon request. Upon request in accordance with this subdivision, the Commissioner shall furnish a certificate, under seal of the Department, setting forth a distinguishing number or license plate of a motor vehicle, trailer, or semitrailer, together with the name and address of its owner. The certificate shall be prima facie evidence in any court in the Commonwealth of the ownership of the vehicle, trailer, or semitrailer to which the distinguishing number or license plate has been assigned by the Department. However, the Commissioner shall not release any photographs pursuant to this subdivision unless the requester provides the depicted individual's name and other sufficient identifying information contained on such individual's record. The information in this subdivision shall be provided free of charge.

The Department shall release to a requester information that is required for a requester to carry out the requester's official functions in accordance with this subdivision. If the requester has entered into an agreement with the Department, such agreement shall be in a manner prescribed by the Department, and such agreement shall contain the legal authority that authorizes the performance of the requester's official functions and a description of how such information will be used to carry out such official functions. If the Commissioner determines that sufficient authority has not been provided by the requester to show that the purpose for which the information shall be used is one of the requester's official functions, the Commissioner shall refuse to enter into any agreement. If the requester submits a request for information in accordance with this subdivision without an existing agreement to receive the information, the request shall be in a manner prescribed by the Department, and such request shall contain the legal authority that authorizes the performance of the requester's official functions and a description of how such information will be used to carry out such official functions. If the Commissioner determines that sufficient authority has not been provided by the requester to show that the purpose for which such information shall be used is one of the requester's official functions, the Commissioner shall deny such request.

Notwithstanding the provisions of this subdivision, the Department shall not disseminate to any federal, state, or local government entity, law-enforcement officer, or law-enforcement agency any privileged information for any purposes related to civil immigration enforcement unless (i) the subject of the information provides consent or (ii) the requesting agency presents a lawful judicial order, judicial subpoena, or judicial warrant. When responding to a lawful judicial order, judicial subpoena, or judicial warrant, the Department shall disclose only those records or information specifically requested. Within three business days of receiving a request for information for the purpose of civil immigration enforcement, the Commissioner shall send a notification to the individual about whom such information was requested that such a request was made and the identity of the entity that made such request.

The Department shall not enter into any agreement pursuant to subsection E with a requester pursuant to this subdivision unless the requester certifies that the information obtained will not be used for civil immigration purposes or knowingly disseminated to any third party for any purpose related to civil immigration enforcement.

10. Upon the request of the driver licensing authority in any foreign country, the Commissioner shall provide whatever driver and vehicle information the requesting authority shall require to carry out its official functions. The information shall be provided free of charge.

11. a. For the purpose of obtaining information regarding noncommercial driver's license holders, upon the written request of any employer, prospective employer, or authorized agent of either, and with the written consent of the individual concerned, the Commissioner shall (i) compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records and (ii) provide the requester with driver information in the form of a transcript of an individual's record, including all convictions, all crashes, any type of driver's license that the individual currently possesses, and all driver's license suspensions, revocations, cancellations, or forfeiture, provided that such individual's position or the position that the individual is being considered for involves the operation of a motor vehicle.

b. For the purpose of obtaining information regarding commercial driver's license holders, upon the written request of any employer, prospective employer, or authorized agent of either, the Commissioner shall (i) compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records and (ii) provide the requester with driver information in the form of a transcript of such individual's record, including all convictions, all crashes, any type of driver's license that the individual currently possesses, and all driver's license suspensions, revocations, cancellations, forfeitures, or disqualifications, provided that such individual's position or the position that the individual is being considered for involves the operation of a commercial motor vehicle.

12. Upon the written request of any member of a volunteer fire company or volunteer emergency medical services agency and with written consent of the individual concerned, or upon the request of an applicant for membership in a volunteer fire company or to serve as volunteer emergency medical services personnel, the Commissioner shall (i) compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records and (ii) provide driver information in the form of a transcript of the individual's record, including all convictions, all crashes, any type of driver's license that the individual currently possesses, and all license suspensions, revocations, cancellations, or forfeitures. Such transcript shall be provided free of charge if the request is accompanied by appropriate written evidence that the person is a member of or applicant for membership in a volunteer fire company or a volunteer emergency medical services agency and the transcript is needed by the requester to establish the qualifications of the member, volunteer, or applicant to operate equipment owned by the volunteer fire company or volunteer emergency medical services agency.

13. Upon the written request of a Virginia affiliate of Big Brothers Big Sisters of America, a Virginia affiliate of Compeer, or the Virginia Council of the Girl Scouts of the USA, and with the consent of the individual who is the subject of the information and has applied to be a volunteer with the requester, or on the written request of a Virginia chapter of the American Red Cross, a Virginia chapter of the Civil Air Patrol, or Faith in Action, and with the consent of the individual who is the subject of the information and applied to be a volunteer vehicle operator with the requester, the Commissioner shall (i) compare personal information supplied by the requester with that contained in the Department's records and, when the information supplied by the requester is different from that contained in the Department's records, provide the requester with correct information as contained in the Department's records and (ii) provide driver information in the form of a transcript of the applicant's record, including all convictions, all crashes, any type of driver's license that the individual currently possesses, and all license suspensions, revocations, cancellations, or forfeitures. Such transcript shall be provided at a fee that is one-half the normal charge if the request is accompanied by appropriate written evidence that the person has applied to be a volunteer or volunteer vehicle operator with the requester as provided in this subdivision.

14. On the written request of any person who has applied to be a volunteer with a court-appointed special advocate program pursuant to § 9.1-153, the Commissioner shall provide a transcript of the applicant's record, including all convictions, all crashes, any type of driver's license that the individual currently possesses, and all license suspensions, revocations, cancellations, or forfeitures. Such transcript shall be provided free of charge if the request is accompanied by appropriate written evidence that the person has applied to be a volunteer with a court-appointed special advocate program pursuant to §9.1-153.

15, 16. [Repealed.]

17. Upon the request of an attorney representing a person involved in a motor vehicle crash, the Commissioner shall provide the vehicle information for any vehicle involved in the crash and the name and address of the owner of any such vehicle.

18. Upon the request, in the course of business, of any authorized agent of an insurance company or of any not-for-profit entity organized to prevent and detect insurance fraud, or perform rating and underwriting activities, the Commissioner shall provide (i) all vehicle information, the owner's name and address, descriptive data and title, registration, and vehicle activity data, as requested, or (ii) the driver name, license number and classification, date of birth, and address information for each driver under the age of 22 licensed in the Commonwealth, provided that such request includes the driver's license number or address information of such driver. Use of such information shall be limited to use in connection with insurance claims investigation activities, antifraud activities, rating, or underwriting.

19. [Repealed.]

20. Upon the written request of the compliance agent of a private security services business, as defined in §9.1-138, which is licensed by the Virginia Department of Criminal Justice Services, the Commissioner shall provide the name and address of the owner of the vehicle under procedures determined by the Commissioner.

21. Upon the request of the operator of a toll facility, a traffic light photo-monitoring system acting on behalf of a government entity, or the Dulles Access Highway, or an authorized agent or employee of a toll facility operator or traffic light photo-monitoring system operator acting on behalf of a government entity or the Dulles Access Highway, for the purpose of obtaining vehicle owner data under subsection H of §15.2-968.1, subsection A of §33.2-504, subsection M of §46.2-819.1 or subsection H of § 15.2-968.1, subsection P of §46.2-819.3:1, or subsection N of § 46.2-819.5. Information released pursuant to this subdivision shall be limited to the name and, physical address, and, if available, email or other electronic address of the owner of the vehicle having failed to pay a toll or having failed to comply with a traffic light signal or having improperly used the Dulles Access Highway and the vehicle information, including all descriptive vehicle data and title and registration data of the same vehicle.

22-26. [Repealed.]

27. Upon the written request of the executor or administrator of a deceased person's estate, the Department shall, if the deceased person had been issued a driver's license or special identification card by the Department, supply the requester with a hard copy image of any photograph of the deceased person kept in the Department's records.

28. [Repealed.]

29. a. Upon written agreement, the Commissioner may digitally verify the authenticity and validity of a driver's license, learner's permit, or special identification card to the American Association of Motor Vehicle Administrators, a motor vehicle dealer as defined in §46.2-1500, or another organization approved by the Commissioner.

b. Upon written agreement, the Commissioner may release minimum information as needed in the Department's record through any American Association of Motor Vehicle Administrators service program created for the purpose of the exchange of information to any business, government agency, or authorized agent who would otherwise be authorized to receive the information requested pursuant to this section.

30. Upon the request of the operator of a video-monitoring system as defined in §46.2-844 acting on behalf of a government entity, the Commissioner shall provide vehicle owner data pursuant to subsection B of §46.2-844. Information released pursuant to this subdivision shall be limited to the name and address of the owner of the vehicle having passed a stopped school bus and the vehicle information, including all descriptive vehicle data and title and registration data for such vehicle.

31. Upon the request of the operator of a photo speed monitoring device as defined in §46.2-882.1 acting on behalf of a government entity, the Commissioner shall provide vehicle owner data pursuant to subsection B of §46.2-882.1. Information released pursuant to this subdivision shall be limited to the name and address of the owner of the vehicle having committed a violation of §46.2-873 or 46.2-878.1 and the vehicle information, including all descriptive vehicle data and title and registration data, for such vehicle.

32. Notwithstanding the provisions of this section other than subdivision 33, the Department shall not release, except upon request by the subject of the information, the guardian of the subject of the information, the parent of a minor who is the subject of the information, or the authorized agent of the subject of the information, or pursuant to a court order, (i) proof documents submitted for the purpose of obtaining a driving credential or a special identification card, (ii) the information in the Department's records indicating the type of proof documentation that was provided, or (iii) applications relating to the issuance of a driving credential or a special identification card. As used in this subdivision, "proof document" means any document not originally created by the Department that is submitted to the Department for the issuance of any driving credential or special identification card. "Proof document" does not include any information contained on a driving credential or special identification card.

33. Notwithstanding the provisions of this section, the Department may release the information in the Department's records that it deems reasonable and necessary for the purpose of federal compliance audits.

C. Information disclosed or furnished shall be assessed a fee as specified in §46.2-214, unless as otherwise provided in this section.

D. Upon the receipt of a completed application and payment of applicable processing fees, the Commissioner may enter into an agreement with any governmental authority or business to exchange information specified in this section by electronic or other means.

E. The Department shall not release any privileged information pursuant to this title unless the Department has entered into a written agreement authorizing such release. The Department shall require the requesting entity to specify the purpose authorized pursuant to this title that forms the basis for the request and provide the permissible purpose as defined under 18 U.S.C. §2721(b). Privileged information requested by an entity that has been altered or aggregated may be used only for the original purposes specified in the written agreement consistent with this title. The requesting entity shall disseminate privileged information only to third parties subject to the original purpose specified in the written agreement consistent with this title. Any agreement that does not allow third-party distribution shall include a statement that such distribution is prohibited. Such agreement may limit the scope of any authorized distribution consistent with this title. Privileged information distributed to any third party shall only be further distributed by such third party subject to the original purpose specified and consistent with this title, or unless such third party is the subject of the information, the parent of a minor who is the subject of the information, the guardian of the subject of the information, the authorized agent or representative of the subject of the information, or the owner of the vehicle that is the subject of the information.

Any agreement entered into pursuant to this subsection between the Department and the Department of State Police shall specify (i) that privileged information shall be distributed only to authorized personnel of an entity meeting the definition of a criminal justice agency as defined in § 9.1-101 and other comparable local, state, and federal criminal justice agencies and entities issued a Virginia S-Originating Agency Identification (S-ORI) status; (ii) that privileged information shall be accessed, used, and disseminated only for the administration of criminal justice as defined in § 9.1-101; and (iii) that no local, state, or federal government entity, through the Virginia Criminal Information Network (VCIN) or any other method of dissemination controlled by the Department of State Police, has access to information stored by the Department in violation of the protections contained in this section. The Department of State Police shall notify the Department prior to when a new entity is to be granted S-ORI status and provide a copy of the S-ORI application to the Department. The Department of State Police shall not allow any entity to access Department data through VCIN if the Department objects in writing to the entity obtaining such data.

The provisions of this subsection shall not apply to (a) requests for information made pursuant to subdivision B 4; (b) a request made by an entity authorized to receive privileged information pursuant to subsection B, provided that such request is made on a form provided by the Department, other than a written agreement, that requires the requester to certify that such entity is entitled to receive such information pursuant to this title, state the purpose authorized pursuant to subsection B that forms the basis for the request, explain why the information requested is necessary to accomplish the stated purpose, and certify that the information will be used only for the stated purpose and the information received shall not be disseminated to third parties unless there is authorization to do so; or (c) the release of information to a law-enforcement officer or agency during an emergency situation, provided that (1) the requesting entity is authorized to receive such information pursuant to subdivision B 9, (2) the timely release of such information is in the interest of public safety, and (3) the requesting entity completes the form required pursuant to clause (b) within 48 hours of the release of such information.

F. Any person that receives any privileged information that such person knows or has reason to know was received in violation of this title shall not disseminate any such information and shall notify the Department of the receipt of such privileged information.

G. The Department shall conduct audits annually based on a risk assessment to ensure that privileged information released by the Department pursuant to this title is being used as authorized by law and pursuant to the agreements entered into by the Department. If the Department finds that privileged information has been used in a manner contrary to law or the relevant agreement, the Department may revoke access.

H. Any request for privileged information by an authorized agent of a governmental entity shall be governed by the provisions of subdivision B 9.