In January 2008, HB 1007 was introduced before the Virginia General Assembly. The bill exempts the Virginia Fusion Intelligence Center (Virginia Fusion Center) – and other Commonwealth agencies assigned to the Virginia Fusion Center – from Virginia privacy and government transparency laws. The bill includes an anti-whistleblower provision and would also prevent the enforcement of privacy rights established by Virginia courts. The Virginia Fusion Center is one of several similar entities established by state governments throughout the United States. HB 1007 was passed by the Virginia Assembly on March 8, 2008, and subsequently signed by the Governor.
HB 1007 adds two sections (Section 52-48 and Section 52-49) to Chapter 11 of the Virginia Code. Section 52-48(A) exempts the Virginia Fusion Center from the government transparency requirements set forth in the Virginia Freedom of Information Act, as well as the privacy provisions set forth in the Virginia Government Data Collections and Disseminations Practices Act. Section 52-48(B) shields Virginia employees connected to the Virginia Fusion Center from subpoena. Sections 52-48(C)-(D) bar individuals from disclosing any information received from the Virginia Fusion Center, and impose criminal penalties for disclosure. Section 52-49 eliminates several long-standing civil rights of action (e.g. defamation and invasion of privacy) for citizens harmed by information provided to the Virginia Fusion Center.
The Virginia Freedom of Information Act (FOIA) states that its purpose is to “ensure the people of the Commonwealth ready access to public records in the custody of a public body or its officers and employees, and free entry to meetings of public bodies wherein the business of the people is being conducted.” The Virginia FOIA recognizes that “[t]he affairs of government are not intended to be conducted in an atmosphere of secrecy since at all times the public is to be the beneficiary of any action taken at any level of government.” The Virginia FOIA sets forth procedures for “ensuring the people of the Commonwealth ready access to public records.” By exempting the Virginia Fusion Center from the Virginia FOIA, HB 1007 guarantees that the affairs of the Virginia Fusion Center will be “conducted in an atmosphere of secrecy.”
The Virginia Government Data Collections and Disseminations Practices Act recognizes that “[a]n individual’s privacy is directly affected by the extensive collection, maintenance, use and dissemination of personal information,” “[t]he increasing use of computers and sophisticated information technology has greatly magnified the harm that can occur from these practices,” and “[a]n individual’s opportunities to secure employment, insurance, credit, and his right to due process, and other legal protections are endangered by the misuse of certain of these personal information systems.” Moreover, the statute “preserve[s] the rights guaranteed a citizen in a free society” by “establish[ing] procedures to govern [government] information systems containing records on individuals.” The Virginia Government Data Collections and Disseminations Practices Act bars “personal information system[s] whose existence is secret.” The statute also prohibits the use of inaccurate information, prohibits the misuse of personal information, prevents “personal information collected for one purpose from being used for another purpose,” and provides procedures for citizens to “learn the purpose for which information has been recorded and particulars about its use and dissemination.” By exempting the Virginia Fusion Center from the Virginia Government Data Collections and Disseminations Practices Act, HB 1007 removes these statutory privacy protections from personal information collected by the Virginia Fusion Center.
The Virginia Fusion Center
Fusion centers are intelligence databases that collect information on ordinary citizens. They have raised substantial privacy concerns. Federal guidelines call for fusion centers to accumulate and retain information about citizens from a wide range of public and private sources. Such information includes, but is not limited to: financial records, credit reports, medical records, internet and email data, video surveillance from retail stores and sporting facilities, data from preschools, and welfare records. The Virginia Fusion Center’s operations involve contact with federal agencies and federal programs. Press reports and statements from Virginia officials have raised questions about federal involvement in the Virginia legislation. Shortly after HB 1007 was introduced, the Virginia Fusion Center’s administrative head implied that federal policies might have been the impetus for HB 1007, but did not provide further details. For more information about fusion centers, see EPIC’s page: Information Fusion Centers and Privacy.
EPIC’s Virginia FOIA Requests and Subsequent Lawsuit
On February 12, 2008, EPIC filed Virginia FOIA requests with the Virginia Department of State Police (the VSP) for public records that directly relate to alleged federal government involvement with HB 1007. EPIC requested the following public records:
all correspondence, communications, and records of meetings between the VSP and the U.S. Department of Homeland Security concerning the Virginia Fusion Center, including funding, development, and impact on the Virginia Freedom of Information Act and the Virginia Collections and Disseminations Practices Act;all correspondence, communications, and records of meetings between the VSP and the U.S. Department of Justice concerning the Virginia Fusion Center, including funding, development, and impact on the Virginia Freedom of Information Act and the Virginia Collections and Disseminations Practices Act; and
all correspondence, communications, and records of meetings between the VSP and the Institute for Intergovernmental Research concerning the Virginia Fusion Center, including funding, development, and impact on the Virginia Freedom of Information Act and the Virginia Collections and Disseminations Practices Act.
EPIC urged the VSP to provide the requested public records as soon as possible because of the public records’ relevance to the Virginia General Assembly’s consideration of (then-pending) HB 1007 – a bill that, if passed, would impact the rights of Virginia residents. On February 19, 2008, the VSP sent a letter to EPIC. The letter acknowledged the VSP’s receipt of EPIC’s public records requests, and further stated that the VSP would not disclose any public records in response. On March 21, 2008, EPIC filed a lawsuit under the Virginia Freedom of Information Act challenging the VSP’s failure to disclose public records and failure to comply with the Virginia Freedom of Information Act.
Documents Obtained by EPIC Through Its Lawsuit
EPIC v. the Virginia Department of State Police, et al., Case No. 08-01357 (Va. Gen. Dist. Ct. filed March 12, 2008)