VIRGINIA CONSUMER DATA PROTECTION ACT PASSED
April 12, 2021
On March 2, 2021, the Governor Ralph Northam signed into law the Virginia Consumer Data Protection Act (“VCDPA”), available here, which will become effective January 1, 2023. This follows the EU’s General Data Protection Regulation (GDPR) passed in 2018 and the California Consumer Privacy Act (“CCPA”) which became effective in January of 2020, both enacted to provide additional protection for consumers by limiting how business can use and must protect consumer’s personal data. The following are some of the key features of this law:
- The VCDPA only applies to businesses (referred to as “Controllers”) that either: i) control or process Personal Data of at least 100,000 “Consumers”; or ii) derive over 50% of gross revenue from the sale of Personal Data and control or process Personal Data of at least 25,000 Consumers;
- Controllers must provide Consumers with at least one secure, reliable method to invoke the consumer rights, which includes confirmation of, access to, and deletion of personal data in certain circumstances, and the ability to opt out of certain processing of their Personal Data;
- Controllers must limit the collection of consumer personal data to only that which is “adequate, relevant and reasonably necessary” for the disclosed processing purposes, and must establish a process for Consumers to appeal a denial of a rights request;
- Controllers must provide consumers with a privacy notice addressing the categories and purposes of personal data collected by the Controller, how Consumers may exercise their rights, and what personal data shared is with third parties;
- Controllers must conduct and document Data Protection Assessments when performing certain types of processing;
- Controllers must enter into agreements with data “Processors” that clearly set forth instructions for processing Personal Data;
- Controllers must obtain Consumers’ consent before processing “Sensitive Data;”
Businesses will have 30 days to cure any violation after notice from the VA Attorney General, after which they could be subject to a $7,500 penalty for each violation. Finally, businesses should understand that compliance with the GDPR and CCPA will not ensure compliance with the VCDPA. While all three have many similar provisions, they are not identical, so special care must be taken to ensure proper compliance with the provisions of each.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com or 202-659-6622); Drew Derco (dderco@eckertseamans.com or 202-659-6665), or Andy Orr (aorr@eckertsemans.com or 202-659-6625).
Share This Post
Authors
