Does Your Business Need to Comply with Virginia’s New Data Privacy Law?

Virginia has recently joined the growing list of states with their own comprehensive data privacy laws...

Virginia has recently joined the growing list of states with their own comprehensive data privacy laws. The Consumer Data Protection Act (CDPA), which incorporates elements of the European Union’s General Data Protection Regulation (GDPR), as well as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), will go into effect on January 1, 2023.

Covered Businesses and Data

The requirements set forth in the CPRA apply to entities that conduct business in Virginia or produce products or services that are targeted to Virginia residents and that either:

• Control or process the personal data of at least 100,000 consumers during a calendar year.
• Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.

The term “controller” is used to refer to entities that, alone or jointly with others, determine the purpose and means of processing personal data. The following entities are exempt under the CPRA, even if they meet the above requirements:

• A body, authority, board, bureau, commission, district, or Virginian agency or any Virginian political subdivision;
• Any financial institution or data subject to the Gramm-Leach-Bliley Act;
• A covered entity or business subject to the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act;
• A nonprofit organization; or
• An institution of higher education.

“Consumer” is defined as “a natural person who is a resident of the Commonwealth acting only in an individual or household context.” Unlike other privacy laws, the CPRA expressly excludes those who are “acting in a commercial or employment context.” Accordingly, the law generally does not apply to employee relations or business-to-business transactions.

The CPRA defines “personal data” as “any information that is linked or reasonably linkable to an identified or identifiable natural person.

Consumer Privacy Rights

The CPRA establishes several personal data rights. Consumers may invoke the following rights by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke:

• To confirm whether or not a controller is processing the consumer’s personal data and to access such personal data;
• To correct inaccuracies in the consumer’s personal data, taking into account the nature of the data and the purposes of the processing of the consumer’s personal data;
• To delete personal data provided by or obtained about the consumer;
• To obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
• To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Controllers must respond to a consumer request without undue delay, but in all cases within 45 days of receipt of the request. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension. Information provided in response to a consumer request must be provided by a controller free of charge, up to twice annually per consumer.

Controller Responsibilities

The CDPA also imposes several additional responsibilities on data controllers. To start, controllers must provide consumers with a “reasonably accessible, clear, and meaningful” privacy notice that includes: the categories of personal data processed by the controller; the purpose for processing personal data; how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request; the categories of personal data that the controller shares with third parties, if any; and the categories of third parties, if any, with whom the controller shares personal data. Data controllers must also:

• Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer;
• Except as otherwise provided in the law, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer’s consent;
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices must be appropriate to the volume and nature of the personal data at issue;
• Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers; and
• Not process sensitive data concerning a consumer without obtaining the consumer’s consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children’s Online Privacy Protection Act

If a controller sells personal data to third parties or processes personal data for targeted advertising,  the controller must clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing. Controllers must also establish, and describe in a privacy notice, one or more secure and reliable means for consumers to submit a request to exercise their consumer rights.

Enforcement

The CDPA does not include a private right of action. However, it does authorize the state attorney general to enforce the law and seek penalties of up to $7,500 per violation. Notably, the Virginia privacy law also includes a right to cure–­­upon discovering a potential CDPA violation, the attorney general must provide the data controller written notice and allow the data controller 30 days to cure the alleged violation prior to filing suit.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, David Einhorn, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.