Scarinci Hollenbeck, LLC, LLCScarinci Hollenbeck, LLC, LLC

Firm Insights

Does Your Business Need to Comply with Virginia’s New Data Privacy Law?

Author: Scarinci Hollenbeck, LLC

Date: June 3, 2021

Key Contacts

Back
Does Your Business Need to Comply with Virginia’s New Data Privacy Law?

Virginia has recently joined the growing list of states with their own comprehensive data privacy laws...

Virginia has recently joined the growing list of states with their own comprehensive data privacy laws. The Consumer Data Protection Act (CDPA), which incorporates elements of the European Union’s General Data Protection Regulation (GDPR), as well as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), will go into effect on January 1, 2023.

Covered Businesses and Data

The requirements set forth in the CPRA apply to entities that conduct business in Virginia or produce products or services that are targeted to Virginia residents and that either:

  • Control or process the personal data of at least 100,000 consumers during a calendar year.
  • Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.

The term “controller” is used to refer to entities that, alone or jointly with others, determine the purpose and means of processing personal data. The following entities are exempt under the CPRA, even if they meet the above requirements:

  • A body, authority, board, bureau, commission, district, or Virginian agency or any Virginian political subdivision;
  • Any financial institution or data subject to the Gramm-Leach-Bliley Act;
  • A covered entity or business subject to the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act;
  • A nonprofit organization; or
  • An institution of higher education.

“Consumer” is defined as “a natural person who is a resident of the Commonwealth acting only in an individual or household context.” Unlike other privacy laws, the CPRA expressly excludes those who are “acting in a commercial or employment context.” Accordingly, the law generally does not apply to employee relations or business-to-business transactions.

The CPRA defines “personal data” as “any information that is linked or reasonably linkable to an identified or identifiable natural person.

Consumer Privacy Rights

The CPRA establishes several personal data rights. Consumers may invoke the following rights by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke:

  • To confirm whether or not a controller is processing the consumer’s personal data and to access such personal data;
  • To correct inaccuracies in the consumer’s personal data, taking into account the nature of the data and the purposes of the processing of the consumer’s personal data;
  • To delete personal data provided by or obtained about the consumer;
  • To obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
  • To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Controllers must respond to a consumer request without undue delay, but in all cases within 45 days of receipt of the request. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension. Information provided in response to a consumer request must be provided by a controller free of charge, up to twice annually per consumer.

Controller Responsibilities

The CDPA also imposes several additional responsibilities on data controllers. To start, controllers must provide consumers with a “reasonably accessible, clear, and meaningful” privacy notice that includes: the categories of personal data processed by the controller; the purpose for processing personal data; how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request; the categories of personal data that the controller shares with third parties, if any; and the categories of third parties, if any, with whom the controller shares personal data. Data controllers must also:

  • Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer;
  • Except as otherwise provided in the law, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer’s consent;
  • Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices must be appropriate to the volume and nature of the personal data at issue;
  • Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers; and
  • Not process sensitive data concerning a consumer without obtaining the consumer’s consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children’s Online Privacy Protection Act

If a controller sells personal data to third parties or processes personal data for targeted advertising,  the controller must clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing. Controllers must also establish, and describe in a privacy notice, one or more secure and reliable means for consumers to submit a request to exercise their consumer rights.

Enforcement

The CDPA does not include a private right of action. However, it does authorize the state attorney general to enforce the law and seek penalties of up to $7,500 per violation. Notably, the Virginia privacy law also includes a right to cure–­­upon discovering a potential CDPA violation, the attorney general must provide the data controller written notice and allow the data controller 30 days to cure the alleged violation prior to filing suit.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, David Einhorn, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Scarinci Hollenbeck, LLC, LLC

Related Posts

See all
How Understanding Bankruptcy Trends Can Benefit Your Business post image

How Understanding Bankruptcy Trends Can Benefit Your Business

The bankruptcy legal landscape presents both challenges and opportunities for businesses navigating financial distress. Understanding current bankruptcy trends can help businesses make more informed and strategic decisions. Corporate Bankruptcy Filings Trending Upwards Bankruptcy filings continued to trend upwards in 2024. According to statistics released by the Administrative Office of the U.S. Courts, personal and business […]

Author: Brian D. Spector

Link to post with title - "How Understanding Bankruptcy Trends Can Benefit Your Business"
SEC Takes Actions Against Issuers for Failure to File Form D post image

SEC Takes Actions Against Issuers for Failure to File Form D

In December, the U.S. Securities and Exchange Commission (SEC) announced charges against two privately held companies for failing to file a Form D notice, which is generally utilized for exempt securities offerings. Here, the SEC’s enforcement sends a strong message: compliance with regulatory requirements is not optional and failure to comply can have significant consequences. […]

Author: Kenneth C. Oh

Link to post with title - "SEC Takes Actions Against Issuers for Failure to File Form D"
Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda post image

Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda

On February 14, 2025, the Office of General Counsel (OGC) of the National Labor Relations Board (NLRB) under Acting General Counsel William B. Cowen issued Memorandum 25-05, “New Process for More Efficient, Effective, Accessible and Transparent Case handling.” The Memorandum rescinds nearly all of the Memoranda issued by his direct predecessor, Jennifer Abruzzo, setting the […]

Author: Matthew F. Mimnaugh

Link to post with title - "Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda"
What Are FIRPTA Withholding Requirements? post image

What Are FIRPTA Withholding Requirements?

If you purchase real property from a foreign person or entity, you may be required to withhold taxes from your payment to the seller under the Foreign Investment in Real Property Tax Act (FIRPTA). The federal tax law is designed to ensure that foreign sellers pay any applicable capital gains tax on profits realized from […]

Author: Jesse M. Dimitro

Link to post with title - "What Are FIRPTA Withholding Requirements?"
Does Your Homeowners Insurance Provide Adequate Coverage? post image

Does Your Homeowners Insurance Provide Adequate Coverage?

Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]

Author: Jesse M. Dimitro

Link to post with title - "Does Your Homeowners Insurance Provide Adequate Coverage?"
Understanding the Importance of a Non-Contingent Offer post image

Understanding the Importance of a Non-Contingent Offer

Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]

Author: Jesse M. Dimitro

Link to post with title - "Understanding the Importance of a Non-Contingent Offer"

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Sign up to get the latest from our attorneys!

Explore What Matters Most to You.

Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.

Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.

Let`s get in touch!

* The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship. Confidential or time-sensitive information should not be sent through this form.

Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!

Please select a category(s) below: