Virginia Enacts Consumer Data Privacy Law

On 2 March, Virginia Governor Ralph Northam signed into law the Consumer Data Protection Act, making Virginia the second state after California to enact a data privacy law.

On 2 March, Virginia Governor Ralph Northam signed into law the Consumer Data Protection Act, making Virginia the second state after California to enact a data privacy law.

With the passage of the Consumer Data Protection Act, Virginia follows in California’s footsteps to protect the personal data privacy of its citizens. The law, going into effect 1 January 2023, will apply to all businesses that control or process the data of at least 100,000 consumers in Virginia or more than 50 percent gross revenue will be derived from the sale of personal data of 25,000 or more Virginians.

In 2018, California passed the California Consumer Privacy Act (CCPA), which grants California residents some of the same personal privacy rights found in the EU’s General Data Privacy Regulation (GDPR), such as the right to access, transfer, delete and object to the sale of their personal information. The Virginia Consumer Data Protection Act provides very similar protections. The California Consumer Privacy Act was followed by the California Privacy Rights Act in 2020 (CPRA), which updated as well as issued new regulations and specifications, such as the establishment of a Privacy Protection Agency.

While similar to California’s law, Virginia’s law lacks a private right of action, which means that the ability for individuals to sue on behalf of their personal data is limited, and the enforcement of the law is left in the hands of the state attorney general. However, this is a major step towards protecting the private data of consumers, which has gained popularity across the country. New York, Oklahoma, Utah and Wyoming are currently weighing their own proposals.