Virginia passes consumer data protection law

Eastern state follows California in offering consumers opt-out for data processing

Virginia Capitol Building

Yesterday, Virginia became the second state to pass a consumer data protection law, forcing companies to give consumers the right to opt out of data collection. Governor Ralph Northam signed the Consumer Data Protection Act into law on Tuesday. 

The law, which Virginia's General Assembly passed last month, allows consumers to confirm whether a company is holding their data and access it using an automated system. The system allows them to retrieve it in a portable format, making it possible to send it to another company. 

Users can amend inaccuracies in the data or force the company to delete it altogether. They can also prevent companies from using the data for marketing or other purposes.

Companies must respond to consumer requests within 45 days but may extend that period by an additional 45 days based on request complexity, as long as they inform the individual and explain the delay. The company must fulfill up to two free annual requests from an individual, but they may charge for additional requests.

Organizations must disclose what they'll use an individual's data for and must limit their personal data collection to those purposes. They must also explain which third parties they'll share the data with and what they'll do with it.

Related Resource

Edge-enabled mobility of the future

Turning vehicle data into value

How to turn vehicle data into value - whitepaper from EquinixDownload now

Consumers can opt out of personal data collection and the sale of data to third parties. However, the company can choose not to offer consumers goods or services if it needs the opted-out data to provide the service.

The law, which goes into effect on January 1, 2023, affects companies holding personal data for at least 100,000 consumers or those holding at least 25,000 individuals’ personal data and make more than half their income selling that data. 

Companies violating the law face civil penalties of up to $7,500 per affected individual, but they can escape those penalties if they fix the problem within 30 days of Virginia notifying them. All penalties collected will go to a Consumer Privacy Fund established by Virginia, which will support enforcement of the Act.

The Act doesn’t define new data breach notification rules, instead referring to existing rules in the state's legal code.

The legislation now goes to Virginia's Joint Commission on Technology and Science to evaluate how to implement it and release a study by November.

This is the second such law to pass in the US. California's approval of the California Consumer Protection Act (CCPA) went into effect last year. There’s still no cohesive federal consumer data protection law, which four in five Americans want.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

Facebook bans Signal's crafty anti-tracking ad campaign
data protection

Facebook bans Signal's crafty anti-tracking ad campaign

5 May 2021
BigID launches freemium privacy management tool for SMBs
data protection

BigID launches freemium privacy management tool for SMBs

26 Apr 2021
Taiwan’s TSMC plans five additional US-based chip plants
Hardware

Taiwan’s TSMC plans five additional US-based chip plants

4 May 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021
Dell patches vulnerability affecting hundreds of computer models worldwide
cyber security

Dell patches vulnerability affecting hundreds of computer models worldwide

5 May 2021