Skip to content
Schedule a Call
Call Now

Virginia Consumer Data Protection Act

Article by Tsaaro

7 min read

Virginia Consumer Data Protection Act

What is the Consumer Data Protection Act passed by Virginia?

  • The CDPA draws its substance from existing Privacy Act and California Consumer Privacy Act.

Who does it apply to?

  • Entities which conduct business in Virginia or produce products or services that are targeted to Virginia residents. Which businesses fall under these criteria?
    • Those which control or process the personal data of at least 100,000 consumers during a calendar year.
    • Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.

How is CDPA different from CCPA?

  • No revenue threshold: even large businesses will not fall under its scope unless they meet the above criteria.
  • Threshold of data processed is higher: double the number of residents should be data subjects for CDPA to apply.
  • No time limits or formats regarding disclosures.
  • Consideration for sale of data must be in terms of money. Sale of data explicitly excludes:
    • Disclosures to processors, third parties for a product or service, controller’s affiliates, information that consumers themselves made available to a mass audience, as a part of a M&A transaction.

CPRA v/s CDPA?

  • Employee data not included in CDPA: omits a person from the definition of a consumer where they are acting in a commercial or employment context.

What is the scope of personal data?

  • Excludes deidentified or publicly available data. These operate on two levels under the CDPA:
    • Entity level exemptions:
      • Virginian authorities, political subdivision
      • Financial institutions
      • Entity/ business subject to Health Insurance Portability and Accountability Act.
      • A non profit organization
      • Higher education institution
    • Data level exemptions: these are broadly of 14 types including information regulated under:
      • Fair Credit Reporting Act
      • Drivers Privacy Protection Act
      • Farm Credit Act
      • Family Educational Rights and Privacy Act

What are the rights of the consumers?

  • Right to access and confirm the processing of personal data
  • Right to correct inaccuracies in personal data
  • Right to delete personal data
  • Right to data portability and to transmit the data to another controller without hindrance
  • Right to opt out of the processing of personal data (like targeted Ads, sale of data). There is no exception in favour of the businesses in this right.
  • Right to appeal a business’s denial to act reasonably.

What are business’ obligations?

  • Limits on collection: adequate, relevant and reasonably necessary in relation to the purposes
  • Limits on use: to not process personal data for purposes that are not disclosed, unless the controller obtains the consumer’s consent
  • Technical safeguards: to maintain reasonable technical data security practices to protect the confidentiality, integrity, and accessibility of personal data
  • Data Protection Assessments: conduct and evaluate the risks associated with processing activities
  • Data processing agreements: must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.
  • Privacy Policy: must state the following:
    • Categories of personal data processed and/or shared with third parties
    • Purpose of processing data
    • Consumer’s rights and methods of appeal

How does the enforcement work?

  • No private right of action given: the enforcement largely depends on the attorney general.
  • The controller has 30 days to act upon the violation ad provide the AG with a written statement to that effect
    • Failure to do so will attract a penalty of $7,500 per violation.

269 thoughts on “Virginia Consumer Data Protection Act”

Leave a Reply

Your email address will not be published. Required fields are marked *

Consent
Consent: The Cornerstone of Data Privacy
Tsaaro Consulting

Consent: The Cornerstone of Data Privacy

Consent is the cornerstone of data privacy. Any individual should have the opportunity to make choices about their personal data …

•
December 30, 2024
WhatsApp ruling
CCI’S WHATSAPP RULING: WHY IS IT SIGNIFICANT FOR PRIVACY? 
Tsaaro Consulting

CCI’S WHATSAPP RULING: WHY IS IT SIGNIFICANT FOR PRIVACY? 

INTRODUCTION: In a recent ruling, the Competition Commission of India (CCI) has slapped a heavy fine of 213.14 crore on …

•
December 18, 2024
STAFF AUGMENTATION SERVICES
HOW TO AVOID COMMON PITFALLS WHEN USING STAFF AUGMENTATION SERVICES
Tsaaro Consulting

HOW TO AVOID COMMON PITFALLS WHEN USING STAFF AUGMENTATION SERVICES

In today’s dynamic and fast-paced corporate environment businesses are increasingly adopting staff augmentation as a flexible workforce solution to address …

•
December 11, 2024
Staff Augmentation Consulting
Staff Augmentation Consulting: A Cost-Effective Solution for Scaling Your Workforce
Tsaaro Consulting

Staff Augmentation Consulting: A Cost-Effective Solution for Scaling Your Workforce

In today’s fast-paced business environment, organisations are constantly seeking innovative methods to adapt and scale efficiently. Staff Augmentation Consulting services, …

•
December 6, 2024
Cross-Border Data Transferes
ENSURING SAFE CROSS-BORDER DATA TRANSFERS: A GUIDE TO TRANSFER IMPACT ASSESSMENTS
Tsaaro Consulting

ENSURING SAFE CROSS-BORDER DATA TRANSFERS: A GUIDE TO TRANSFER IMPACT ASSESSMENTS

INTRODUCTION: In today’s interconnected world, businesses operate across borders, serving customers globally. This inevitably leads to the transfer of personal …

•
December 4, 2024
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

ATS Bouquet, Noida Sector – 132, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.