Skip to content

Virginia Consumer Data Protection Act

Article by Tsaaro

7 min read

What is the Consumer Data Protection Act passed by Virginia?

  • The CDPA draws its substance from existing Privacy Act and California Consumer Privacy Act.

Who does it apply to?

  • Entities which conduct business in Virginia or produce products or services that are targeted to Virginia residents. Which businesses fall under these criteria?
    • Those which control or process the personal data of at least 100,000 consumers during a calendar year.
    • Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.

How is CDPA different from CCPA?

  • No revenue threshold: even large businesses will not fall under its scope unless they meet the above criteria.
  • Threshold of data processed is higher: double the number of residents should be data subjects for CDPA to apply.
  • No time limits or formats regarding disclosures.
  • Consideration for sale of data must be in terms of money. Sale of data explicitly excludes:
    • Disclosures to processors, third parties for a product or service, controller’s affiliates, information that consumers themselves made available to a mass audience, as a part of a M&A transaction.

CPRA v/s CDPA?

  • Employee data not included in CDPA: omits a person from the definition of a consumer where they are acting in a commercial or employment context.

What is the scope of personal data?

  • Excludes deidentified or publicly available data. These operate on two levels under the CDPA:
    • Entity level exemptions:
      • Virginian authorities, political subdivision
      • Financial institutions
      • Entity/ business subject to Health Insurance Portability and Accountability Act.
      • A non profit organization
      • Higher education institution
    • Data level exemptions: these are broadly of 14 types including information regulated under:
      • Fair Credit Reporting Act
      • Drivers Privacy Protection Act
      • Farm Credit Act
      • Family Educational Rights and Privacy Act

What are the rights of the consumers?

  • Right to access and confirm the processing of personal data
  • Right to correct inaccuracies in personal data
  • Right to delete personal data
  • Right to data portability and to transmit the data to another controller without hindrance
  • Right to opt out of the processing of personal data (like targeted Ads, sale of data). There is no exception in favour of the businesses in this right.
  • Right to appeal a business’s denial to act reasonably.

What are business’ obligations?

  • Limits on collection: adequate, relevant and reasonably necessary in relation to the purposes
  • Limits on use: to not process personal data for purposes that are not disclosed, unless the controller obtains the consumer’s consent
  • Technical safeguards: to maintain reasonable technical data security practices to protect the confidentiality, integrity, and accessibility of personal data
  • Data Protection Assessments: conduct and evaluate the risks associated with processing activities
  • Data processing agreements: must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.
  • Privacy Policy: must state the following:
    • Categories of personal data processed and/or shared with third parties
    • Purpose of processing data
    • Consumer’s rights and methods of appeal

How does the enforcement work?

  • No private right of action given: the enforcement largely depends on the attorney general.
  • The controller has 30 days to act upon the violation ad provide the AG with a written statement to that effect
    • Failure to do so will attract a penalty of $7,500 per violation.

645 thoughts on “Virginia Consumer Data Protection Act”

  1. Fantastic perspective! The points you made are thought-provoking. For additional insights, check out this link: FIND OUT MORE. What do others think about this?

Leave a Reply

Your email address will not be published. Required fields are marked *

Tsaaro Consulting

“It was invigorating to have a new competitor… DeepSeek’s model is impressive, particularly around what they’re able to deliver for …

Tsaaro Consulting

Introduction The Digital Personal Data Protection Act 2023 (DPDP Act) provides that consent is a prerequisite to process the personal …

Tsaaro Consulting

The Digital Personal Data Protection (DPDP) Act, 2023, introduces an overall approach to the protection of the digital personal data …

Tsaaro Consulting

Today, personal data has become one of the most valuable resources, powering industries and shaping digital economies. However, the misuse …

Tsaaro Consulting

Introduction: Data protection laws worldwide empower individuals, referred to as ‘Data Subjects’ under the GDPR or ‘Data Principals’ under India’s …

Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.