Virginia Consumer Data Protection Act

What is the Consumer Data Protection Act passed by Virginia?

• The CDPA draws its substance from existing Privacy Act and California Consumer Privacy Act.

Who does it apply to?

• Entities which conduct business in Virginia or produce products or services that are targeted to Virginia residents. Which businesses fall under these criteria?
  • Those which control or process the personal data of at least 100,000 consumers during a calendar year.
  • Control or process the personal data of at least 25,000 consumers and derive at least 50% of its gross revenue from the sale of personal data.

How is CDPA different from CCPA?

• No revenue threshold: even large businesses will not fall under its scope unless they meet the above criteria.
• Threshold of data processed is higher: double the number of residents should be data subjects for CDPA to apply.
• No time limits or formats regarding disclosures.
• Consideration for sale of data must be in terms of money. Sale of data explicitly excludes:
  • Disclosures to processors, third parties for a product or service, controller’s affiliates, information that consumers themselves made available to a mass audience, as a part of a M&A transaction.

CPRA v/s CDPA?

• Employee data not included in CDPA: omits a person from the definition of a consumer where they are acting in a commercial or employment context.

What is the scope of personal data?

• Excludes deidentified or publicly available data. These operate on two levels under the CDPA:
  • Entity level exemptions:
    • Virginian authorities, political subdivision
    • Financial institutions
    • Entity/ business subject to Health Insurance Portability and Accountability Act.
    • A non profit organization
    • Higher education institution
  • Data level exemptions: these are broadly of 14 types including information regulated under:
    • Fair Credit Reporting Act
    • Drivers Privacy Protection Act
    • Farm Credit Act
    • Family Educational Rights and Privacy Act

What are the rights of the consumers?

• Right to access and confirm the processing of personal data
• Right to correct inaccuracies in personal data
• Right to delete personal data
• Right to data portability and to transmit the data to another controller without hindrance
• Right to opt out of the processing of personal data (like targeted Ads, sale of data). There is no exception in favour of the businesses in this right.
• Right to appeal a business’s denial to act reasonably.

What are business’ obligations?

• Limits on collection: adequate, relevant and reasonably necessary in relation to the purposes
• Limits on use: to not process personal data for purposes that are not disclosed, unless the controller obtains the consumer’s consent
• Technical safeguards: to maintain reasonable technical data security practices to protect the confidentiality, integrity, and accessibility of personal data
• Data Protection Assessments: conduct and evaluate the risks associated with processing activities
• Data processing agreements: must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.
• Privacy Policy: must state the following:
  • Categories of personal data processed and/or shared with third parties
  • Purpose of processing data
  • Consumer’s rights and methods of appeal

How does the enforcement work?

• No private right of action given: the enforcement largely depends on the attorney general.
• The controller has 30 days to act upon the violation ad provide the AG with a written statement to that effect
  • Failure to do so will attract a penalty of $7,500 per violation.