The Virginia Consumer Data Protection Act (VCDPA)

The Virginia Consumer Data Protection Act (HB 2307 / SB 1392) or (VCDPA) passed the Virginia House of Delegates and the state Senate on February 5, 2021. The law passed with significant bipartisan support.

The VCDPA is intended to be a privacy bill, which is exhaustive in nature. The legislation aims to allow residents of the Virginia Commonwealth to opt-out of the sale of their personal data and the targeting of that information in a fashion similar to California's Consumer Privacy Act (CCPA).

The bill also gives consumers the ability to acquire any data that companies collect from them, as well as correct or delete it.

The law will become enforceable on January 1, 2023.

Virginia Delegate Cliff Hayes Jr. (D) introduced the law into the Virginia House of Delegates after saying he was influenced by the European General Data Protection Regulation (GDPR) and other states' efforts. One of the reasons he gave for submitting the legislation was that the U.S. federal government had not taken action.

The Washington Post quoted him as saying:

"Who needs to worry about hackers when we're giving away and selling consumers' private identifiable information? We just want to make sure that we're protecting the consumers' data privacy rights."

The VCDPA is based in general upon the most current version of the Washington Privacy Act (WPA), proposed by the Washington state senate earlier this year. However, the VCDPA differs from the WPA on key points, and that many think make it more friendly toward businesses.

Major players in the tech industry like Microsoft, Amazon, and various trade groups in the tech space, have all backed the legislation. Legislators have suggested that additional protections (which the VCDPA doesn't currently provide) are in the works.

Who is Covered by the VCDPA?

The VCDPA would cover the following:

• Persons that do business in the Commonwealth or who produce products or services that are targeted to residents of the Commonwealth, and that:

• During a calendar year, process or control personal data of at least 100,000 consumers, or

• Process or control the personal information of at least 25,000 consumers and obtain over 50 percent of gross revenue from selling that data

Definition of "Consumer"

According to the VCDPA, a "consumer" is "a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context."

However, there are some crucial exceptions to this definition.

For instance, as in the WPA, a "consumer" is not someone who acts in an employment or commercial context. Moreover, these people are exempt from the legislation's provisions for consumer rights, which we describe below.

Definition of "Personal Data"

• The VCDPA defines "personal data" as "any information that is linked or reasonably linkable to an identified or identifiable natural person." However, publicly available information, and data that has been de-identified, is excluded from that definition.

• "De-identified data'' is information, which "cannot reasonably be linked to an identified or identifiable natural person [or] a device linked to such person." Interestingly, companies must protect de-identified data under the VCDPA to reduce the risk of re-identification. Moreover, the law demands that the data controller (any entity that acquires and possesses the personal data of a consumer for its own use) make a public commitment not to make any effort at re-identification.

• Any data controller that discloses de-identified information must use "reasonable" oversight methods to ensure that recipients comply with all contractual obligations and take applicable measures to handle any breaches that may occur.

• Note that the VCDPA would not restrict either the controller's or the processor's right to "conduct internal research to develop, improve, or repair products, services, or technology."

Consent and Sensitive Personal Data

Specific categories of personal data are designated as "sensitive personal data," which includes:

• Personal data revealing racial or ethnic origin

• Religious beliefs

• Mental or physical health diagnosis

• Sexual orientation

• Immigration or citizenship standing

• The processing of biometric or genetic data to uniquely identify a natural person (physical or digital photographs, a video or audio recording or data generated therefrom, etc. are excluded)

• The personal information collected from a known child

• Precise geolocation data

The legislation defines "consent" as "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement." This is another area where the CDPA borrowed from the WPA.

When processing sensitive personal information, companies are required to obtain consent from consumers.

Finally, companies in compliance with the 1998 Children's Online Privacy Protection Act (COPPA) in terms of verifiable parental consent will also be considered in compliance with the VCDPA's requirements to acquire parental consent for individuals under the age of 13.

Exemptions to the VCDPA

The VCDPA has several exemptions, including exceptions for higher education institutions, business associates, nonprofits, and "financial institutions or data subject to Title V of the federal Gramm-Leach-Bliley Act." Exemptions are also provided for companies covered by HIPAA.

Additionally, the VCDPA cannot limit a controller or processor's ability to:

• Comply with state or federal law

• Cooperate with law enforcement

• Defend legal claims

• Provide a service or product, which a consumer requests

• Perform a contract with the consumer

• Detect or prevent security incidents

The law also will not forbid controllers and processors from conducting:

"internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party."

Finally, there are specific data sets exempted from the VCDPA. They include:

• Specific personal data regulated by the Family Educational Rights and Privacy Act (FERPA)

• Particular kinds of data regulated by the Fair Credit Reporting Act (FCRA)

• HIPAA personal health data

• Data related to employment

Consumer Privacy Rights

The VCDPA provides Commonwealth of Virginia residents with specific rights concerning privacy. These include the following:

• The right to confirm a consumer's personal data is being processed by a controller

• The right to access personal data possessed by a controller

• The right to have personal data deleted

• The right to opt-out of the processing of personal information that is intended to be used for the sale of such data, targeted advertising, or profiling the consumer, and

• The right to acquire a copy of the consumer's personal information in a portable and usable format (provided it's technically practical) which allows the consumer to transmit the data to another controller without obstruction

In regard to all of the above, controllers must respond to consumer requests within 45 days. However, there are some cases where businesses are exempt from complying with consumer rights requests.

These include:

• When personal information has already been pseudonymized (and safeguards are in place), and

• When complying would be "unreasonably burdensome"

Exemptions from the Definition of "Sale"

Unlike the CCPA, the VCDPA defines the sale of personal data as "the exchange of personal data for monetary consideration by the controller to a third party."

For the sake of comparison, the CCPA adds in the words "other monetary consideration" to its definition of "sale."

Additionally, the VCDPA excludes the following from the definition of "sale:"

• When the controller discloses personal data to a processor, which then processes the information on the controller's behalf

• When the consumer requests a service or product and the controller discloses the data to a third party to provide that service or product

• When the personal data is transferred or disclosed to a controller's affiliate

• When personal information is intentionally disclosed via mass media and was not restricted to a specific audience by the consumer and is therefore available to the general public, or

• When personal data is transferred or disclosed as an asset to a third party as part of a bankruptcy, merger, acquisition, or another transaction where the third party takes control of the controller's assets in whole or in part

Your Responsibilities Under the VCDPA

To comply with the VCDPA, companies must:

• Restrict the data they acquire to only information that's necessary and relevant

• Put security safeguards in place to protect personal information

• Refrain from any discrimination against consumers that wish to exercise their privacy rights (There's some wiggle room here for controllers provided consumers have used their rights to opt-out, or when services or products "require" their personal information. Another area where flexibility exists is in regard to premium features, loyalty programs, and discounts)

• Refrain from processing sensitive data without consent

• Provide a privacy notice (a Privacy Policy), which discloses information such as the types and categories of personal information collected, why the data is collected, and how consumers may exercise their rights

Third-Party Data Processing Agreements

Data processing agreements with third party data processors must:

• Provide instructions on the processing of personal information that includes the overall purpose and nature of the processing

• Identify the kind of data that will be processed and must also include the length of time the processor may process the data and the obligations and rights of both parties

• Make sure that all individuals that process personal data are bound by confidentiality in terms of that personal data

• Delete or return all personal information once the purpose for which it was collected is fulfilled

• Cooperate with assessments, and

• Pass on all of the above requirements to any subcontractors

Data Protection Assessments

Before a company begins processing personal data, which "present a heightened risk of harm to consumers," and that may include targeted advertising, specific profiling activities, the sale of data, or sensitive data, it must conduct a data protection assessment.

All data protection assessments are required to compare the possible risks to consumers' rights (lessened by security measures) with the general benefits of continuing on with processing activity.

It is crucial to note that Virginia's Attorney General can force businesses to conduct a data protection assessment without a court order. However, all assessments are exempt from Virginia's Freedom of Information Act and remain confidential.

Additionally, should the Attorney General demand a data protection assessment, work product protection regarding the contents of an assessment or attorney-client privilege is not to be considered waived.

Penalties for Non-Compliance

The Virginia Attorney General's office has exclusive authority to enforce the law. It must provide companies with 30 days' notice of any violation. The offending company then has that amount of time to cure the offense.

If the company takes no action and the violation is not remedied, it could be subject to fines of up to $7,500 per violation.

Additionally, the offending company could be forced to pay "reasonable expenses incurred in investigating and preparing the case, including attorney fees."

Shortcomings of the VCDPA

Critics of the new legislation continue to argue that the legislation doesn't include provisions that allow consumers to sue companies that infringe upon their privacy rights. (In other words, there is no private right of action.)

Privacy advocates like Consumer Reports and the Electronic Frontier Foundation urged Virginia's lawmakers to increase protections in the VCDPA to the point that it was comparable with the CCPA.

Summary

• The VCDPA passed the Virginia House of Delegates and the state Senate on February 5, 2021

• The legislation aims to allow residents of the Virginia Commonwealth to opt-out of the sale of their personal data as well as the targeting of that information in a fashion similar to California's Consumer Privacy Act (CCPA)

• The law becomes enforceable on January 1, 2023

• The law covers persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth

• The law exempts higher education institutions, business associates, nonprofits, and "financial institutions or data subject to Title V of the federal Gramm-Leach-Bliley Act

• The law exempts companies covered by HIPAA

• Companies must restrict the data they acquire to only information that's necessary and relevant

• Provide privacy notices, which disclose information such as the types and categories of personal information collected, why the data is collected, and how consumers may exercise their rights

• Consumers have the right to opt-out, the right to access data, correct faulty data, and delete data

• Companies must conduct data protection assessments before they begin processing personal data

• Companies that violate the VCDPA could be subject to fines of up to $7,500 per violation and reasonable expenses incurred in investigating and preparing the case, including attorney fees

While other states in America continue to contemplate data privacy and protection laws, Virginia has effectively made itself second only to California in its efforts to pass a comprehensive privacy law.

In light of the above, companies that do business in Virginia should begin working to comply with the VCDPA if they haven't started doing so already.

All US Privacy Laws

Want to read more about privacy laws in the USA? Start here: