Virginia passes consumer data protection law

Eastern state follows California in offering consumers opt-out for data processing

Virginia Capitol Building

Yesterday, Virginia became the second state to pass a consumer data protection law, forcing companies to give consumers the right to opt out of data collection. Governor Ralph Northam signed the Consumer Data Protection Act into law on Tuesday. 

The law, which Virginia's General Assembly passed last month, allows consumers to confirm whether a company is holding their data and access it using an automated system. The system allows them to retrieve it in a portable format, making it possible to send it to another company. 

Users can amend inaccuracies in the data or force the company to delete it altogether. They can also prevent companies from using the data for marketing or other purposes.

Companies must respond to consumer requests within 45 days but may extend that period by an additional 45 days based on request complexity, as long as they inform the individual and explain the delay. The company must fulfill up to two free annual requests from an individual, but they may charge for additional requests.

Organizations must disclose what they'll use an individual's data for and must limit their personal data collection to those purposes. They must also explain which third parties they'll share the data with and what they'll do with it.

Related Resource

Edge-enabled mobility of the future

Turning vehicle data into value

How to turn vehicle data into value - whitepaper from EquinixDownload now

Consumers can opt out of personal data collection and the sale of data to third parties. However, the company can choose not to offer consumers goods or services if it needs the opted-out data to provide the service.

The law, which goes into effect on January 1, 2023, affects companies holding personal data for at least 100,000 consumers or those holding at least 25,000 individuals’ personal data and make more than half their income selling that data. 

Companies violating the law face civil penalties of up to $7,500 per affected individual, but they can escape those penalties if they fix the problem within 30 days of Virginia notifying them. All penalties collected will go to a Consumer Privacy Fund established by Virginia, which will support enforcement of the Act.

The Act doesn’t define new data breach notification rules, instead referring to existing rules in the state's legal code.

The legislation now goes to Virginia's Joint Commission on Technology and Science to evaluate how to implement it and release a study by November.

This is the second such law to pass in the US. California's approval of the California Consumer Protection Act (CCPA) went into effect last year. There’s still no cohesive federal consumer data protection law, which four in five Americans want.

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Apple turns to Chinese suppliers for next iPhone
supply chain management (SCM)

Apple turns to Chinese suppliers for next iPhone

4 Aug 2021
Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Zoom settles $85 million lawsuit over 'zoombombing', privacy policies
video conferencing

Zoom settles $85 million lawsuit over 'zoombombing', privacy policies

2 Aug 2021
Google, Facebook will require returning office staff to be fully vaccinated
flexible working

Google, Facebook will require returning office staff to be fully vaccinated

29 Jul 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021