Virginia has joined California as the second state to enact a comprehensive data privacy law. On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA) into law. The VCDPA does not go into effect until January 1, 2023, but the broad privacy mandate will have an immediate impact on compliance efforts for many Virginia businesses.
The law includes elements similar to those found in the California Consumer Privacy Act (CCPA) and the newly enacted California Privacy Rights Act (CPRA), such as provisions granting Virginia residents the right to access, correct, delete, know about, and opt out of the sale and processing of their personal information for “targeted advertising” purposes. Similar to the European Union’s privacy analog, the General Data Protection Regulation (GDPR), the VCDPA imposes data security and consumer response obligations on the data “controller” and “processor” for certain businesses handling personal data belonging to Virginia consumers. However, the VCDPA differs from the CCPA, CPRA, and GDPR in several notable ways. Most importantly, unlike the CCPA, the VCDPA does not apply to employee data and does not create a private right of action for protected consumers.
The VCDPA applies to entities conducting business in Virginia or producing products or services targeted at Virginia residents “that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.” The delineated scope is broad, covering most entities regularly engaged in consumer transactions involving residents within the Commonwealth. The law includes a carve-out for certain categories of businesses, including state entities; nonprofits; higher education institutions; and entities that are governed by federal privacy regimes such as the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Health Information Technology for Economic and Clinical Health Act.
The rights granted under the VCDPA apply to a “consumer,” which is defined as “a natural person who is a resident of the Commonwealth acting only in an individual or household context.” As noted above, this definition expressly excludes “a natural person acting in a commercial or employment context.” This broad exclusion appears to avoid many of the headaches created by privacy compliance requirements in the employment context.
It should be noted that the rights granted to consumers under the VCDPA include the right to opt out of processing of personal data for “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” Under the privacy law, the phrase “decisions that produce legal or similarly significant effects” encompasses a decision made by the controller that “results in the provision or denial by the controller of … employment opportunities.” The definition of “consumer”—which expressly excludes individuals in the “employment context”—may prevent the opt-out right from being applied to employers handling data from applicants or employees. However, Virginia employers may want to note the potential ambiguity and evaluate it as the effective date of the VCDPA approaches.
Notwithstanding the exception for employment data, Virginia employers—especially those doing business with Virginia consumers—may want to be mindful of the information covered and rights created by the VCDPA. The law identifies the following categories of information as falling within its purview:
The VCDPA also enumerates a series of consumer rights and associated obligations for those entities handling consumer information. Consumers have the rights to:
Consumers also have the right to appeal a denial of an attempt to exercise rights under the VCDPA. A business must respond to any consumer request made under the VCDPA “within 45 days of receipt of the request.” Where reasonably necessary, the business may then extend the response deadline by an additional 45 days, so long as the business notifies the consumer within the initial response window. If a business fails to do this, the VCDPA mandates that the “controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the consumer’s receipt of the decision.” If the appeal is denied, the law requires the controller to inform the consumer regarding how to submit a complaint to the Virginia attorney general.
Like the CCPA and GDPR, the VCDPA directs controllers to implement security and transparency measures, including:
Although the VCDPA does not directly impact employee data or create any private right of action, it represents a dramatic shift in Virginia’s privacy landscape that is likely to continue as Virginia and other states become increasingly active in their data security efforts.
