Wednesday, April 7, 2021
Virginia has joined California as the second state to enact a comprehensive data privacy law. On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA) into law. The VCDPA does not go into effect until January 1, 2023, but the broad privacy mandate will have an immediate impact on compliance efforts for many Virginia businesses.
The law includes elements similar to those found in the California Consumer Privacy Act (CCPA) and the newly enacted California Privacy Rights Act (CPRA), such as provisions granting Virginia residents the right to access, correct, delete, know about, and opt out of the sale and processing of their personal information for “targeted advertising” purposes. Similar to the European Union’s privacy analog, the General Data Protection Regulation (GDPR), the VCDPA imposes data security and consumer response obligations on the data “controller” and “processor” for certain businesses handling personal data belonging to Virginia consumers. However, the VCDPA differs from the CCPA, CPRA, and GDPR in several notable ways. Most importantly, unlike the CCPA, the VCDPA does not apply to employee data and does not create a private right of action for protected consumers.