Virginia Consumer Data Protection Act (VCDPA)

Who does the Virginia Consumer Data Protection Act exempt? 

The Virginia data protection act does not apply to the following types of entities: 

• Any body, authority, board, bureau, commission, district or government agency in Virginia, or any political subdivision located in the state;
• Financial institutions or data that is subject to Title V of the Gramm-Leach-Bliley Act;
• Covered entities or business associates governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164 established pursuant to HIPAA, and the Health Information Technology for Economic and Clinical Health Act (P.L. 111-5);
• Nonprofit organizations;
• Higher education institutions.
  
  

What are the requirements for businesses under the Virginia Consumer Data Protection Act? 

In order to be compliant with the VCDPA, your organization should: 

1. Limit the collection of personal information to only that which is “adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer”;
2. Limit the use of personal information, meaning do “not process personal information for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal information is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent”;
3. Not process sensitive personal information without obtaining consent and in the case of sensitive personal information about children, follow COPPA’s rules;
4. Implement technical safeguards for your website, meaning “establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal information. Such data security practices shall be appropriate to the volume and nature of the personal information at issue”;
5. Establish  data protection assessments (“DPAs”), to determine any potential risks resulting from processing activities. There are no clear guidelines as to the frequency of the assessments or how long their results must be kept;
   
   a) Similar to the GDPR, if there is an instance where personal information is processed by a data processor on behalf of a data controller, this can only be done following a data processing agreement which must “clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties”;
6. Provide your website visitors with a Privacy Policy that  includes the following: 

• The categories of personal information that will be collected;
• The purposes for collecting personal information;
• How your website visitors can exercise their data subject access rights, or appeal a controller’s decision in regards to a submitted request; 
• The categories of personal information that are being shared with a third party, if any; and
• The categories of third parties with whom you share the personal information of your website visitor, if any. 
  
  

What data access rights does the Virginia Consumer Data Protection Act grant? 

Virginia's privacy law (CDPA) provides your website visitors with a series of data access rights, including: 

• Right to access: your website visitors have a right to confirm whether or not you are processing their personal information and to access such personal information;
• Right to correct: they have the right to correct inaccuracies in their personal information, taking into account the nature of the personal information and the purposes of the processing of their personal information;
• Right to delete: self explanatory, they have the right to delete any personal information provided by or obtained about them. 
• Right to data portability: your website visitors have the right to obtain a copy of their personal information that they previously provided to you in a portable and, to the extent technically feasible, readily usable format that allows them to transmit the information to another controller without hindrance, where the processing is carried out by automated means;
• Do Not Sell my Personal Information / Opt Out: individuals have the right to opt out of the processing of their personal information for the purpose of targeted advertising, sale of personal information or profiling as regards advancing decisions which may have actual or similar legal effects over the individual. 
• Finally, the Virginia Consumer Data Protection Act gives your website visitors the Right to appeal, meaning that if you refuse to respond to a data subject access request within the legal timeframe (45 days from the date of receiving the request) you are obliged to “establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable time after the consumer's receipt of the decision." If the appeal is also denied, you must inform the individual whose appeal you refused how they can file a complaint with the Attorney General. 

How to respond to consumer requests under the Virginia Consumer Data Protection Act? 

You must reply to a consumer request “without undue delay, but in all cases within 45 days of receipt of the request submitted.” You are allowed to extend this by another 45 days, “when reasonably necessary, taking into account the complexity and number of the consumer's requests” as long as you inform the person who submitted the request of the extension within the initial 45 days period, and you include the reason for the extension.

Before replying to a request, you must be able to authenticate said request. If you are unable to do so, you are not required to comply with the request and may request additional information “reasonably necessary to authenticate the consumer and the consumer's request.”

The information you provide in response to a request has to be “free of charge, up to twice annually per consumer.” However, Virginia's privacy act states that “if requests from a consumer are manifestly unfounded, excessive, or repetitive,”you may “charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request” but you are responsible with “demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.”

If an individual wishes to appeal your refusal to grant their request, you are required to establish a process for this to be possible. The appeal process has to be “conspicuously available and similar to the process for submitting requests to initiate action.”

Last but not least, within 60 days of receiving an appeal, you are required to inform the person who appealed your decision, in writing, of any action taken or not taken in connection with their appeal, along with a written explanation of the reasons for this. If their appeal is denied, you must provide them with “an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.”

Virginia Consumer Data Protection Act enforcement and penalties

The provisions of the Virginia Consumer Data Protection Act are enforced by the state Attorney General.

Prior to taking any action against your business, the Attorney General will provide you with a 30 day written notice of the specific parts of this privacy law that you have violated. Generally, if within the 30 days you cure the violation(s) and provide an express written statement that these have been cured and that no further violations will occur, no action will be taken against you.

However, if you continue to violate any of the provisions of the Virginia Consumer Data Protection Act following the cure period, or you breach an express written statement previously provided to the Attorney General, you are liable to be charged with a civil penalty of up to $7,500 for each violation. It is important to note that each “violation” could be each customer record under your control; penalties can therefore add up quickly.

Data Subject Rights - GDPR vs. Virginia Consumer Data Protection Act

FAQs about the Virginia Consumer Data Protection Act

VCDPA Resources

• Meet Virginia’s Expected New Consumer Data Protection Act

• What is the difference between the VCDPA and the CCPA?