Virginia Proposes Virginia Privacy Act Legislation

We’re almost one month into 2020 and privacy continues to be a trending topic, especially in the United States. As several states introduce new privacy legislation on the heels of the California Consumer Privacy Act (CCPA), we will dive into some of the newly proposed bills over the next few weeks. In this article, we talk about the Virginia Privacy Act Legislation.

Data Protection for Virginians

On January 8, 2020, lawmakers in Virginia proposed a bill, the Virginia Privacy Act (HB 473), or VCPA, that would create a number of privacy rights to strengthen the data privacy rights of Virginians.

Who Does it Apply To?

The provisions of the legislation apply to an entity that conducts business in Virginia or targets Virginia internationally with products, and meets the one of the following criteria:

1. Controls or processes personal data of not fewer than 100,000 consumers
2. Derives over 50 percent of gross revenue from the sale of personal data and processes or controls personal data of not fewer than 25,000 customers.

What Information is Covered?

“Personal Data” is defined as “information that is linked to an identified or identifiable person”. This does not include publicly available information.

Proposed Privacy Rights

The proposed VCPA would require a controller to facilitate requests by consumers to exercise newly created rights. The rights can be generally summarized as the following:

• Right to Access: the right to confirm whether their personal data is being processed by the controllers
• Right to Know: including whether personal data is being processed or sold; where personal data is being processed.
• Right to Correct: including the completion of incomplete personal data.
• Right to Delete: the right to request the deletion of personal information.
• Right to Restrict Processing: the right to request restricting the process of personal data when the processing of the data is not consistent for which it was collected for.
• Right to Object to Processing: the right to object to targeted advertising.

Ongoing Monitoring

Businesses that will be affected by VCPA should analyze the effect of the bill and actively follow the consideration of the legislation.