Earlier this month saw the Commonwealth of Virginia become the second state to pass a bill dealing with the protection and collection of consumer data by online companies. On March 2nd Governor Ralph Northam signed House Bill 2307 which is also known as the Consumer Data Protection Act.
The bill, which was sponsored by Sen. David Marsden (D-Fairfax) seeks to allow consumers to obtain copies of their online data. The bill also allows consumers to amend or delete data in order to ensure one’s privacy as well as offer an opt out of allowing businesses to use the data for purposes sure as marketing.
Marsden had also introduced the same bill in the Senate which was listed as SB 1392.
According to its language the bill will apply to all persons that conduct business within the Commonwealth and either control or process the personal data of at least 100,000 consumers. The bill would also apply to businesses that derive over 50% of gross revenue from the sale of personal data or control and process personal data of at least 25,000 consumers.
The bill would not apply to state or local governmental entities and also contains exceptions for certain types of information or data governed by federal law.
The bill would also give exclusive authority to the Attorney General to enforce violations of the law. Any fines collected through this bill would according to its language be put into a Consumer Privacy Fund which would be attached to the state treasury. The bill would also direct the Joint Commission on Technology and Science to establish a work group to review the provisions written in the act and address any issues that may come up once it’s been implemented.
The Virginia legislation comes over two years after California’s Consumer Privacy Act which was passed in 2018. Through that act residents of the Golden State have the right to delete some personal information that was already collected. This is in addition to being allowed to opt out of the sale of their personal information. California’s act also gives exclusive authority to their Attorney General for enforcement.
California’s Consumer Privacy Acy was based off the European Union’s General Data Protection Regulation act which was passed in 2016 and implemented in 2018.
Virginia is the second state to implement such personal data privacy rules, a similar bill was introduced in the Utah State Senate. SB 200 failed to pass before the state’s general assembly adjourned.
The bill will become effective on Jan. 1 2023.