April 18, 2021

Volume XI, Number 108

Advertisement

April 16, 2021

Subscribe to Latest Legal News and Analysis

April 15, 2021

Subscribe to Latest Legal News and Analysis

Virginia Passes Comprehensive Data Privacy Law – Mintz’s Hot Take

On Tuesday, Virginia Governor Ralph Northam signed the Consumer Data Protection Act (“CDPA”) into law, making Virginia the second U.S. state after California to pass a comprehensive data privacy law.   Those familiar with the European Union General Data Protection Regulation (GDPR) will recognize terminology throughout the CDPA, mimicking many GDPR-defined terms, such as “controller”, “processor” and “personal data.”  While not quite as expansive as the GDPR in every respect, the CDPA is a very broad-based privacy law that is on par with the California Consumer Privacy Act.  Below, we break down some of its key elements. 

To whom does the CDPA apply?

The CDPA applies to persons that conduct business in Virginia or produce products or services that are targeted to Virginia residents that: (i) during a calendar year, control or process personal data of at least 100,000 consumers; or (ii) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.  

Notably, “consumers” as used in the CDPA does not include individuals acting in a commercial or employment context.   This is a key difference from the soon-to-be effective California Privacy Rights Act.

Are there exemptions?

Yes, there are several exemptions in the CDPA.  For example, the CDPA does not apply to certain government organizations, nonprofits, certain educational institutions, and entities governed by certain other laws such as HIPAA or GLBA.  It also does not apply to certain employment-related information, nor to information governed by certain federal laws such as The Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the Fair Credit Reporting Act (FRCA).

What rights do consumers have under the CDPA?

  • Right to confirm whether or not their personal data is processed;

  • Right to access their personal data;

  • Right to correct their personal data;

  • Right to deletion of  their personal data;

  • Right to portability of their personal data; and

  • Right to opt-out of the processing of their personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

What are a business’ obligations to consumers?

  • Respond to consumer requests under the CDPA within 45 days of receipt (may be extended an additional 45 days in certain circumstances)

  • Provide required information to consumers free of charge, up to twice per year

  • Authenticate requests using commercially reasonable efforts

  • Establish a process for consumers to appeal any refusal to take action on a consumer request

Are businesses required to provide notices to consumers?

  • Businesses must post a privacy policy that meets requirements under the CDPA, including how consumers may submit requests to exercise their CDPA rights

  • Businesses must conspicuously disclose any sale of personal data or processing of personal data for targeted advertising (and how to opt-out of such disclosure or processing)

What other obligations do businesses have?

  • Conduct and document data protection assessments, which include extensive requirements and an obligation to provide such assessments to the Attorney General upon request

  • Practice data minimization: limit collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer)

  • Process personal data only for disclosed purposes, or purposes compatible with such disclosures

  • Establish, implement, and maintain data security practices

  • Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers

  • Not discriminate against a consumer for exercising any consumer rights, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to consumers

  • Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act

Are vendors/data processors impacted?

Yes, vendors that are data processors have direct obligations under the CDPA, such as adhering to instructions from data controllers, assisting data controllers with their own compliance obligations, assisting data controllers with data protection assessments, and required subcontractor flow-down obligations. 

The CDPA also contains specific requirements that must be included in data processing agreements between data controllers and data processors.

Is there a private right of action?

Although this issue was hotly debated, the CDPA does not provide for a private right of action and is enforced exclusively by the Attorney General.

What are the fines and penalties for violation of the CDPA?

Civil penalties up to $7500 per violation, injunctive relief, and recoupment of investigation and case preparation expenses, including attorney fees, incurred by the Attorney General.  

When does the CDPA become effective?

January 1, 2023. 

Advertisement
©1994-2021 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.National Law Review, Volume XI, Number 62
Advertisement
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

Cynthia Larose, Privacy, Security, Attorney, Mintz Levin, Law Firm, electronic transactions lawyer
Member / Chair, Privacy & Cybersecurity Practice

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from start-ups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-...

617-348-1732
Christopher Buontempo Corporate Lawyer Mintz
Associate

Chris is a corporate attorney and a Certified Information Privacy Professional (CIPP). He has significant experience handling legal and business issues relating to technology, data privacy and security, brand protection, contract negotiation, licensing, and product development. 

Chris has held several leadership positions at technology, consumer product, and e-commerce companies. Prior to joining Mintz, he was Director of Legal Affairs and Privacy Officer at The Predictive Index, a high-growth, SaaS-based personnel assessment and technology company with an expansive international...

617-239-8322
Advertisement
Advertisement