Virginia passes consumer data protection law

Eastern state follows California in offering consumers opt-out for data processing

Virginia Capitol Building

Yesterday, Virginia became the second state to pass a consumer data protection law, forcing companies to give consumers the right to opt out of data collection. Governor Ralph Northam signed the Consumer Data Protection Act into law on Tuesday. 

The law, which Virginia's General Assembly passed last month, allows consumers to confirm whether a company is holding their data and access it using an automated system. The system allows them to retrieve it in a portable format, making it possible to send it to another company. 

Users can amend inaccuracies in the data or force the company to delete it altogether. They can also prevent companies from using the data for marketing or other purposes.

Companies must respond to consumer requests within 45 days but may extend that period by an additional 45 days based on request complexity, as long as they inform the individual and explain the delay. The company must fulfill up to two free annual requests from an individual, but they may charge for additional requests.

Organizations must disclose what they'll use an individual's data for and must limit their personal data collection to those purposes. They must also explain which third parties they'll share the data with and what they'll do with it.

Related Resource

Edge-enabled mobility of the future

Turning vehicle data into value

How to turn vehicle data into value - whitepaper from EquinixDownload now

Consumers can opt out of personal data collection and the sale of data to third parties. However, the company can choose not to offer consumers goods or services if it needs the opted-out data to provide the service.

The law, which goes into effect on January 1, 2023, affects companies holding personal data for at least 100,000 consumers or those holding at least 25,000 individuals’ personal data and make more than half their income selling that data. 

Companies violating the law face civil penalties of up to $7,500 per affected individual, but they can escape those penalties if they fix the problem within 30 days of Virginia notifying them. All penalties collected will go to a Consumer Privacy Fund established by Virginia, which will support enforcement of the Act.

The Act doesn’t define new data breach notification rules, instead referring to existing rules in the state's legal code.

The legislation now goes to Virginia's Joint Commission on Technology and Science to evaluate how to implement it and release a study by November.

This is the second such law to pass in the US. California's approval of the California Consumer Protection Act (CCPA) went into effect last year. There’s still no cohesive federal consumer data protection law, which four in five Americans want.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Podcast transcript: Can the US take on big tech?
Policy & legislation

Podcast transcript: Can the US take on big tech?

19 Nov 2021
The IT Pro Podcast: Can the US take on big tech?
Policy & legislation

The IT Pro Podcast: Can the US take on big tech?

19 Nov 2021
US gov initiative aims to attract 'world-class' cyber security talent
Careers & training

US gov initiative aims to attract 'world-class' cyber security talent

18 Nov 2021
Japan's Fugaku retains title as world’s fastest supercomputer
high-performance computing (HPC)

Japan's Fugaku retains title as world’s fastest supercomputer

16 Nov 2021

Most Popular

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Apple's mixed reality headset could debut in 2022
augmented reality (AR)

Apple's mixed reality headset could debut in 2022

29 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021