The Virginia Consumer Data Protection Act (VCDPA), a comprehensive privacy law that will affect many businesses either based in Virginia or doing business with or marketing to consumers in the Commonwealth next year, has been amended by the 2022 General Assembly. The amendments relate to consumer requests to delete personal data held by a business, expand the definition of nonprofit organizations, and redirect penalties and fees collected from the enforcement of the VCDPA by the Office of the Attorney General to an existing fund.
The amendments provide additional options for controllers of personal data from a source other than the consumer to comply with that person’s request to delete that data. Now controllers receiving such a request can either a) keep a record of the deletion request and the minimum data necessary to ensure the consumer’s personal data remains deleted from their business’ records, and not use that retained data for any other purpose, or b) remove a consumer’s personal data from processing for any purpose except those already exempted from the VCDPA’s provisions.
The VCDPA previously defined “nonprofit organizations” to mean Virginia Nonstock Corporations, organizations exempt from taxation under Internal Revenue Code §§ 501(c)(3), (6), or (12), and subsidiaries and affiliates of public utility service providers. The amendments expand that definition to include political organizations and certain insurers exempt from taxation under Internal Revenue Code § 501(c)(4).
Lastly, the amendments repeal the Consumer Privacy Fund originally established to hold penalties, expenses, and attorneys’ fees collected under the VCDPA, and redirect those funds to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.
Although the VCDPA gives consumers more control over personal data collected by certain businesses, it is more narrowly tailored than similar legislation in other states and does not provide a private right of action. However businesses operating in Virginia that collect or utilize consumer data should evaluate whether the VCDPA will impact their operations, and, if necessary, be prepared to comply with its numerous requirements on or before Jan. 1, 2023.
Related reads: Preparing Your Business for Compliance with Virginia’s New Consumer Data Protection Act
Related legislation: HB381, HB714, SB534
Attorneys and practice areas related to this topic include:
Jonathan M. Joseph
Robert D. Michaux
Intellectual Property
This item has been provided as an informational service and does not constitute legal counsel or advice, which can only be rendered in the context of specific factual situations. If a legal issue should arise, please contact an attorney listed or retain the assistance of other competent legal counsel. Case results depend on a variety of factors unique to each case and results do not guarantee or predict a similar result in any future case undertaken.