Yes. On March 2, 2021, the Virginia Consumer Data Protection Act (“VCDPA”) was enacted into law, to go into effect on January 1, 2023. The VCDPA gives Virginia residents the rights to access, correct, delete, know, and opt-out of the sale and processing for targeted advertising purposes of their personal information. Enforcement of the VCDPA is exclusively within the power of the Attorney General, and there is no private right of action for consumers.

VCDPA applies to all entities “who conduct business in the commonwealth of Virginia or produce products or services that are targeted to residents of the Commonwealth” and who, during a calendar year, either:

(1) control or process personal data of at least 100,000 consumers, or

(2) derive over 50% of gross revenue from the sale of personal data of at least 25,000 consumers.

The bill does not apply to state or local governmental entities and certain types of data and information governed by federal law are exempt from the statute.

“Personal Data” includes “any information that is linked or reasonably linkable to an identified or identifiable natural person,” but excludes employment data, pseudonymous data, and “de-identified data or publicly available information.”

VCDPA also grants consumers the right to not be discriminated against for exercising any of the rights granted by this statute, but explicitly exempts loyalty programs from this prohibition.

VCDPA limits the ability of businesses to store and use personal data and it requires the implementation of certain safeguards. VCDPA limits the collection and processing by controllers of personal data to that which is “adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed.” If the controllers wish to use such personal data for another purpose, they must obtain consent from consumers before processing the data.  Additionally, VCDPA requires that businesses “establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data,” as appropriate to the volume and nature of the personal data collected.

For more information about the VCDPA, click here.