In 2021, Virginia became the second state after California to enact comprehensive consumer privacy legislation. With several key differences between the two laws, the VCDPA offers an alternative model for other states planning to enact their own data and privacy protections.
Bloomberg Law delivers expert analysis on the issues shaping state, federal, and international data and privacy laws. From risk mitigation and compliance challenges to legislative initiatives affecting how companies do business, rely on Bloomberg Law for the actionable guidance you need to make informed decisions.
Data privacy law topics
With evolving and emerging technologies come new risks and responsibilities. Bloomberg Law’s essential news, expert analysis, and practice tools give you deeper insights that help you stay ahead of privacy and data security developments and protect your business.
Download this chart for an at-a-glance comparison of the elements of each law – including key similarities and differences.
Use this questionnaire to determine whether the VCDPA applies to your organization.
This report analyzes the most pressing data privacy and cybersecurity challenges facing in-house counsel, from AI regulations to child online privacy laws.
The VCDPA gives consumers the right to access their personal data and request that it be deleted by businesses. It also requires companies to conduct data protection assessments related to processing personal data for targeted advertising and sales purposes. The law even contains some restrictions on the use of de-identified data, or data modified to no longer directly identify individuals from whom the data were derived.
Entities conducting business in Virginia must satisfy one of two thresholds to fall within the statute’s scope, and both thresholds address a minimum number of affected consumers. To be subject to the law, entities must control or process:
The VCDPA went into effect Jan. 1, 2023.
The VDCPA specifies six consumer rights:
A consumer is a natural person who is a resident of Virginia acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.
Processing means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
Targeted advertising means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests. Consumers have the right to opt out of targeted advertising.
The “sale of personal data” means the exchange of personal data for monetary consideration by the controller to a third party. Consumers have the right to opt out of the sale of personal data.
Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Consumers have the right to opt out of profiling.
The VCDPA defines personal data as any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include de-identified data or publicly available information.
The VCDPA defines sensitive data as a category of personal data that includes:
Yes. The VCDPA prohibits the processing of sensitive data without obtaining consumer consent (Va. Code § 59.1-578). The processing of sensitive data also triggers the obligation to conduct and document a data protection assessment (Va. Code § 59.1-580).
Consent means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
The VCDPA exempts certain information covered by federal laws and regulations, such as:
The VCDPA also exempts certain information processed or maintained in the employment context (Va. Code § 59.1-576.C).
The VCDPA imposes obligations on persons that either conduct business in the commonwealth or produce products or services that are targeted to residents of the commonwealth and that:
The VCDPA exempts the following entities:
A controller is the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data.
Under the VCDPA, controllers are obligated to:
Yes. A controller in possession of de-identified data must:
To facilitate the exercise of consumer rights, the VCDPA requires a controller to:
A controller (or processor) need not comply with an authenticated consumer rights request if all the following are true:
A controller must conduct and document a data protection assessment in each of the following circumstances:
A data protection assessment must identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.
No. The Virginia attorney general may request, pursuant to a civil investigative demand, that a controller disclose any data protection assessment that is relevant to an investigation conducted by the attorney general, and the controller shall make the data protection assessment available to the attorney general. The attorney general may evaluate the data protection assessment for compliance with the responsibilities set forth in Va. Code § 59.1-578.
The VCDPA prohibits a controller from:
A processor is a natural or legal entity that processes personal data on behalf of a controller.
A processor must adhere to the instructions of a controller and must assist the controller in meeting its obligations under the VCDPA.
A contract between a controller and a processor governs the processor’s data processing procedures with respect to processing performed on behalf of the controller. The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.
The contract must require the processor to:
The Virginia attorney general has exclusive authority to enforce the VCDPA (Va. Code § 59.1-584).
Yes. Prior to initiating an action, the attorney general must provide a controller or processor 30 days’ written notice identifying the specific provisions alleged to have been, or that are being, violated. If within the 30-day period the controller or processor cures the noticed violation and provides the attorney general an express written statement that the alleged violations have been cured and that no further violations shall occur, no action shall be initiated against the controller or processor.
If a controller or processor continues to violate the VCDPA following the cure period or breaches an express written statement provided to the attorney general, the attorney general may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of the VCDPA and civil penalties of up to $7,500 for each violation.
At just eight pages, the VCDPA is significantly more succinct than the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Analysis by Bloomberg Law suggests that the law’s brevity and clarity may result in the VCDPA becoming a model for future privacy legislation.
The VCDPA clearly defines whose personal data is covered, describing consumers as Virginia residents “acting only in an individual or household context.” It further clarifies that consumers are not those acting in a “commercial or employment context.” Unlike California, where the now-expired B2B and employee exclusions have been the subject of several statutory amendments, Virginia has chosen not to leave those potential compliance hurdles up in the air.
Additionally, businesses must satisfy one of the thresholds to fall within the statute’s scope, and unlike California, the VCDPA makes no mention of a threshold based solely on annual gross revenue. Entities are not left to question whether the processing of data from a dozen or so consumers will subject them to the law.
Virginia’s law has no significant recordkeeping requirements, aside from documenting data protection assessments. If a business already has in place a GDPR- or CCPA-compliant process for receiving and responding to data subject or consumer access requests, that process should be sufficient to handle requests from Virginia residents.
The Virginia law has carve-outs for protected health information under the Health Insurance Portability and Accountability Act (HIPAA), as well as for personal data regulated by the Family Educational Rights and Privacy Act (FERPA). Those falling outside the scope of the law also include state agencies, nonprofit organizations, colleges and universities, and entities or data subject to Title V of the Gramm-Leach-Bliley Act (GLBA), which largely regulates banks and other financial institutions.
Virginia residents can’t sue directly over violations of the law. Enforcement is left in the hands of the state attorney general, who can seek damages of up to $7,500 per violation.
A plus for business is the law’s 30-day cure period, which allows companies that receive letters alleging noncompliance to communicate with the attorney general’s office and remedy any potential violations before fines are imposed.
Additionally, unlike the CCPA, the Virginia data privacy law explicitly allows businesses to offer different prices and levels of service to consumers enrolled in loyalty programs without having to comply with certain obligations.
From live events to in-depth reports, discover singular thought leadership on consumer data privacy laws across the U.S. and around the world. Our expert network of analysts are always on the case, so you can make yours.
Save valuable time when you trust Bloomberg Law to tackle complex data privacy requirements with ease. Request a demo to learn more.