Virginia Enacts Consumer Data Privacy Act
The new law, effective in 2023, grants consumers rights similar to those in California's CCPA but notably lacks a private right of action and requires opt-in consent for sensitive data.
Virginia has become the second state to enact comprehensive consumer privacy legislation, with Governor Ralph Northam signing the Consumer Data Privacy Act (CDPA) into law on March 2, 2021. The law creates a new set of compliance obligations for businesses that conduct business in Virginia or target its residents and either control or process personal data for at least 100,000 consumers, or derive over 50% of gross revenue from the sale of personal data while controlling or processing data for at least 25,000 consumers. Sophisticated counsel care because the CDPA, while conceptually similar to the California Consumer Privacy Act (CCPA), has key differences. These include a narrower definition of 'sale' (limited to monetary consideration), the absence of a private right of action, and a requirement for opt-in consent to process sensitive data. The law imposes its own requirements, including mandatory data protection assessments for certain activities. Enforcement is vested exclusively with the state attorney general. With an effective date of January 1, 2023, clients have time to assess the law's applicability and integrate its requirements into their national privacy compliance programs.