Virginia may become the second state to enact major privacy legislation of general applicability, following the California Consumer Privacy Act (“CCPA”), which was enacted in 2018. The Virginia bill, if signed into law, would take effect January 1, 2023.

The legislation would:

  • establish a comprehensive framework for controlling and processing personal data of Virginia residents
  • provide Virginia residents with certain rights with respect to their personal data, including rights of access, correction, deletion, portability, the right to opt out of certain processing, and the right to appeal a controller’s decision regarding a rights request.
  • include requirements with respect to data minimization, processing limitations, data security, non-discrimination, third-party contracting and data protection assessments, and
  • impose requirements directly on entities who process data on behalf of a controller.

While some aspects of the bill are similar to concepts found in the CCPA and in the EU’s General Data Protection Regulation (“GDPR”), the Virginia law would differ.  It would include a number of exemptions, including for financial institutions (or data) subject to the Gramm Leach Bliley Act, and entities and business associates covered by the Health Insurance Protection and Portability Act (HIPPA).  It would also include some “data/context” specific exemptions, such as an exemption for human resources-related data processing.

The legislation gives the Virginia Attorney General exclusive enforcement authority does not provide for a private right of action. The Attorney General’s office would be required to provide companies with 30 days’ notice of any violation and an opportunity to cure. The Attorney General would be able to file an action seeking $7,500 per violation a company does not address.

The Virginia House of Delegates and Senate have passed identical bills.  The legislation now moves to Governor Ralph Northam’s desk.  The Governor could sign them into law, make line-item amendments, or veto them.  Action is expected by the end of March.