Virginia Passes Consumer Data Protection Act

Why This Privacy Law is Important:

On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA) into law. Virginia is the second state to enact a comprehensive state privacy law, following California, yet its substance draws from both California’s laws—the California Consumer Privacy Act (CCPA), and the newly enacted California Privacy Rights and Enforcement Act (CPRA). The Virginia legislature is the first to enact such a law of its own – the California Legislature enacted the CCPA to preempt a ballot initiative in 2018 (and the CPRA was passed as a ballot initiative by California voters).

Overview:

The VCDPA, which will go into effect on January 1, 2023, differs from other enacted state privacy laws, and companies doing business in Virginia or marketing to Virginians will need to reassess their collection and use of consumer personal information and modify their compliance efforts.

Who This Law Applies To:

The law applies to entities that conduct business in Virginia and either (i) control or process personal data of at least 100,000 consumers or (ii) derive over 50 percent of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers

Download the Privacy Alert to the right to get the full text and expert analysis!