Virginia signed the Virginia Consumer Data Protection Act (VCDPA) into law on March 2, 2021, and became the second state after California to officially enact comprehensive consumer data privacy legislation. The VCDPA gives Virginians the right to access their data and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments related to processing personal data for targeted advertising and sales purposes.
On April 11, 2022, Virginia Gov. Glenn Youngkin approved amendments to the VCDPA ahead of its Jan. 1, 2023, effective date, with a goal to provide clarity for companies preparing to comply with the new law.
In summary, the approved amendments add an exemption to the law’s right to delete, modify its definition of “nonprofit,” and alter the funding structure for enforcement. Read on to learn more about the VCDPA amendments and understand how they may impact the work of in-house counsel, attorneys, and legal professionals advising clients on the VCDPA’s implementation.
What VCDPA amendments were approved?
Following the VCDPA’s passage in 2021, the Virginia legislature created the VCDPA Work Group of the Joint Commission on Technology and Science to study findings, best practices, and recommendations prior to the January 2023 implementation of the act. The approved VCDPA amendments were inspired by the Work Group’s final report, which was produced after six meetings were convened in 2021.
‘Right to delete’ exception
The VCDPA gives consumers the right to delete and empowers Virginians to request the deletion of personal data. The first set of amendments (SB 393 and HB 381) establishes an exception to the VCDPA’s right to delete, which applies in instances where personal data is collected from a source other than the consumer. Under this exception, data may be considered deleted in instances where either:
- A minimal record of the deletion request is retained for the exclusive purpose of ensuring the consumer’s data is/remains erased; or
- The consumer has opted out of all nonexempt data processing activities (e.g., targeted advertising and sales).
Elimination of the Consumer Privacy Fund
The original VCDPA legislation called for the creation of a Consumer Privacy Fund that would have stored civil penalties collected from enforcement of the law. The second set of amendments (SB 534 and HB 714) eliminates the Consumer Privacy Fund and diverts all funds collected under this law to the state treasury’s Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.
These amendments also redefine VCDPA-exempt “nonprofit organizations” to include tax-exempt political organizations. Find out which entities are exempt from VCDPA.