Virginia Enacts Omnibus Privacy Law

Womble Bond Dickinson

Womble Bond Dickinson

On March 2, 2021, Governor Northam made Virginia the second state in the U.S. to enact a comprehensive privacy law, Virginia's Consumer Data Protection Act (CDPA).  We will follow-up with more discussion on how this impacts your business in the lead-up to the law's effective date (January 1, 2023, the same as CPRA), but here are a few highlights:

  • Individuals protected: CDPA regulates data related to Virginia residents in their individual or household capacity.  It specifically exempts individuals acting in a commercial or employment context (i.e., B2B or employee data).  
  • Regulated entities: CDPA regulates "controllers" and "processors" that meet this test: individuals or entities that conduct business in Virginia or produce products or services that are targeted to Virginia residents and meet one of two thresholds: (1) control or process personal data of at least 100,000 consumers or (2) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of that data.  CDPA does not apply to Commonwealth agencies or political subdivisions of the Commonwealth, entities or data subject to the Gramm-Leach-Bliley Act, covered entities or business associates governed by HIPAA, non-profits or institutions of higher education.  
  • Enforceability: CDPA does not include a private right of action.  The law may only be enforced by the Virginia Attorney General's Office.  Entities have a 30-day notice and cure period to remedy any violations of the law before the AG can initiate an enforcement action.  

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Womble Bond Dickinson | Attorney Advertising

Written by:

Womble Bond Dickinson

Womble Bond Dickinson on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.