Keypoint: The VCDPA is now finalized in advance of its January 1, 2023 effective date.
On April 11, 2022, Virginia Governor Glenn Youngkin signed three Virginia Consumer Data Protection Act (VCDPA) amendment bills into law. The three bills will go into effect July 1, 2022. With the signing of the bills, the VCDPA’s text is now finalized in advance of its January 1, 2023 effective date.
As discussed more fully below, the bills (1) add a new exemption to the VCDPA’s right to delete, (2) repeal the Consumer Privacy Fund provision and, instead, direct penalties, expenses and attorney fees recovered enforcing the VCDPA to a different fund; and (3) modify the VCDPA’s definition of nonprofit.
Last year, Virginia became the second state to pass consumer data privacy legislation when lawmakers passed the Virginia Consumer Data Protection Act (VCDPA). Prior to the law passing, a provision was added establishing a Work Group to “review the provisions of [the VCDPA] and issues related to its implementation” and submit a report by November 1, 2021. When the VCDPA passed, the Washington Post, citing a legislative press release, reported that the Work Group was established “to continue to strengthen the law’s consumer protections.”
The Work Group met six times from June to August 2021. In its Final Report, the Work Group identified seventeen “points of emphasis” that “arose during the six Work Group meetings.” However, the Work Group did not propose any specific amendments.
After the Virginia legislature opened on January 12, 2022, lawmakers filed eight bills seeking to amend the VCDPA. The bills centered around adding additional exemptions, modifying the law’s definition of sensitive information, and tweaking the enforcement provisions.
Ultimately, Virginia lawmakers passed four bills to amend the VCDPA prior to the March 12, 2022 adjournment date.
Lawmakers passed HB 381 and SB 393 on February 25, 2022 and March 4, 2022, respectively. The bills, which contain identical language, add the following exemption to the VCDPA’s right to delete:
A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete such data pursuant to subdivision A 3 by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the business’s records and not using such retained data for any other purpose pursuant to the provisions of this chapter or (ii) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.
Governor Youngkin approved HB 381, but vetoed SB 393. Given that the bills contain identical language, it is unclear what impact, if any, the veto has. Further, the Washington Post reported that Governor Youngkin vetoed 25 bipartisan bills. That included vetoing 9 of the 10 bills sponsored by Senator Adam Ebbin, while signing identical House bills in 6 of those cases. One of those bills was Senator Ebbin’s SB 393. According to the Washington Post: “Typically a governor signs both versions, allowing both sponsors bragging rights for getting a bill passed into law.”
Lawmakers also passed SB 534 and HB 714, which contain identical language. The bills repeal the Consumer Privacy Fund and provide that all “civil penalties, expenses, and attorney fees collected pursuant to [the VCDPA] shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation and Enforcement Revolving Trust Fund.”
The bills also amend the VCDPA’s definition of “nonprofit organization” to include political organizations and any organization exempt from taxation under § 501(c)(4) of the Internal Revenue Code.” The bills define political organization as “a party, committee, association, fund, or other organization, whether or not incorporated, organized and operated primarily for the purpose of influencing or attempting to influence the selection, nomination, election, or appointment of any individual to any federal, state, or local public office or office in a political organization or the election of a presidential/vice-presidential elector, whether or not such individual or elector is selected, nominated, elected, or appointed.”
With the passage of these bills, the VCDPA’s text is now finalized in advance of its January 1, 2023, effective date. It also is worth noting that the VCDPA does not authorize rulemaking. Therefore, at least in Virginia, organizations can drive compliance with a final text.