The Governor of Virginia signed, on 11 April 2022, House Bill ('HB') 381 to amend §59.1-577 of the Virginia Consumer Data Protection Act of 2021 ('CDPA') with the respect to the right to deletion of personal data. More specifically, HB 381 provides for consumer's personal data rights including:

• to access personal data;
• to correct innacurate personal data;
• to delete personal data provided by or obtained about the consumer; and
• to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling of the consumer.

In addition, HB 381 stipulates that a controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data by opting the consumer out of the processing of that data for targeted advertising, sale, or profiling pursuant to §59.1-577(A) of the CDPA.

As such, HB 381 will become effective on 1 January 2023.

An identical bill, Senate Bill ('SB') 393, received a veto from the Governor and was not signed, with the Governor noting the lack of necessity as SB 393 is identical to the approved HB 381.

You can read HB 381 and view its history here.