Senate Bill ('SB') 1392 to Amend the Code of Virginia by adding in Title 59.1 a Chapter Numbered 52, Consisting of Sections Numbered 59.1-571 - 59.1-581, relating to the Consumer Data Protection Act ('CDPA') was introduced, on 13 January 2021, in the Virginia State Senate. In particular, the CDPA aims to establish new definitions including that of precise geolocation data, profiling, targeted advertising, and the sale of personal data. Furthermore, the Bill includes in its scope persons that conduct business in the Commonwealth of Virginia or produce products or services that are targeted to residents of the Commonwealth and that meet one or more of the following requirements:

• during a calendar year, control or process personal data of at least 100,000 consumers; or
• control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. 

Furthermore, the CDPA aims to confer data subjects with industry recognised rights including access, correction, deletion, portability, and opt-out rights. Moreover, the CDPA aims to establish obligations on controllers and processors including rules regarding Data Protection Impact Assessments and the processing of de-identified data. Finally, the Bill mandates enforcement by the Attorney General with civil penalties for non-compliance at $7,500 which will be credited into a newly established Consumer Privacy Fund. If enacted, the CDPA would enter into effect on 1 January 2023.

You can read the Bill and track its progress here.

UPDATE (8 February 2021)

Consumer data protection bill passes State Senate

SB 1392 passed, on 5 February 2021, the Virginia State Senate and was sent to the Virginia House of Delegates for consideration.

You can read SB 1392 and track its progress here.

UPDATE (18 February 2021)

Consumer data protection bill passes State House of Delegates

SB 1392 passed, on 18 February 2021, the Virginia House of Delegates.

You can read SB 1392 and track its progress here.