Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

West Virginia: Bill on Consumer Data Protection introduced to House of Representatives

On February 26, 2024, House Bill 5698 relating to the Consumer Data Protection Act was introduced to the West Virginia House of Representatives and thereafter read for the first time on the same date. The bill confirms that it aims to establish a framework for controlling and processing personal data in West Virginia. The bill introduces definitions including biometric data, consent, consumer, controller, sensitive data, personal data, and processing.

Scope

The bill applies to persons that conduct business in West Virginia or produce products or services that are targeted to residents of West Virginia and that:

  • during a calendar year, control or process personal data of at least 100,000 consumers;
  • control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data; or
  • have annual gross revenues generated in West Virginia that exceed $25 million.

Consumer rights

The bill provides for consumer rights, including the right to:

  • confirm whether or not a controller is processing the consumer's personal data;
  • access personal data;
  • correct inaccuracies in the consumer's personal data;
  • delete personal data provided by or obtained about the consumer;
  • obtain a copy of the consumer's personal data; and
  • opt out of the processing of personal data for specific purposes. 

Obligations

The bill details data controller responsibilities including data minimization, data security, restrictions on the processing of sensitive data, and transparency requirements, such as the adoption of a privacy notice. The bill also lays down requirements for conducting of data protection assessments in specified circumstances. In addition, the bill details obligations for vendor management, including the conclusion of a contract between controllers and processors, and provides requirements tailored to data processors. 

Enforcement and effective date

The Attorney General of West Virginia has exclusive authority to enforce the provisions of the bill and may initiate an action and seek damages for up to $7,500 for each violation, after the 30-day cure period. The bill would enter into effect on January 1, 2025, upon its passage.

You can read the bill here and track its progress here.

Update: February 28, 2024

Bill on passes House 

On February 28, 2024, the bill passed the House and thereafter was transferred to the West Virginia State Senate.

You can read the bill here and track its progress here.

Update: March 1, 2024

Bill passes House of Representatives, referred to Senate

On February 29, 2024, the bill was introduced to the Senate and, on the same date, referred to the Committee on Judiciary.

You can read the bill here and track its progress here.