Second State Passes Consumer Data Privacy Act

• Pages: 14-15
• Date: 01 July 2021
• Author: Aubrey Eyrolles
• Subject Matter: Civil Law

Published in Litigation News Volume 46, Number 4, Summer 20 21. © 2021 by the American Bar A ssociation. Repro duced with permissi on. All rights reser ved. This informati on or any portion the reof may not be copie d or disseminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

Photo Illustra tion by Elmarie Jara © G etty Images

Second State

Passes Consumer

Data Privacy Act

By Aubrey Eyrolles, Litigation News Contributing Editor

A

second state has enac ted sweeping privacy legislation

that gives consume rs more control over the persona l

data that companie s collect. Though Virgin ia’s new

Consumer Data Pr ivacy Act (CDPA) does not provide

consumers with a pr ivate right of action, fa ilure to comply

with its provisions may resu lt in state enforcement actions

and hefty  nes. ABA Litigat ion Section leaders predict that

litigators may be able to use the C DPA to consumers’ advan-

tage in common law privacy a ctions and advise bus inesses to

immediately be gin assessing how they will comply wit h the

new law before it goes into effe ct on January 1, 202 3.

Consumer Rights under the CDPA

The CDPA provides consumer s with the following rights with

respect to their p ersonal data: (1) conrm whether a busines s

is processing it or has ac cess to it; (2) correct inaccuracie s; (3)

ask the business to dele te it; (4) opt out of the data being sold

or used for targete d advertising; and (5) request a copy of the

data. Business es have 45 days to respond to those consumer

requests and, if re asonably necessary, may extend that tim e

period by an additiona l 45 days.

The Scope of the CDPA

The statute applies to “per sons that conduct busin ess in the

Commonwealth or produc e products or servic es that are tar-

geted to residents of the Com monwealth” who also meet one

of the two following requ irements during a calendar year :

(1) control and process the persona l data of at least 100,0 00

consumers, or (2) control and pro cess the personal data of

at least 25,00 0 consumers and derive at le ast 50 percent of

their gross revenue f rom the sale of persona l data. “Personal

data” is dened as “any infor mation that is linked or reason-

ably linkable to an identi ed or identiable natural person ,”

but excludes it any “de-identied data o r publicly available

informat ion.”

Certain ent ities and types of data are exempt, t hough.

Exempt entities include (1) Virgi nia public agencies, (2)

nancial i nstitutions regulated by the Gram m-Leach-Bliley

Act (GLBA), (3) entities covered under t he Health Insu rance

Portability and A ccountability A ct (HIPAA) or t he Health

Information Technology for E conomic and Clinical Hea lth

Act (HI TECH Act), (4) nonprot organi zations, and (5)

higher education in stitutions. The statute also exempt s cer-

tain categorie s of data, including employee a nd job applicant

14 | SECTION OF LITIGATION