VA Follows CA And Creates Own Consumer Protection Laws

Gov. Ralph Northam signed data privacy legislation into law on Tuesday, making Virginia the second state in the nation to adopt its own data protection rules.

The law, known as the Consumer Data Protection Act, had broad support from the tech industry, including Amazon, which is building an Arlington, Va., headquarters. The legislation will allow residents of the commonwealth to opt out of having their data collected and sold, similar to a California law that went into effect last year. Under the new law, Virginia resident also can see what data companies have collected about them, and correct or delete it. (Amazon CEO Jeff Bezos owns The Washington Post.)

The Virginia law is widely viewed as more industry-friendly than the California provision, however, and privacy advocates have called for Virginia to adopt some of California’s provisions that make it easier for people to opt out of data collection from multiple companies. The Virginia law also does not allow individuals to bring lawsuits against tech companies for violations and will be enforced by the state’s attorney general, not a separate enforcement agency.

The law is expected to take effect on Jan. 1, 2023. It also would require companies to get permission before collecting particularly sensitive types of data related to racial or ethnic origin, genetic data, and geolocation.

State Sen. David Marsden (D), a sponsor of the bill, said the law’s passage would allow Virginia to “take the lead in data privacy in the United States.”