Finalized Amendments to the Virginia Consumer Data Protection Act – By Evan Enzer

Virginia finalized the Virginia Consumer Data Protection Act (VDPA) last month when Gov. Glenn Younkin signed two bills amending the law ahead of its January 2023 effective date. This marks the end of the amendment process that began in November of last year when the state’s VDPA Working Group issued its final report on “best practices and recommendations.”

One bill, H 381, alters data subjects’ right to delete data that controllers acquire from third parties. Now, controllers can fulfill the subject’s request to delete by either (1) “retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the business’s records and not using such retained data for any other purpose pursuant to the provisions of [the VDPA];” or (2) “opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of [the VDPA].” In effect, data controllers may now opt-out subjects from processing instead of deleting third-party data.

According to the International Association of Privacy Professionals, Virginia made this change after data aggregators expressed that they would struggle to maintain VDPA compliance because they might indirectly collect a particular consumer’s data after receiving a deletion request from that consumer. While the new bill simplifies compliance, it may also open loopholes that allow brokers to use personal data in ways that fall outside the VDPA’s definition of “processing.”

Another amendment, S 534, eliminates Virginia’s Consumer Privacy Fund and instead directs funds to the State Treasury’s Consumer Advocacy, Litigation, and Enforcement Trust. The same bill also amends the VDPA’s definition of a “non-profit organization” to include political organizations, meaning the VDPA will not apply to these groups. This will be a significant relief for political organizations that have come to rely on personal data for voter outreach and strategizing in recent years.

With the amendments process over, attorneys and other professionals can confidently advise their clients on VDPA compliance ahead of its 2023 effective date.