Ride the Lightning

Virginia Governor Signs Country’s Second Data Privacy Legislation

March 4, 2021

The Washington Post (sub.req.) reported that Virginia Gov. Ralph Northam signed data privacy legislation into law on March 2, making Virginia the second state in the nation to adopt its own data protection rules.

The Consumer Data Protection Act had broad support from the tech industry, including Amazon, which is building an Arlington, Va., headquarters. The legislation will allow residents of the commonwealth to opt out of having their data collected and sold, much as the California law that went into effect in 2020. Under the new law, Virginia residents can also see what data companies have collected about them, and correct or delete it.

The Virginia law is more industry friendly than the California law. Privacy advocates have called for Virginia to adopt some of California’s provisions that make it easier for people to opt out of data collection from multiple companies. The Virginia law also does not allow individuals to bring lawsuits against tech companies for violations and will be enforced by the state’s attorney general, not a separate enforcement agency.

The law is expected to take effect on January 1, 2023. It requires companies to get permission before collecting particularly sensitive types of data related to racial or ethnic origin, genetic data and geolocation.

Consumer Reports and other privacy advocates previously called on Virginia lawmakers to consider adding a requirement for a global opt-out browser setting, which people could turn on to alert companies that they want as little of their data collected as possible. They also requested that policymakers update the law to ensure that people can authorize outside agents to make requests on their behalf about how companies use their data.

Northam’s administration will have an ongoing work group to continue to strengthen the law’s consumer protections.

Many states, including Washington and New Jersey, are considering privacy legislation. Utah is considering legislation that is very like the Virginia bill.

Frankly, a patchwork of state laws is not desirable. The fact that a patchwork seems to be coming might finally force Congress to adopt federal privacy legislation.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email:  Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson