Virginia Amends the Virginia Consumer Data Protection Act (“VCDPA”)

Written by: Richard Sheinis, Esq.

As many of you know, the VCDPA is scheduled to go into effect on January 1, 2023.  In advance of the effective date, the Virginia Legislature has passed several amendments to the Act.  The amendments are as follows:

1. 1. A new exemption to the right to delete when the personal data about a consumer has been obtained from a source other than the consumer.  When such a request is received from a consumer, the business may either (1) retain a record of the deletion request and the minimum data necessary to ensure the personal data remains deleted from the business’ records and not use the retained data for any other purpose; or (2) opt the customer out of the processing of the personal data for any purpose except for those exempted pursuant to the Act.
   2. The provision regarding the Consumer Privacy Fund was repealed and penalties, expenses and attorney fees recovered through the enforcement of the VCDPA shall go to a different fund.
   3. VCDPA’s definition of non-profit was expanded to include any organization exempt from taxation under Section 501(c)(4) of the Internal Revenue Code.

It is noteworthy that unlike the CCPA, the VCDPA does not provide for rulemaking by the Attorney General.  Therefore, compliance will be determined based upon the Act itself, not rules passed by a government office or agency.