Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On March 2 Virginia Governor Ralph Northam signed into law the Consumer Data Protection Act (CDPA), which grants Virginia residents new data privacy rights and creates new obligations for how businesses collect and use their personal data. It also grants the Virginia attorney general the authority to impose penalties on noncompliant businesses of up to $7,500 per violation. The law becomes effective on January 1, 2023, the same day another consumer data protection law – <a href="https://www.thompsonhine.com/publications/california-voters-approve-new-data-privacy-law" target="_blank" rel="noopener">the California Privacy Rights and Enforcement Act of 2020</a> (CPRA) – takes effect. The CDPA’s key features and unique requirements are set forth below.

contentpilot/introduction

Scope of applicability. The CDPA only applies to a limited set of organizations (called “controllers”) that collect Virginia residents’ personal data. In particular, it applies to (for-profit) organizations conducting business in Virginia or producing products or services that target Virginia residents, and (i) that control or process the personal data of at least 100,000 consumers or (ii) control or process the personal data of at least 25,000 consumers and derive over 50% of their gross revenue from the “sale” (defined below) of personal data. The CDPA defines “personal data” broadly as “any information that is linked or reasonably linkable to” an identifiable person. On the other hand, it defines “consumer” narrowly as a Virginia resident acting in an “individual or household context.” The CDPA does not apply to personal data concerning an individual acting in the commercial or employment context.

core/paragraph

New data privacy rights. The CDPA creates several new data privacy rights and privileges for Virginia consumers:

core/list

Although the CDPA requires organizations to establish processes to receive and authenticate consumer data requests, it lacks important guidance and criteria in this area. For instance, it mandates that organizations create processes to allow for a consumer to “appeal” a controller’s decision not to honor a data rights request but lacks specificity on how the appellate review must be formulated. Moreover, the CDPA does not substantively address how a controller should address a scenario when it disputes whether a consumer’s personal data is considered “inaccurate” and therefore chooses not to “correct” it. Absent clarifying regulations, controllers should consider leveraging guidance and experience developed by other data protection frameworks that address these same issues.

Online advertising, selling data and profiling. The CDPA furnishes Virginia consumers with the right to opt out of the processing of personal data involving:

The phrase “targeted advertising” means displaying an advertisement to a consumer that is selected based on the consumer’s personal data derived from activities the consumer undertakes “over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests.” With some exceptions, the CDPA defines targeted advertising similarly to how the CPRA defines “cross-context behavioral advertising.” Next, the term “sale” of personal data refers to “the exchange of personal data for monetary consideration.” The CDPA does not, however, incorporate the “other consideration” qualifier that is found in the CPRA. The term “profiling” refers to the automated processing of personal data to evaluate, analyze or predict an individual’s economic situation, health, preferences, interests, reliability, behavior, location or movement that produces legal or similar effects.

Privacy policies and other notices. A controller is required to provide consumers with a “reasonably accessible, clear, and meaningful” privacy notice that describes its data processing activities (e.g., categories of personal data processed and shared, purpose of processing). It must also describe how consumers can exercise their data privacy rights and the controller’s data subject request appeals process. A controller that sells personal data or uses it for targeted advertising purposes has the additional obligation to “clearly and conspicuously disclose such processing” and the manner in which consumers can exercise their opt-out rights. However, it is unclear whether this opt-out disclosure can be included in a controller’s privacy policy or must be set forth in a separate notice.

Consent. The CDPA limits how a controller can use personal data without a consumer’s consent. For example, a controller is prohibited from using personal data in a manner not necessary for or compatible with the purpose the controller disclosed to the consumer, unless it obtains the consumer’s consent. In addition, a controller is prohibited from processing “sensitive data” without obtaining appropriate consent. The CDPA defines “sensitive data” as personal data that (i) reveals a consumer’s racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, (ii) uses genetic or biometric data for identification purposes, (iii) involves personal data collected from a “known child,” or (iv) includes “precise geolocation data,” which itself is uniquely defined in the law.

Data protection assessments. Pursuant to the CDPA, a controller is required to undertake a “data protection assessment” when it engages in data processing involving:

The assessment must incorporate a cost-benefit analysis pertaining to the processing and address several factors related to data security, risk mitigation and consumer expectations. A controller may be required to furnish a copy of its data protection assessment to the Virginia attorney general pursuant to its CDPA compliance investigations.

Data processing agreements. Like many other data protection laws, the CDPA requires a controller to include certain data protection-related clauses in its contracts with organizations that process personal data on its behalf (i.e., “processors”). These clauses must address, among others, the nature, scope and duration of processing; limited data use; confidentiality; proof of compliance; and auditing. Processors must flow-down their obligations when retaining their own subcontractors.

Data security. The CDPA places affirmative data security obligations on controllers. In particular, it requires them to “[e]stablish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.” The CDPA does not define these practices with specificity, and instead requires them to “be appropriate to the volume and nature of the personal data at issue.”

core/heading

The CDPA is similar to, but not exactly the same as, data protection laws enacted in other jurisdictions (e.g., California, the European Union), and a business that is compliant with these existing frameworks should be well-positioned to comply with the CDPA. Yet, given the likelihood that other states may enact data protection laws soon, businesses subject to the CDPA should create a data compliance program in the near term to better ensure that they have the resources available to address future requirements.

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

or any member of our <a href="https://www.thompsonhine.com/services/privacy-and-cybersecurity" target="_blank" rel="noopener">Privacy &amp; Cybersecurity</a> group.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Privacy__Cybersecurity_Update_-_Virginia_Lawmakers_Approve_New_Data_Privacy_and_Cybersecurity_Law.pdf

Virginia Enacts New Data Privacy and Cybersecurity Law

Services