A padlock on a keyboard, symbolizing data privacy.

Shutterstock (Licensed)

Virginia poised to pass sweeping new data privacy bill

It does have some differences to California's law.


Andrew Wyrich


Posted on Feb 11, 2021   Updated on Feb 12, 2021, 9:09 am CST

Virginia appears poised to become the second state to enact a data privacy bill in the absence of federal rules.

The bill, titled the “Consumer Data Protection Act” would apply to businesses in Virginia that control or process data of at least 100,000 consumers, or derives more than 50 percent of its revenue from the sale of personal data of at least 25,000 consumers.

It also allows for people to access, correct, delete, or get a copy of the data businesses have on them and to opt-out of the collection of personal data that is used for targeted advertising. If signed into law, it would become effective in 2023.

The state’s House of Delegates and Senate both passed the bill, as the Washington Post notes, which would need to be signed by Gov. Ralph Northam (D) to become law.

If it is signed, Virginia’s law would be the second major data privacy bill passed by states. California passed its “California Consumer Privacy Act” in 2018 and it went into effect last year.

However, Virginia’s bill differs in some areas, perhaps most notably with the omission of a private right of action—the ability for consumers to sue companies that violate the law. Instead, the bill leaves enforcement up to the state’s attorney general.

Meanwhile, a group of public advocacy groups including Consumer Reports, EPIC, and the Electronic Frontier Foundation also wrote to Virginia lawmakers last week offering suggestions on how to make the bill stronger.

A private right of action is included in California’s law and has been a major point of contention in talks around a federal data privacy bill. Last year, Democrats and Republicans in Congress both put out a framework for data privacy bills.

Sen. Maria Cantwell (D-Wash.) and other Democrats introduced a bill that would force big tech companies like Facebook and Google to explain what they are doing with user data and allow users to see and delete personal information that was collected. It also allowed users to opt-out of data being transferred to third parties.

That bill also allowed for a private right of action and wouldn’t preempt state laws that go further than it. Sen. Roger Wicker (R-Miss.) circulated a draft of a rival bill that did not include the private right of action and would preempt state laws.

Meanwhile, some lawmakers have proposed creating a new federal agency that would be tasked with enforcing privacy rights.

Read more of the Daily Dot’s tech and politics coverage

Nevada’s GOP secretary of state candidate follows QAnon, neo-Nazi accounts on Gab, Telegram
Court filing in Bored Apes lawsuit revives claims founders built NFT empire on Nazi ideology
EXCLUSIVE: ‘Say hi to the Donald for us’: Florida police briefed armed right-wing group before they went to Jan. 6 protest
Inside the Proud Boys’ ties to ghost gun sales
‘Judas’: Gab users are furious its founder handed over data to the FBI without a subpoena
EXCLUSIVE: Anti-vax dating site that let people advertise ‘mRNA FREE’ semen left all its user data exposed
Sign up to receive the Daily Dot’s Internet Insider newsletter for urgent news from the frontline of online.
Share this article
*First Published: Feb 11, 2021, 10:30 am CST