{"id":1542,"date":"2021-02-12T16:29:28","date_gmt":"2021-02-12T21:29:28","guid":{"rendered":"https:\/\/encompass-digital.com\/?p=1542"},"modified":"2021-02-12T21:43:08","modified_gmt":"2021-02-13T02:43:08","slug":"virginia-is-about-to-get-a-major-california-style-data-privacy-law","status":"publish","type":"post","link":"https:\/\/encompass-digital.com\/pt\/virginia-is-about-to-get-a-major-california-style-data-privacy-law\/","title":{"rendered":"Virginia is about to get a major California-style data privacy law"},"content":{"rendered":"
\n
\n\n\n\n
\n\n\n\n
<\/td>\n\n

<\/span><\/span><\/o:p><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Virginia is about to get a major California-style data privacy law <\/span><\/a><\/o:p><\/span><\/p>\n

Ars Technica <\/o:p><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/o:p><\/span><\/p>\n

 <\/o:p><\/span><\/p>\n

Virginia is poised to follow in California’s footsteps any minute now and become the second state in the country to adopt a comprehensive online data protection law for consumers.<\/o:p><\/p>\n

If adopted, the Consumer Data Protection Act<\/span><\/a> would apply to entities of a certain size that do business in Virginia or have users based in Virginia. The bill enjoys broad popular support among state lawmakers; it passed 89-9 in the Virginia House and unanimously (39-0) in the state Senate, and Democratic Gov. Ralph Northam is widely expected to sign it into law without issue in the coming days.<\/o:p><\/p>\n

FURTHER READING<\/o:p><\/span><\/h3>\n

California approves privacy rules opposed by ISPs and tech companies<\/span><\/a><\/o:p><\/span><\/p>\n

In the absence of a general-purpose federal privacy framework, states all over the nation are very slowly stepping in with their own solutions. The Virginia law is somewhat modeled on California’s landmark Consumer Privacy Act<\/span><\/a>, which was signed into law in 2018 and took effect on January 1, 2020. Legislatures in several other states—including Minnesota<\/span><\/a>, New York<\/span><\/a>, North Dakota<\/span><\/a>, Oklahoma<\/span><\/a>, and Washington<\/span><\/a>—have some kind of data privacy bills currently under consideration.<\/o:p><\/p>\n

What would the Virginia law do?<\/o:p><\/span><\/h2>\n

The CDPA applies to entities that “control or process” personal information of 100,000 or more Virginia residents in a calendar year or to entities that make 50 percent or more of their gross revenue from the sale of personal data if they hold information about at least 25,000 residents. Basically, the big data brokers and companies with a major online presence would all be covered, but small businesses would not be. Under the law, these entities that determine “the purpose and means of processing personal data” are called “controllers.”<\/o:p><\/p>\n

Covered consumers are also defined very explicitly in the bill, meaning specifically individuals acting on their own or in a “household context.” It does not<\/span><\/em> include actions “in a commercial or employment context.” So if you’re using the Internet at home on your own time, you’re covered; if you’re using the Internet at work for work reasons, you’re not.<\/o:p><\/p>\n

Provided that an interaction does involve a private consumer, a covered business, and covered personal information, however, then Virginia residents would gain a handful of explicit new rights for how their data is handled, including:<\/o:p><\/p>\n

Advertisement<\/span><\/span><\/o:p><\/p>\n