Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Home - Warner Norcross + Judd LLP

On March 2, 2021, Governor Ralph Northam signed into law Virginia's Consumer Data Protection Act (CDPA). Virginia is now the second state to pass significant data privacy and security legislation, California being the first. The CDPA goes into effect January 1, 2023.

contentpilot/introduction

core/heading

The CDPA applies to persons (which includes legal entities like LLCs, corporations, etc.) that conduct business in Virginia or produce products or services targeted to residents of Virginia and either: 

core/paragraph

core/list

The CDPA includes a list of persons and data that are exempt, including:

Notably, the CDPA exemption for financial institutions governed by the GLBA and covered entities and business associates under HIPAA and HITECH is broader than the exemption found under California's privacy laws, which only exempt the specific data subject to laws like HIPAA or GLBA, and not the entire entity itself. Accordingly, a financial institution doing business in both Virginia and California that otherwise meets the thresholds for the laws in both states to apply, would be subject to California's privacy laws with respect to personal information that is not governed by GLBA (such as website visitor data), but appears to be entirely exempt from Virginia's CDPA.

What Rights Do Consumers Have?

Under the CDPA, consumers are natural persons (i.e., not businesses, but real people) who are residents of Virginia acting only in an individual or household context. A consumer DOES NOT include individuals acting in a commercial or employment context. This is a very significant carve out which means that business to business information and employment information is not subject to the CDPA.

What Will Be Required of Me/My Organization?

How Does This Compare With Other Privacy Laws?

The CDPA does have concepts similar to California's privacy laws and Europe's General Data Protection Regulation (GDPR). For example, under both the CDPA and California law, consumers have the right to know whether their data is being collected, request that their data that was collected be deleted and opt-out of the sale of their personal information. However, unlike California privacy law, the CDPA's enforcement is left solely to Virginia's attorney general and there is no private right of action for consumers.   The CDPA adopted the concepts of data "controllers" and data "processors" from the GDPR, and the CDPA’s data assessment requirements are similar to the GDPR’s data protection impact assessment requirement. But the CDPA is not nearly as comprehensive as the GDPR.   Companies that are in compliance with California’s privacy laws or the GDPR will still need to go through a separate compliance process for the CDPA.

What Are the Penalties For Non-Compliance?

Violations of the CDPA can lead to injunctions, civil penalties of up to $7,500 for each violation, and payment of reasonable expenses and attorneys' fees incurred in connection with the investigation and preparation of a case based on CDPA violations.

For more information on the CDPA and other privacy updates, please be sure to attend Warner’s webinar, the “Mid-Year Data Privacy Legal Update,” on May 25, 2021. You can register <a href="https://www.wnj.com/News-and-Events/Events/Webinar-Mid-Year-Data-Privacy-Legal-Update" target="_blank" rel="noreferrer noopener">here</a>. If you need help complying with the CDPA, please contact Norbert F. Kugele, Lexi M. Woods or any other member of Warner’s Cybersecurity and Privacy Practice Group.

Partner

Norbert F. Kugele

Associate

Alexandra M. “Lexi” Woods

Cybersecurity and Privacy

What You Need to Know About Virginia’s Consumer Data Protection Act

The Warner Norcross + Judd LLP lawyer responsible for the contents of our advertising and this website is managing partner <a href="/people/mark-j-wassink/" aria-label="Mark Wassink">Mark Wassink</a> who can be reached at <a href="mailto:mwassink@wnj.com" aria-label="email Mark Wassink">mwassink@wnj.com</a> or 616.752.2189. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website.

What You Need to Know About Virginia’s Consumer Data Protection Act

professionals