On January 1, 2023, the Virginia Consumer Data Protection Act (VCDPA) will go into effect. With passage of the law earlier this year, Virginia joined Colorado and California as the only states to enact comprehensive privacy legislation. The VCDPA includes components similar to the California Privacy Rights Act (CPRA), including providing certain rights to Virginia residents, creating obligations for companies doing business in Virginia, and giving significant enforcement authority to the Virginia Attorney General. However, like the Colorado Privacy Act (CPA) discussed in a previous client alert, the VCDPA does not include employee personal data. Organizations should kickstart compliance efforts now to avoid regulatory scrutiny.
Covered Entities. Similar to the CPRA, the VCDPA establishes thresholds to determine applicability. In particular, the VCDPA applies to entities that conduct business in Virginia or produce products or services targeted towards Virginia residents and that control or process personal data of at least:
(1) 100,000 consumers during the calendar year or
(2) 25,000 consumers and derive over 50% gross revenue from the sale of personal data.
Unlike the CPRA, there is no revenue threshold which means that large businesses that don’t meet these requirements can avoid obligations under the VCDPA. The VCDPA also provides exemptions for: (1) Virginia State agencies and bodies, (2) financial institutions or data subject to...
For years, Democrats and Republicans have debated the significance of the laptop, which was left for repair at a Delaware shop. Today at 3:52 p.m. EDT The Justice Department on Friday charged two f...