VCDPA is the second major privacy law in the United States of America after the California Privacy Rights Act (CCPA), both of which are following the European GDPR model.

Following this trend, many states are soon to pass their own legislation regarding privacy and personal data security.

Who is the VCDPA addressed to?

The VCDPA targets all institutions, organizations, or entities  “who conduct business in the commonwealth of Virginia or produce products or services that are targeted to residents of the Commonwealth” and whom over the period of a year either:

“(1) control or process personal data of at least 100,000 Virginia residents, or (2) derive over 50% of gross revenue from the sale of personal data (though the statute is unclear as to whether the revenue threshold applies to Virginia residents only) and control or process personal data of at least 25,000 Virginia residents.”

So if you have a website that targets people from Virginia, make sure you are complying with this future legislation by:

• Updating your notices.
• Implementing data minimization.
• Setting up a possible appeal method.
• Providing the option to opt-out for sensitive data.
• Evaluating your privacy, security, and reporting procedures.

VCDPA Rights and Obligations

Similar to the other previous privacy laws, VCDPA defines the rights of the consumers, as in the individuals whose data is being collected, and the obligations of the controllers, the entities that gather and store this data. 

According to the Virginia Consumer Data Protection Act, individuals have the right to:

1. Confirm whether their personal data is being processed by a controller;
2. Correct inaccuracies in their data;
3. Delete personal data obtained from or about the consumer;
4. Obtain a copy of the data the consumer previously provided the controller in a portable and “readily usable” format; and
5. Opt-out of data collection if the data is collected “for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

While the controllers must make sure to:

1. Limit collection of personal data to what is “adequate, relevant, and reasonably necessary” related to the purposes of processing, which must be disclosed to the consumer;
2. Refrain from processing personal data for any other purpose than those disclosed, unless the consumer consents;
3. Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data.
4. Not process personal data in violation of anti-discrimination laws, or discriminate against consumers for exercising any consumer rights under the CDPA.
5. Refrain from processing “sensitive” consumer data without a consumer’s consent.
6. Provide clear and conspicuous notice to consumers of any sale of personal data to third parties or processing for targeted advertising, and the manner for opting out of such activity.
7. Create and provide in the privacy notice “one or more secure and reliable means for consumers to submit a request to exercise their consumer rights” that must “take into account the ways in which consumers normally interact with the controller” and the need for “secure communication of such requests.
8. Provide consumers with a “reasonably accessible, clear, and meaningful privacy notice” that includes: 

• The categories of personal data processed by the controller;
• The purposes for processing the personal data
• How a consumer may exercise their CDPA rights, and how they may appeal a controller’s decision regarding a request;
• The categories of data the controller shares with third parties;
• The categories of third parties the controller shares data with.

CCPA and VCDPA comparison

In this next part, we will discuss the similarities and differences between CCPA and VCDPA. 
Let's start with the definition of personal data.

According to CCPA, it is information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, while the VCDPA defines it as any information that is linked or reasonably linkable to an identified or identifiable natural person.

In terms of penalties and fines, both laws state that non-compliant businesses will have to pay casualties of up to $7,500 per violation, which is very low compared to the GDPR fines.

According to the CCPA data processing activities that might be considered of significant risk to consumer privacy will annual audits and assessments, while for VCDPA data protection assessments need to be conducted when:

1. processing personal data for the purposes of targeted advertising; 
2. selling personal data;
3. processing personal data for purposes of profiling (in certain contexts);
4. processing sensitive data; or
5. conducting any processing activity that presents a heightened risk of harm to consumers.

You can see a more detailed comparison between VCDPA and CCPA here.

In order to be fully privacy compliant, we recommend you start by installing a website analytics tool that guarantees data security.

TWIPLA is one of those tools as it does not use cookies to track your visitors and it does not share the data with any third parties. You have full control over the personal information you collect.