United States of America: Adoption of Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act is adopted by both chambers of the state parliament. The bill establishes new requirements for personal data processing and security and applies to entities that are based in the State; produce or advertise their services to the residents of Virginia; and process or control personal data of at least 100,000 consumers. In cases where 50% of the entity's gross revenue is generated by selling or processing personal data, the threshold is set at 25,000 consumers. Furthermore, the act expands the consumers' rights, granting the right to correct, delete, opt-out from processing personal data for targeted advertising, sale or profiling. Finally, it gives the Attorney General the power to enforce the law and creates the Consumer Privacy Fund to provide support investigations conducted by the Attorney General.