Virginia's Consumer Data Protection Act (CDPA)

Personal Data under CDPA is broad and relatable to the CCPA and GDPR. It excludes de-identified and publicly available information.
The CDPA defines a consumer as someone acting in an individual or household context, and it expressly does not include “a natural person acting in a commercial or employment context.” It also exempts personal data collected from job applicants.

“Sensitive data” means “a category of personal data that includes”:

• Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
• The processing of genetic or biometric data for to uniquely identify a natural person;
• The personal data collected from a known child; or
• Precise geolocation data.

The CDPA provides the following consumer rights:

• Right to confirm whether the controller is processing personal information.
• Right to access personal data.
• Right to data portability (i.e., data must be provided in a readily usable format so that it can be transferred from one entity/platform to another).
• Right to correct inaccurate personal data.
• Right to delete personal data.
• Right to opt-out of targeted advertising.
• Right to object to automated profiling and decision-making that results in legal or significant effects concerning the consumer.
• Right to non-discrimination for the exercise of these rights.
• Right to opt-out of sales of personal data.

​Whereas the CDPA requires that the organizations “authenticate” consumer data requests, it does not provide guidance or a description of how such authentication should be accomplished.

Virginia’s CDPA requires businesses to conduct and document “data protection assessments” for certain types of data practices, including the processing of personal data for targeted advertising, the processing of sensitive data, and any processing activities with potential risk to harm the consumers. Data protection assessments must be carried to show the benefits and risks arising from these practices. These assessments must be made available to the Virginia Attorney General upon request.

Controllers require consumer’s consent before processing any sensitive data under Virginia Consumer Data Protection Act.
Consent, as defined similarly under GDPR and CPRA means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer and may include a written statement, including a statement written by electronic means, or any other unambiguous, affirmative action.