Update on Proposed VCDPA Amendments
There was a flurry of activity last week on bills that seek to amend the Virginia Consumer Data Protection Act (VCDPA). In total, Virginia lawmakers are considering eight bills with many of them seeing movement last week.
Among other notable developments, the bills are now aligned on the proposed right to delete exemption language. Further, HB 714, which originally sought to modify the right to cure provision, was revised. Below is a summary:
Right to Delete
HB 381,?SB 393, and?SB 584?seek to add a new exemption to the VCDPA’s right to delete. SB 584 originally contained different language than the other two bills; however, it was incorporated into SB 393. The aligned bills now propose adding the following language to § 59.1-577:
A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data pursuant to subdivision A 3 by opting the consumer out of the processing of that data for targeted advertising, sale, or profiling pursuant to subdivision A 5.
On February 3, the House General Laws Committee voted 21-0 to pass HB 381 out of committee. On February 4, the Senate voted to dispense with the constitutional reading of SB 393. That bill previously was voted out of committee on February 2. As noted, the bill also incorporated SB 584.
Enforcement
As originally offered, HB 714 sought to amend the "right to cure" provision to provide the Attorney General's office with discretion to deem whether a cure is possible. On February 1, a substituted version of HB 714 was offered that removed that provision. That substituted version passed out of a subcommittee of the Committee on Commerce and Energy on February 1.
The as-introduced version of HB 714 also would have allowed the Attorney General's office to seek "actual damages for aggrieved customers." That provision was removed from the substituted version.
Finally, the substituted version would still repeal § 59.1-585, which creates the Consumer Privacy Fund. Section 59.1-584 also would be amended to provide that “[a]ll civil penalties, expenses, and attorney fees collected pursuant to this chapter shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.”
Meanwhile, SB 534 was referred to the Senate Committee on Finance and Appropriations.
Sensitive Data
HB 1259?seeks to amend and restrict the definition of “sensitive data" by making the following change (noted in italics):
Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. However, such data shall only be considered "sensitive data" when used to make a decision that results in legal or similarly significant effects concerning a consumer;
On February 3, a subcommittee of the Committee on Commerce and Energy voted 8-0 to recommend reporting HB 1259.
Definitions of Nonprofit Organization and Political Organization
HB 552?and?SB 516?would expand the VCDPA’s definition of “nonprofit organization” to include “any organization exempt from taxation under § 501 (c)(4) of the Internal Revenue Code that is identified in §?52-41.”
On January 31, the Senate Commerce and Labor Committee voted out SB 516, and the bill was referred to the Finance and Appropriations Committee. HB 552 was referred to a subcommittee of the Committee on Commerce and Energy on January 1.
In addition to those bills, the as-filed version of HB 714 (discussed above) sought to amend the definition of “nonprofit organization” by adding political organizations and defining that term. On February 1, a subcommittee of the Committee on Commerce and Energy voted 8-0 to recommend reporting HB 714 with substitute. The substituted version incorporates the changes proposed by HB 552 and SB 516.