A new consumer data protection bill has been introduced in the Virginia Senate.

Of note:

  • “Consumer” terminology is here to stay but the bill uses the General Data Protection Regulation’s terms “personal data” and “processor/controller” with the related obligations as well as some re: data processing agreements
  • Consumer rights including knowledge, access, rectification, deletion and opt out of sale or profiling
  • Data minimization obligation
  • Purpose limitation obligation
  • Specific obligation on information security standards
  • Obligations involving sensitive information
  • Data protection impact assessment
  • Definition of precise geolocation data being a radius of 1750 feet
  • “Identified” includes link to a device
  • “Publicly available information”  includes information lawfully made available to the general public unless limited by the consumer
  • Enforcement by Attorney General,  no private right of action

Read the full text of the bill.