A new consumer data protection bill has been introduced in the Virginia Senate.
Of note:
- “Consumer” terminology is here to stay but the bill uses the General Data Protection Regulation’s terms “personal data” and “processor/controller” with the related obligations as well as some re: data processing agreements
- Consumer rights including knowledge, access, rectification, deletion and opt out of sale or profiling
- Data minimization obligation
- Purpose limitation obligation
- Specific obligation on information security standards
- Obligations involving sensitive information
- Data protection impact assessment
- Definition of precise geolocation data being a radius of 1750 feet
- “Identified” includes link to a device
- “Publicly available information” includes information lawfully made available to the general public unless limited by the consumer
- Enforcement by Attorney General, no private right of action