Virgina Passes Data Privacy Legislation

Virginia's Consumer Data Protection Act will be effective at the beginning of 2013. It applies to any business which processes the personal data of more than 100,000 consumers, or which earns more than 50% of their revenue from the sale of personal data, while also processing data for more than 25,000 consumers.

Consumers will be able to apply to get access to their data, and also request that it be corrected. A consumer can choose to opt out of having his or her personal data used for processing. Consumer requests have to be responded to within 45 days. An additional 45 day extension may be given for complex requests.

A data controller must provide a consumer with his or her data up to twice a year free of charge. A reasonable fee can be charged for excessive requests, but the controller will have to prove that the request is repetitive or unnecessary.

The Act gives a consumer the right to, "To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means."

If a controller denies a consumer's request, he or she can appeal, and must be notified of a final decision within 60 days. The controller will then have to provide an online system which will allow the consumer to file a complaint with the Virginia Attorney General.