Consumer Data Protection Act; establishes a framework for controlling and processing personal data. (SB1392)

Introduced By

Sen. Dave Marsden (D-Burke) with support from co-patrons Del. Cliff Hayes (D-Chesapeake), Del. Suhas Subramanyam (D-Sterling), Sen. Jennifer Boysko (D-Herndon), and Sen. Siobhan Dunnavant (R-Henrico)

Description

Consumer Data Protection Act. Establishes a framework for controlling and processing personal data in the Commonwealth. The bill applies to all persons that conduct business in the Commonwealth and either (i) control or process personal data of at least 100,000 consumers or (ii) derive over 50 percent of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers. The bill outlines responsibilities and privacy protection standards for data controllers and processors. The bill does not apply to state or local governmental entities and contains exceptions for certain types of data and information governed by federal law. The bill grants consumer rights to access, correct, delete, and obtain a copy of personal data and to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling of the consumer. The bill provides that the Attorney General has exclusive authority to enforce violations of the law, and the Consumer Privacy Fund is created to support this effort. The bill directs the Joint Commission on Technology and Science to establish a work group to review the provisions of this act and issues related to its implementation, and to report on its findings by November 1, 2021. The bill has a delayed effective date of January 1, 2023. This bill is identical to HB 2307. Read the Bill »

Status

03/02/2021: signed by governor

History