Last week, Virginia Gov. Glenn Youngkin signed three amendment bills to the Virginia Consumer Data Protection Act into law, finalizing the text of the law ahead of its Jan. 1, 2023, effective date. The bills change the right to delete, add political organizations to the definition of excluded nonprofits, and repeal the VCDPA consumer privacy fund, remitting payments instead to a preexisting state fund. Youngkin vetoed a fourth VCDPA amendment bill even though it was identical to one of the three he signed.

Youngkin’s signature marks the end of the VCDPA amendment process, during which the General Assembly considered 10 bills to change the law. Much of the amendment process was driven by the findings of the Assembly’s legislative workgroup, which was assigned to offer implementation suggestions ahead of the January effective date. Many of the bills submitted to the Assembly were guided in part or in full by the workgroup’s insights, including the amendments signed into law.

With the VCDPA amendment process complete, let’s take a look at how the three amendment bills change the overall statute.

The first major amendment to the law concerns the right to delete. As mentioned earlier, one of the key amendments was changing consumers’ right to delete into a right to opt out of processing by data brokers.

Prior to the amendments, the VCDPA (§ 59.1-577(A)(3)) granted consumers the right to compel controllers to delete data originally provided by or collected about consumers. This right applied even if the controller in question obtained the personal data from a source other than the consumer. (This article refers to such controllers as “data brokers” rather than “third parties,” because third parties are defined narrowly under the VCDPA and do not include controllers, processors or affiliates of either.)

This amendment created a new exemption for data brokers by not requiring them to delete original data, but instead opt consumers out of the processing altogether. Specifically, the law now says:

“A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data ... by either

• retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the business's records and not using such retained data for any other purpose pursuant to the provisions of this chapter; or
• opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.”

Changing the right to delete into a right to opt out of processing reflects a key concern among the Virginia legislative workgroup about the need to preserve consumers’ ability to control their data on the one hand while promoting widespread compliance on the other.

The workgroup’s final report released last November quoted a representative from LexisNexis, a major data brokerage, by saying that all brokers will struggle to maintain VCDPA compliance with consumers’ deletion requests, given the complexities of deleting consumers’ original data. According to the representative, brokers can conceivably recollect consumer data through subsequent indirect collection, which could result in VCDPA noncompliance. This likelihood is supported by the fact that the VCDPA expressly exempts publicly available information from its definition of personal data. The practical impact of this amendment bill is that brokers will not be required to delete original consumer data, but, upon verifiable request, they are prohibited from processing it.

“Processing” under the VCDPA, however, is a defined term, and there are many exceptions, notably for deidentified data.

Processing is defined as “any operation ... performed, whether by manual or automated means, on personal data ... such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.” (VCDPA § 59.1-575) The VCDPA exempts deidentified data from its definition of personal data, given that requests cannot be completed due to the unverifiable nature of deidentified data.

Another exception exists for pseudonymized data. Consumers’ rights under the VCDPA (which includes the bill’s right to opt out of processing) also do not apply to personal data that has been pseudonymized. Controllers, including brokers, may process pseudonymized data provided the controller can demonstrate technical and organizational controls that would prevent the controller from accessing such information (VCDPA § 59.1-581).

In sum, amending consumers’ right to delete into a right to opt out of processing seems to be intended to promote widespread compliance while preserving consumers’ ability to control the dissemination of their personal data across the internet. However, important exceptions exist to the term processing, the scope of which turns on the identifiability (or lack thereof) of the personal data in question.

The second amendment changes the definition of nonprofit organization. The law generally exempts nonprofits, but the amended definition now includes all political organizations, defined as:

“(A) party, committee, association, fund, or other organization, whether or not incorporated, organized and operated primarily for the purpose of influencing or attempting to influence the selection, nomination, election, or appointment of any individual to any federal, state, or local public office or office in a political organization or the election of a presidential/vice-presidential elector, whether or not such individual or elector is selected, nominated, elected, or appointed.”

This wide definition means that practically any political organization is now exempt from the VCDPA in a state with considerable electoral significance in presidential elections.

The final amendment repeals the Consumer Privacy Fund and provides that all civil penalties and attorney fees will be deposited into an existing state treasury and credited toward the Regulatory, Consumer Advocacy, Litigation, and Enforcement Revolving Trust Fund.

The VCDPA is the nation’s second state-level consumer privacy law after the CCPA, but major differences exist. Unlike its California counterpart, the now-final text of the VCDPA does not include rulemaking authority. This means that controllers and those subject to VCDPA scope can reasonably rely on the meaning of the text without considering the variable of rulemaking in the near future. In other words, compliance proceeds with confidence ahead of the Jan. 1 start date.

Photo by STEPHEN POORE on Unsplash