Virginia has become the second state to enact a broad multi-rights privacy bill. The Virginia Consumer Data Protection Act (VCDPA), which takes effect on January 1, 2023, passed by an overwhelming margin. Employers should consider the implications of VCDPA for existing privacy programs and how this differs from the California Consumer Privacy Act (CCPA). The new law contains several new requirements that add operational challenges, including broader affirmative consent or an opt-in requirement; a broader opt-out right; mandatory data protection assessments; an obligation to confirm processing and broader deletion requirement; a conspicuously disclosed, mandatory right of appeal process; specific processor role-based requirements; and different data minimization standard for controllers. The bill also contains broader sectoral exemptions than CCPA and CPRA.
