Virginia governor signs comprehensive data privacy law

Virginia Gov. Ralph Northam (D) signed the Consumer Data Protection Act on Tuesday, making Virginia the second state in the U.S. to pass a comprehensive data privacy law. 

The bill will give consumers the right to opt out of having their personal data processed for targeted advertising and the right to confirm if their data is being processed. 

State Sen. David Marsden (D), who introduced the bill, cheered Northam’s signing. 

“This is a huge step forward. By creating this omnibus bill, we take the lead in data privacy in the United States. This omnibus bill is clear, concise, and holds companies accountable for protecting consumer data in providing protections for consumers,” Marsden said in a statement. 

A spokesperson for Northam did not immediately respond for comment. 

The law will go into effect in 2023 and applies to all businesses that control or process the proposal data of at least 100,000 consumers, derive more than 50 percent gross revenue from the sale of personal data or process the personal data of at least 25,000 consumers. 

Virginia’s bill follows in the footsteps of a privacy bill California passed in 2018. California expanded on its law in November through a ballot measure. 

Unlike California’s bill, however, Virginia’s lacks a private right of action, meaning individuals are limited in their ability to sue and the enforcement is largely left up to the state attorney general. 

Other states are also considering data privacy proposals. 

In Washington, lawmakers restarted a debate on a privacy bill that is similar to Virginia’s. New York Gov. Andrew Cuomo (D) has also backed similar legislation, and Oklahoma and Utah are also weighing their own.