Virginia Amended the Consumer Data Protection Act

Three amendments to the Virginia Consumer Data Protection Act (“VCDPA”) were signed last week by the Governor which finalizes the text of the law thereby ending the amendment phase of this law. The effective date stays the same for January 1, 2023. The amendments make changes to the right to delete, add political organizations to the definition of excluded nonprofits, and repeals the consumer privacy fund, remitting payments instead to a preexisting state fund. One of the key amendments was changing a consumers’ right to delete into a right to opt-out of processing by data brokers. The original VCDPA (§ 59.1-577(A)(3)) granted consumers the right to compel controllers to delete data originally provided by or collected about consumers. This right applied even if the controller obtained the personal data from a source other than the consumer.