What is the VCDPA (Virginia Consumer Data Protection Act)?
VCDPA stands for the Virginia Consumer Data Protection Act, also commonly referred to as the CDPA. The VCDPA is Virginia’s comprehensive privacy law that grants residents of Virginia specific rights over their personal data.
What rights does the VCDPA provide?
Under the Virginia Consumer Data Protection Act (VCDPA), consumers have six primary rights:
Right of access: the right to confirm whether a controller is processing personal data concerning the consumer and to access the consumer’s personal data.
Right to correction: the right to correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of processing the consumer’s personal data.
Right to delete: the right to delete personal data concerning the consumer.
Right to data portability: the right to obtain personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance.
Right to appeal: businesses must respond to a VCDPA request within 45 days of receipt. It may extend that deadline once after notification by an additional 45 days when reasonably necessary. The consumer has the right to appeal a business’ denial to take action within a reasonable time period.
Right to opt out: Under the VCDPA, consumers have the right to opt out of the processing of personal data for:
- purposes of targeted advertising;
- the sale of personal data; and
- profiling in advancing decisions that produce legal or similarly significant effects concerning the consumer.
The VCDPA defines the “sale of personal information” as “the exchange of personal data for monetary consideration by the controller to a third party.”