Virginia privacy law (VCDPA): consumer rights

Key points

1. Rights to confirm and access, correct, and delete personal data.

   Section: § 59.1-577(A)(1) to (3)

2. Portability covers data the consumer previously provided to the controller, where processing is automated.

   Section: § 59.1-577(A)(4)

3. Opt-outs: targeted advertising, sale (for monetary consideration only), and profiling in furtherance of decisions with legal or similarly significant effects.

   Section: § 59.1-577(A)(5)

4. Response within 45 days; one 45-day extension if reasonably necessary, notified within the first period.

   Section: § 59.1-577(B)(1)

5. Free of charge up to twice a year per consumer; fee or refusal allowed for manifestly unfounded, excessive or repetitive requests.

   Section: § 59.1-577(B)(3)

6. Appeal decided in writing within 60 days; on denial, the controller must give a way to complain to the Attorney General.

   Section: § 59.1-577(C)

7. A parent or legal guardian may exercise a known child's rights.

   Section: § 59.1-577(A)

8. Contract terms that waive or limit consumer rights are void.

   Section: § 59.1-578(B)

Sources

• https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577/
• https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

• Article 15: Right of access by the data subject (access)
• Article 17: Right to erasure (‘right to be forgotten’) (deletion)
• Article 20: Right to data portability (portability)