Virginia Lawmakers Poised to Pass New Rules for Internet Privacy

The two chambers will exchange their bills in a so-called crossover period in the coming days. But lawmakers behind the proposals say any last-minute amendments will likely be minor.

“These bills started out being exactly the same,” said Delegate Cliff Hayes Jr., who introduced the House proposal. “If there aren’t any major changes [going forward], I can’t see why votes would change.”

Virginia is among a handful of states, including Washington and Minnesota, considering new privacy protections. Since California lawmakers passed landmark legislation in 2018, many executives and industry groups have warned that a state-by-state approach to data protection in lieu of a federal standard could prove costly for businesses.

Lawmakers plan to reconcile the two bills as the commonwealth’s shortened legislative session comes to a close this month and could send a final version to the governor’s desk within weeks. The Consumer Data Protection Act would take effect on Jan. 1, 2023.

The proposal would allow Virginians to obtain, correct and delete data collected by businesses that handle the personal information of at least 100,000 consumers annually, with a lower threshold of 25,000 consumers for companies that sell data for most of their revenue. Virginians could also opt out of the sale of their personal data or data processing for the purpose of targeted advertising.

Virginia’s attorney general would enforce the proposed law and be able to seek damages of up to $7,500 per violation. Unlike in California, where residents have a limited private right of action, individual consumers in Virginia wouldn’t have the right to sue companies over any violations of the law. That was a key point of concern from Virginia’s business community, said Sen. David Marsden, who introduced the Senate bill.

“I was hearing that right from the get-go that that was the problem that we needed to avoid,” Mr. Marsden said, adding that he worked closely with trade groups and businesses such as Amazon.com Inc. on the bill.

Amazon, which recently unveiled plans for a new headquarters in northern Virginia, said it supported the proposal in a letter to the Senate tech committee chair last month.

“We believe that policy makers and companies like Amazon have very similar goals—protecting consumer trust and promoting innovation that serves all of us,” wrote Bill Way, Amazon’s assistant general counsel for privacy.

Write to David Uberti at [email protected]