Getting your Trinity Audio player ready...

BY HYUNG JUN LEE

Capital News Service

Information technology experts say a new Virginia consumer data protection law could be more robust, but it will force businesses to rethink how they handle consumer data.

“This is the first time in Virginia consumers will have the right to understand what data a company collects about them and how they use that data and who they share it with,” Andrew Miller, the co-founder of Workshop Digital, a Richmond-based digital marketing agency, said.

Senate Bill 1392 and House Bill 2307 are known as the Consumer Data Protection Act, or CDPA. The governor signed both bills into law this month.

The CDPA allows Virginia residents to retrieve a copy of their personal online data and delete the data. Consumers can opt out of allowing businesses to sell their data.

Personal data is information that can be linked to a consumer’s profile, according to Joseph Jerome, director of state advocacy at San Francisco-based Common Sense Media. The nonprofit rates movies, TV shows and other media for age appropriateness and learning potential.

“It’s important to have a broad understanding of personal data,” Jerome, a lawyer whose expertise includes cybersecurity and data privacy, said.

WHAT DATA WILL BE AFFECTED

The law defines personal data as information that is linked or reasonably linkable to a person.

“Consumers tend to think of personal information as something like their Social Security number or an email address, but new privacy regulations are really trying to get at the sorts of data that go into customer profiles,” Jerome said.

A company can attach traits to a user, such as the individual’s perceived race, education level and political affiliation, according to Jerome.

“The issue isn’t so much what one single company collects, but rather how companies share data among themselves and use that information to infer even more about us,” he said.

Some companies track consumers’ location.

“If a person is at location A at time Y and location B at time Z, if those two locations are coordinates for your home and office, it’s pretty easy to infer who that person is,” Jerome said.

The CDPA impacts companies which handle the data of at least 100,000 consumers annually, or which control or process the data of at least 25,000 consumers and make over half of their gross revenue from selling data.

CDPA EXCEPTIONS

There are exceptions. Companies won’t have to participate if they are protected by the Health Insurance Portability and Accountability Act which restricts the release of medical information or the Gramm-Leach-Bliley Act to protect health and financial data. The GLBA requires financial institutions to safeguard sensitive banking information.

“So in certain scenarios, Google is a business associate under HIPAA,” Jerome said. “Apple offers financial products on its iPhone, you know, has the Apple credit card.”

The Virginia measure is different from the 2018 California Consumer Privacy Act. The California law also regulates how companies buy, sell, license and share data but with stricter parameters in place. California voters recently voted to amend and strengthen the privacy act, with the changes going into effect in 2023. Unlike the Virginia law, California consumers can pursue legal action for a breach of certain information. In Virginia, the attorney general’s office would handle the enforcement of the CDPA, from consumer complaints to the enforcement of fines.

The California law impacted businesses in Virginia, such as Richmond-based IT consulting firm CapTech. The company helps clients bring IT systems into compliance with the California law, said CapTech Principal Peter Carr.

“It affected our business in that it gave us more opportunities to sell into our clients and to help them with their problems around privacy,” Carr said.

BUSINESSES PREDICT IMPACT

CapTech is preparing for Virginia’s new data protection law to go into effect.

“I briefed my partners on the law, we made some projections as to how much business we could generate from this law and how many clients this could apply to,” Carr said.

Other experts in the data field speculate that the CDPA could force businesses to rethink the value of consumer data. Miller, the co-founder of Workshop Digital, said companies can highlight how they protect consumer data to stand out from competitors.

“When you’re telling your customers that we actually care about your data, we keep it secure, here’s how you can access it and what you can ask for us to remove, then I think it shows that the business is aligned with the customer,” Miller said.

He also said the CDPA could move the focus from collection of data to the protection of consumer data.

“If it passes as it’s written now, it’ll mostly affect larger businesses or companies that aggregate and collect a lot of data about Virginia consumers or citizens,” Miller said. “It’ll force companies to rethink how they capture data, what they use it for, how much data they actually need and start to pivot towards having a privacy-driven message to their consumers.”

Consumers will have the ability to exert some control over how their data is used by businesses and across the internet, according to Randy Franklin, the vice-president and general manager at Terazo, a Richmond-based software and platform development company.

“This bill is important for consumers because consumers are increasingly aware of the fact that they are tracked in their online activities,” Franklin said. “They want to understand that the information that these providers and businesses are collecting on them is used in a manner that aligns with how they would like to see that information be used.”