Technology (Consumer Data Protection)

Virginia Consumer Protection Act; prohibited practices; consumer reproductive or sexual health information. Provides that, for the Virginia Consumer Protection Act prohibition on obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without consumer consent, such prohibition does not apply to nonpublic personal information subject to the federal Gramm-Leach-Bliley Act.

Consumer Data Protection Act; data controller responsibilities; precise geolocation data. Provides that, for purposes of the Consumer Data Protection Act, a controller of personal data shall not sell or offer for sale precise geolocation data concerning a consumer.

Regulation of data brokers; civil penalties. Prohibits a person from acquiring personally identifiable information, defined in the bill, through fraudulent means or acquiring and using such information for the purpose of (i) stalking or harassing another person; (ii) committing a fraud, including identity theft, financial fraud, or email fraud; or (iii) engaging in unlawful discrimination, including employment discrimination or housing discrimination. The bill requires a data broker, defined in the bill, to develop, implement, and maintain a comprehensive information security program that includes certain features and technical elements. The bill also requires a data broker operating in the Commonwealth, beginning on December 1, 2027, and annually thereafter, to register with the Secretary of the Commonwealth. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act. The bill has a delayed effective date of July 1, 2027.

Consumer Data Protection Act; individual action for damages or penalty; social media platforms. Allows a parent or minor who suffers loss as the result of a violation of Consumer Data Protection Act provisions relating to social media platforms to initiate an action against a controller or processor in violation of such provisions. The bill requires a parent or minor to provide a controller or processor 30 days' written notice and an opportunity for the controller or processor to cure the noticed violation prior to initiating such an action.

Government Data Collection and Dissemination Practices Act; dissemination of personal information to federal government; civil penalties. Provides that any agency or political subdivision of the Commonwealth shall only disseminate personal information (i) to the extent necessary to comply with state or federal law, including the federal Health Insurance Portability and Accountability Act; (ii) to the extent necessary to carry out the administration of a state or federal program pursuant to state or federal law; (iii) to comply with a subpoena, court order, or administrative proceeding; (iv) to the extent necessary to ensure fulfillment of the obligations of a purchase or contract made in accordance with the Virginia Public Procurement Act or a memorandum of understanding or management agreement made in accordance with the Restructured Higher Education Financial and Administrative Operations Act; (v) when the data subject has given consent; or (vi) to the extent necessary to accomplish a proper purpose of the agency. The bill also prohibits an agency or political subdivision from selling personal information. The bill authorizes a court, in the case of a willful and knowing violation, to subject a specific public officer, appointee, or employee of any agency to civil penalties.

Consumer Data Protection Act; prohibitions and duties relating to minors. Prohibits a controller of an online service, product, or feature from entering into certain agreements with a known minor, unless such controller obtains verified consent from the minor's parent as specified in the bill. The bill imposes certain duties on a controller of an online service, product, or feature related to advertising, algorithm use, and reasonable care toward known minors. The bill expands the consumer rights of a parent to minors and adds a provision allowing a parent to obtain a copy of the minor's data. Current law offers certain consumer rights to the parents of children younger than age 13. The bill has a delayed effective date of January 1, 2027.

Surveillance pricing; prohibited; civil penalties. Prohibits the use of surveillance pricing in connection with a consumer transaction. The bill defines "surveillance pricing" as the selling or offering for sale of a good or service at a customized price for a specific consumer or group of consumers that is based, in whole or in part, on personal data that is collected through electronic surveillance technology, regardless of whether the seller collected or purchased the personal data. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act.

Consumer Data Protection Act; protections for children; definitions. Requires a controller or processor, as such terms are defined in relevant law, to obtain verifiable parental consent, defined in the bill, prior to registering any child younger than 18 years of age with the controller's or processor's product or service or before collecting, using, or disclosing such child's personal data.

Employment decisions; automated decision systems; civil penalty. Provides that the Director of the Department of Human Resource Management shall require any state agency that uses an automated decision system as a substantial factor in any employment decision, as those terms are defined in the bill, to (i) ensure that such system and the use of such system complies with federal and state law, (ii) make certain disclosures, (iii) provide an opt-out mechanism, (iv) annually test such system, (v) ensure data security, and (vi) train agency staff on such system. The bill requires the Department and local government employers to establish and publicize a process for applicants for employment and employees to file concerns and complaints regarding the use of automated decision systems in such employment decisions and a process for the investigation and resolution of any such concerns and complaints. The bill also provides that no final employment decision shall be made by an employer without the involvement of a human decision maker, and no employer shall solely use any recommendation or prediction from an automated decision system to make a final employment decision. The bill subjects violating employers to civil penalties.

College student-athletes; biometric data; protections and limitations. Prohibits any private institution of higher education, associate-degree-granting public institution of higher education, or baccalaureate public institution of higher education in the Commonwealth from disclosing to any individual or entity outside of the institution any enrolled student-athlete's biometric data, as defined in the bill, without the prior written consent of the student-athlete. The bill also prohibits any individual or entity from making the possession, use, or ownership of or the rights to any student-athlete's biometric data a condition of any contract with the student-athlete for the use of the student-athlete's name, image, or likeness without the prior written consent of the student-athlete in a writing that is separate and apart from such contract.