Technology (Cybersecurity)

Regulation of data brokers; civil penalties. Prohibits a person from acquiring personally identifiable information, defined in the bill, through fraudulent means or acquiring and using such information for the purpose of (i) stalking or harassing another person; (ii) committing a fraud, including identity theft, financial fraud, or email fraud; or (iii) engaging in unlawful discrimination, including employment discrimination or housing discrimination. The bill requires a data broker, defined in the bill, to develop, implement, and maintain a comprehensive information security program that includes certain features and technical elements. The bill also requires a data broker operating in the Commonwealth, beginning on December 1, 2027, and annually thereafter, to register with the Secretary of the Commonwealth. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act. The bill has a delayed effective date of July 1, 2027.

Virginia Information Technologies Agency; powers of the CIO; creation of Cyber Civilian Corps. Allows the Virginia Information Technologies Agency (VITA) to select persons to serve as Virginia Cyber Civilian Corp (the Corps) volunteers and Corps advisors and deploy such volunteers to provide rapid response assistance under the direction of VITA upon request of a client affected by a cybersecurity incident, defined in the bill. The bill also establishes an advisory board within VITA to review and make recommendations regarding the creation and administration of the Corps. The bill instructs the Chief Information Officer to consult with the advisory board in decisions related to deployment of the Corps during cybersecurity incidents.