Glenn Brown reports that  today Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (the “Act”) into law, though the Act will not go into effect until January 1, 2023.  With this groundbreaking development, Virginia becomes the second state in the United States to enact a data privacy law that purports to regulate the collection, use, and disclosure of the personal data of its residents generally.  For a comprehensive overview of the Act, check out Glenn‘s fantastic, comprehensive analysis here.

The Act provides rights to natural persons who are Virginia residents and generally imposes obligations on any natural or legal person that:

• Conducts business in Virginia or produces products or services that are targeted to Virginia residents; and
• In a calendar year, either:
  • Controls or processes the personal data of at least 100,000 Virginia residents; or
  • Controls or processes the personal data of at least 25,000 Virginia residents and derives at least 50% of its gross revenue from the sale of personal data