Va. Set to Become 2nd State With Consumer Data Protection Law
Ashley Taylor, a partner at Troutman Pepper, was quoted in the Virginia Business article, " Va. Set to Become 2nd State With Consumer Data Protection Law."
Virginia's bill is "not on its face difficult from a compliance standpoint" for businesses, says Ashley L. Taylor Jr., a partner at Troutman Pepper who has a focus on federal and state government regulatory and enforcement matters.
. . .
More state data laws also means a lower chance of a federal bill that would supersede states' acts and require more regulations, Taylor adds. Also fewer law firms will be willing or able to advise companies on compliance from state to state, since attorneys would have to be experts on how enforcement is taking place in multiple jurisdictions.
. . .
Virginia's legislation would affect more than just the largest companies active here, despite the 100,000-customer benchmark. California’s Consumer Privacy Act of 2018, which allows California residents to opt out of the sale of their personal information and the right to delete some personal information already collected, has "touched every business, even a pizza place that has a rewards program," Taylor notes. Every website or app that collects data is required to include an opt-out link under California's law, and Virginia's statute is similar, although a bit "scaled back," he says.
. . .
With these industry-driven changes and the possibility of other states soon following Virginia and California's lead in consumer data protection, many companies will likely have to make some significant changes in their marketing practices in the next few years. California enacted its legislation, the state attorney general's office reviewed companies' websites, and if there wasn't plain language showing users how to contact the company about data collection, "they got subpoenas," Taylor says.
Virginia's effective date of Jan. 1, 2023, should give companies plenty of time to comply, Taylor adds, as long as "the attorney general and the state give [companies] guidance on their regulations and expectations of business. You've got to have a target to shoot at. Maybe an open forum, a conference — some type of public conversation. That's what I'm hoping for."