RICHMOND, Va. (WRIC) — The Consumer Protection Act (CDPA) is set to go into effect at the beginning of next year, making it more difficult for large corporations to use Virginians’ personal information for profit.
Personal data includes any information that can be linked to a consumer’s online profile, including email addresses, phone numbers and even home addresses.
The CDPA — involving Senate Bill 1392 and House Bill 2307 — was signed by the governor in March 2021, making Virginia the 22nd state to do so.
8News legal analyst, Russ Stone, says consumers shouldn’t only be concerned about what personal information is being shared but also what companies are choosing to do with that information.
“Those companies use that information for their own purposes, obviously, but they also can sell that information and it could end up in the hands of somebody you never had the intention of giving it to,” Stone said.
For many people, giving away personal data feels like a trivial thing — signing up for a new service with an email, or sharing a phone number for a free giveaway, for example — but Stone says companies should be transparent with what they do with that information.
“You do that so many times over the course of a week or a month that ultimately, you know, you have no idea where your information is. And one of the provisions of this bill gives you the right to find out what information they have,” Stone said.
The new law will allow residents to retrieve a copy of whatever personal data a large company may have and even delete the data if they do not want it shared. Consumers will also be able to opt-out of allowing businesses to sell their data.
“What that means is if, say, somebody uses my information in a way that I don’t want them to use it, this bill does not give me the right to sue them,” Stone said. “It is essentially enforced by the attorney general’s office.”
This means that everything, from enforcement to potential fines, will come from the attorney general.
The law will not apply to every company. In order for a company to be eligible, it must have at least 100,000 consumers annually or process the data of at least 25,000 consumers and profit off of half of that.
The CDPA will go into effect on Jan. 1, 2023. Stone still recommends consumers remain selective and discriminating about who they choose to divulge their personal data to.
