Virginia Legislature Introduces Bill Amending Data Privacy Law
Del. Bonita Anthony (D) offered a bill in the Virginia legislature Wednesday that would amend the state’s comprehensive privacy law that went into effect in 2023. The proposed amendments add and define the terms “secondary use” and “user-generated content,” as well as add reporting requirements for controllers and processors of personal data.
Sign up for a free preview to unlock the rest of this article
Anthony’s amendment defines secondary use as “processing of personal data or user-generated content for purposes other than those disclosed at the time of consent by the consumer.” It requires that consumers give consent for their data and content to be processed for any additional purposes outside what they have already consented to. User-generated content is “any digital content, including text, images, video, audio, or other content, that is produced by a consumer” and is added to be regulated alongside personal data.
The added reporting requirement outlines that if a consumer requests it, a controller or processor must provide a report that describes the categories of personal data and user-generated content that were processed and the purpose for processing it during the previous 12 months. If the personal data or user-generated content was shared with a third party, that must be disclosed as well as the category of the third party, and the secondary uses, if any, of the data and content, again within the previous 12 months. This report must be given to consumers within 90 days after their request is submitted, the amendments said.
Anthony’s amendment also raises the penalty ceiling for noncompliance from $7,500 to $15,000 and adds a penalty of up to $22,500 per violation for repeated noncompliance.