In a positive signal for employers, the Virginia General Assembly approved a comprehensive consumer data privacy measure that excludes employment data, implicitly recognizing the significant distinctions between privacy issues in the consumer and employment contexts.
Similar to the California Consumer Privacy Act, Virginia’s Consumer Data Protection Act would give consumers the right to access their data, correct inaccuracies, request the deletion of information, and in certain cases opt out of data collection.
The bill does not contain a private right of action. Violations of the law are enforceable by the state Attorney General.
Privacy bills are active in at least 15 states, and we may see more enactments of state privacy laws before long.
The bottom line: Various key aspects of the Virginia bill, which Governor Ralph Northam (D) has expressed support for and is expected to sign, are an encouraging sign for employers. These notably include the broadly-worded exemption of employment data and no private right of action. However, a patchwork of varying laws is now emerging, placing greater pressure on Congress in its efforts to pass comprehensive federal consumer data privacy legislation.