NORFOLK, Va. — Gov. Ralph Northam officially signed the Consumer Data Protection Act into law on Tuesday. The law doesn't take effect until 2023, allowing for adjustments to it between now and then.
State Sen. Dave Marsden, who introduced the legislation, said the adjustments may be needed because the law charts new territory in Virginia.
"I'm 72, and I get calls all the time asking about college debt that I never had," joked Marsden, referring to the nearly constant onslaught of calls he and others receive because companies have been able to obtain their information.
"Did you know that everybody in America's car warranty is about to expire?" Marsden asked.
Marsden's hope is that the Consumer Data Protection Act will give people more control over their information.
"People will be able to access data, delete data, and correct data, tell folks they can't sell for targeted advertising," Marsden explained.
The law applies to larger businesses operating in Virginia that handle a certain amount of personal data or make a certain amount of money from selling data.
Those businesses either control or process the personal data of at least 100,000 people or they make more than 50% of their gross revenues from personal data sales and control or process personal data of at least 25,000 people.
"This is about your Kroger gas rewards card, Visa card which collects points for you, all collecting info and selling it towards advertisers," said Marsden.
The law says the average person can’t take legal action against companies on their own if there’s a problem. Only the state attorney general has the right to enforce violations.
"It protects people who would never think of going to an attorney or think they have the money to do that. That's a foreign world to them. This way, you do have sort of a guard dog in the Attorney General's office who will be looking after everybody," said Marsden.
It remains to be seen if the attorney general will be aggressive when it comes to going after violators. If he's not, consumers will have no legal recourse to take.
The legislation provides a framework in which companies are expected to operate. Up to this point, the business field mostly has been unregulated. Companies have been able to gather, process, and sell data unchecked.
"We're trying to turn an entire industry around. An entire economy is built on data collection and us, much of which is appropriate. We don't want to shut everything down. We want to provide appropriate protections," said Marsden.