The widespread use of the internet for many of the functions of daily life has led to concerns over the privacy and security of users’ personally identifiable information (PII). Information like addresses, credit card numbers, and Social Security numbers can be very valuable to people who intend to misuse it for their own gain. Identity theft and related crimes cost consumers and businesses billions of dollars every year. Various federal and state laws attempt to protect data privacy, but the U.S. has no comprehensive data privacy law at the national level. Several states, however, have enacted laws that provide sweeping data privacy protections, including California data privacy laws, which have been at the forefront of individual state regulations for the past few years.
This trend of states implementing more stringent data privacy regulations continues in 2023 with Virginia enacting a new data privacy law and California amending its existing data privacy regulations – both taking effect in January 2023.
When Do the New Laws Take Effect?
Both the California Privacy Rights Act (CPRA) and the Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023. Three more states, Colorado, Connecticut, and Utah, will join them later in the year.
What Do the New Laws Protect?
The CPRA and the VCDPA offer extensive protections for consumer data held by third parties.
Who Do the New Laws Cover?
Both laws apply to for-profit businesses and organizations that operate in their respective states and meet criteria related to annual revenue and receipt or use of PII. One criterion in both laws, for example, involves the processing of PII from at least 100,000 consumers per year. The VDCPA may also apply to some individuals and nonprofit organizations.
What Are Consumers’ Rights under the New Laws?
The laws provide consumers with numerous rights regarding their PII, including:
- To know what information is being used, and how;
- To access their personal information;
- To correct inaccuracies;
- To delete certain personal information; and
- To opt out of certain uses of personal information.
With regard to the right to opt out, the CPRA prohibits covered entities from using information belonging to anyone under the age of 16 unless they obtain “opt in” permission.
What Information Do the New Laws Protect?
The CPRA amends the California Consumer Privacy Act (CCPA), which has been in effect since 2020. It uses the CCPA’s definition of “personal information,” which includes anything “that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The CPRA adds a new category of “sensitive personal information,” which includes:
- ID numbers, such as Social Security or passport;
- Login information for online accounts;
- Geolocation data;
- Genetic data;
- Biometric processing data; and
- Information about racial or ethnic origin, union membership, or political or religious affiliations.
The VCDPA uses a similar definition of “personal information.” Its definition of “sensitive data” includes most of the above examples, as well as personal information collected from someone known to be a child under the age of 18.
Who Enforces the New Laws?
For California data privacy laws, the California Attorney General (AG) and the newly created California Privacy Protection Agency may enforce the CPRA. Consumers also have the right to bring a cause of action for violations. The Virginia AG will enforce the VCDPA.
Learn More
Baer Reed advises law firms and in-house counsel on how to address concerns regarding data breaches, data privacy, and related litigation issues. Contact us today to learn more.
Mr. Reyes graduated with honors from the Ateneo de Manila University, where he received the Procter and Gamble Student Excellence Award. He obtained his Juris Doctor degree from the Ateneo de Manila School of Law. During law school, Mr. Reyes was part of the Philippine delegation to the Willem C. Vis International Commercial Arbitration Moot held in Vienna, Austria. He was also a member of the Ateneo Society of International Law and the St. Thomas More Debate Society. He completed his internship at the Public Attorney’s Office. He wrote a thesis entitled: “To Kill A White Elephant: An Analysis of the Fiduciary Exception to the Corporate Attorney-Client Privilege”. Mr. Reyes is admitted to practice law in the Philippines and the State of New York.
Ms. Lardizabal-Manzano is a graduate of San Sebastian College-Recoletos, where she earned her B.A. in Political Science. In 2003, she received her law degree from Lyceum of the Philippines and was admitted to practice law in 2004.
Matthew Hersh earned a B.A. in Political Science from Columbia University in 1990 and graduated cum laude from Georgetown University Law Center in 1999. He also holds a master’s degree in international relations from the Georgetown University School of Foreign Service.
Cap. Avi Levak (Res. IDF) graduated from from Israel’s prestigious Ben-Gurion University of the Negev with a Bachelor of Science in Computer Science and Mathematics. He is also a Leadership and Communication coach trained in TuT coaching by Alon gal in Israel. Avi specializes in high-level, in-depth analysis of business and client needs, within systems and software strategy and architecture.
Ms. Tyler graduated cum laude from Georgetown University and received her law degree, cum laude, from Georgetown University Law Center. During law school, she interned at the United Nations Economic Commission for Europe. She also worked on The Tax Lawyer journal and was a member of the award-winning Barristers’ Council Mock Trial Team. Ms. Tyler is admitted to practice law in the State of California and the District of Columbia.
Ms. Cruz-Anonuevo graduated cum laude and top nine in her batch from Miriam College with a degree of Bachelor of Arts in InternationalStudies. She obtained her Juris Doctor degree from Ateneo de Manila University School of Law in Rockwell. During law school, she interned in Rivera, Santos, Maranan & Associates. She was also part of Ateneo’s Labor Law Bar Operations. She wrote her thesis on, “Stealing Privacy: Limitations on Media’s Photographic Invasion.,” Ms. Cruz-Anonuevo is admitted to practice law in the Philippines.
Ms. Aquino-Batallones obtained a Bachelor of Arts degree in Development Studies (with Minors in Global Politics and Hispanic Studies) from the Ateneo de Manila University. In 2011, she received her Juris Doctor degree from Ateneo de Manila University School of Law. During law school, she interned at Romulo Mabanta Buenaventura Sayoc & de los Angeles then became an intern of Ateneo Legal Services Center’s Clinical Legal Education Program.
Mr. De Guzman graduated from San Beda College with a degree of Bachelor of Arts Major in Economics and received his law degree from San Beda College of Law. He is multilingual and is fluent in three languages: Chinese, Filipino, and English. He was admitted to the Philippine Bar in 2003.