§ 59.1-577. Personal data rights; consumers

<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="Head1"> <title>§ 59.1-577. Personal data rights; consumers</title> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="apple-touch-icon" href="./images/favicon-law16.png" sizes="16x16" /> <link rel="apple-touch-icon" href="./images/favicon-law32.png" sizes="32x32" /> <script src="/Scripts/session.js" type="text/javascript"></script> <link rel="stylesheet" href="/Content/base.css" type="text/css" media="all" />  <link rel="stylesheet" href="/Content/720_grid.css" type="text/css" media="screen and (min-width: 720px)" /> <link rel="stylesheet" href="/Content/986_grid.css" type="text/css" media="screen and (min-width: 986px)" /> <link rel="stylesheet" href="/Content/1236_grid.css" media="screen and (min-width: 1236px)" /> <link rel="stylesheet" href="/Content/font-awesome.min.css" /> <link href='https://fonts.googleapis.com/css?family=PT+Sans+Narrow:400,700' rel='stylesheet' type='text/css' /> <link type="text/css" rel="stylesheet" href="https://fonts.googleapis.com/css?family=PT Serif:r,i,400,700" /> <link href='https://fonts.googleapis.com/css?family=Lato:400,700,300,300italic,400italic,700italic' rel='stylesheet' type='text/css' /> <link rel="stylesheet" href="/Content/jquery.fancybox.css" type="text/css" media="all" /> <link rel="stylesheet" href="/Content/jquery.qtip.min.css" type="text/css" media="all" /> <meta name='robots' content='nofollow' /><meta name='robots' content='noindex' /><meta name='docid' content='002316' /> <style type="text/css">.fancybox-margin {margin-right: 0px;}</style>  <script async src="https://www.googletagmanager.com/gtag/js?id=G-F6YYKCXH17"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-F6YYKCXH17'); </script> </head> <body> <input type="text" style="width:0;height:0;visibility:hidden;position:absolute;left:0;top:0" /> <input type="password" style="width:0;height:0;visibility:hidden;position:absolute;left:0;top:0" /> <input type="hidden" id="hidSignIn" value="0" /> <div class="top-bar"></div> <header> <nav> <div class="lis-links-content full"> <ul> <li><a href="https://virginiageneralassembly.gov/">Virginia General Assembly</a> /</li> <li><a href="https://help.lis.virginia.gov">LIS Learning Center</a> /</li> <li><a href="https://lis.virginia.gov/privacy">Privacy Policy</a> /</li> <li><a href="https://lis.virginia.gov">LIS home</a> /</li> <li><a href="https://lis.virginia.gov/register-account">Register Account</a> /</li> <li><a href="https://lis.virginia.gov/login">Login</a></li> </ul> </div> </nav> </header> <div class="grid-wrapper one-and-three halves"> <div class="portal-title"> <a href="https://lis.virginia.gov/">LIS</a> </div> <div class="portal-links"> <ul> <li> <a class="txt-blue" href="https://lis.virginia.gov">Session Information</a> </li> <li> <a class="txt-dark-blue" href="https://lis.virginia.gov/bill-search">Bills & Resolutions</a> </li> <li> <a class="txt-green" href="https://budget.lis.virginia.gov/default/2025/1">State Budget</a> </li> <li> <a class="txt-light-green" href="https://law.lis.virginia.gov/">Virginia Law</a> </li> <li> <a class="txt-orange" href="https://rga.lis.virginia.gov/">Reports to the General Assembly</a> </li> </ul> </div> </div> <div class="va-law"> <div class="grid"> <div class="row"> <div class="slot-0-1-2"> <h1><a href="https://law.lis.virginia.gov">Virginia Law</a></h1> </div> <div class="slot-3-4-5"> <div class="input-group .search-comp "> <div class="input-group-btn"> <button type="button" id='searchType' value="Code_of_Virginia" class="btn btn-sm btn-default dropdown-toggle" data-toggle="dropdown">Code of Virginia <span class="caret"></span></button> <ul id='searchList' class="dropdown-menu" role="menu"> <li class="searchBtn"><a href="#">All</a></li> <li class="searchBtn active"><a href="#">Code of Virginia</a></li> <li class="searchBtn "><a href="#">Administrative Code</a></li> <li class="searchBtn "><a href="#">Constitution</a></li> <li class="searchBtn "><a href="#">Charters</a></li> <li class="searchBtn "><a href="#">Authorities</a></li> <li class="searchBtn "><a href="#">Compacts</a></li> <li class="searchBtn "><a href="#">Uncodified Acts</a></li> </ul> </div>  <input type="text" id="txtSearch" class="form-control input-sm" placeholder="Search" /> <span class="input-group-btn"> <button class="btn btn-sm btn-default" id="searchBtn" type="button"><i class="fa fa-search"></i></button> </span> </div>  </div> </div> </div> </div> <div class="grid">       <body class="flipcol "> <input type="hidden" id="hidST" /> <input type="hidden" id="hidToC" value="1" /> <input type="hidden" id="hidID" /> <input type="hidden" id="hidNote"/> <input type="hidden" id="hidBiP" value="false" /> <input type="hidden" id="hidReport" value="0" /> <input type="hidden" id="hidSegments" /> <input type="hidden" id="hidPage" value="vacode" /> <div class="grid"> <div class="row"> <div class="slot-6-7-8"> <section id="pageTitle"><h2 class='pg-title'>Code of Virginia</h2></section> <section class="breadcrumbs" id="breadcrumbs"><p><a href='/vacode/'>Table of Contents</a> » <a href='/vacode/title59.1/'>Title 59.1. Trade and Commerce</a> » <a href='/vacode/title59.1/chapter53/'>Chapter 53. Consumer Data Protection Act</a> » <span class='breadcrumb-inactive'>搂 59.1-577. Personal data rights; consumers</span></p></section> <section class="content-header-menu" id="menucontainer"> <nav class="content-header-menu-left"><ul><li><a title='搂 59.1-576. Scope; exemptions' href='/vacode/title59.1/chapter53/section59.1-576/''><i class='fa fa-long-arrow-left'></i></a> Section <a title='搂 59.1-578. (Effective until January 1, 2025) Data controller responsibilities; transparency' href='/vacode/title59.1/chapter53/section59.1-578/''><i class='fa fa-long-arrow-right'></i></a></li></ul></nav> <a href="#" class="scroll_top "><i class="fa fa-arrow-up"></i></a> <nav class="content-header-menu-middle"><ul><li><span id='printIE' class='printPDF'><a id='A1' onclick='PrintPreview();' title='Print page' href=''><i class='fa fa-print'></i> Print</a></span></li><li><a id='A3' data-section='vacode/59.1-577' title='Download PDF' href=''><i class='fa fa-file-text'></i> PDF</a></li><li><a class='fancybox fancybox.iframe' href='/emailForm'><i class='fa fa-envelope'></i> email</a></li></ul></nav> <nav class="content-header-menu-right"></nav> </section> <p class="sidenote alert rptCheckbox"><strong>Creating a Report:</strong> Check the sections you'd like to appear in the report, then use the "Create Report" button at the bottom of the page to generate your report. Once the report is generated you'll then have the option to download it as a pdf, print or email the report.</p> <article id="vacode" class="content"> <div id="printStuff"><div id='printHeader'>Code of Virginia<br/>Title 59.1. Trade and Commerce<br/>Chapter 53. Consumer Data Protection Act</div><div id='printDate'>11/23/2024</div></div> <span id='va_code' class="content"><h2> <span id='v0'>搂 59.1-577</span>. Personal data rights; consumers.</h2><section class='body editable' id='edit38540' data-table='CoV' data-field='body'><p>A. A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right:</p><p>1. To confirm whether or not a controller is processing the consumer's personal data and to access such personal data;</p><p>2. To correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data;</p><p>3. To delete personal data provided by or obtained about the consumer;</p><p>4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and</p><p>5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.</p><p>B. Except as otherwise provided in this chapter, a controller shall comply with a request by a consumer to exercise the consumer rights authorized pursuant to subsection A as follows:</p><p>1. A controller shall respond to the consumer without undue delay, but in all cases within 45 days of receipt of the request submitted pursuant to the methods described in subsection A. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within the initial 45-day response period, together with the reason for the extension.</p><p>2. If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but in all cases and at the latest within 45 days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision pursuant to subsection C.</p><p>3. Information provided in response to a consumer request shall be provided by a controller free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.</p><p>4. If a controller is unable to authenticate the request using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action under subsection A and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.</p><p>5. A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data pursuant to subdivision A 3 by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the business's records and not using such retained data for any other purpose pursuant to the provisions of this chapter or (ii) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.</p><p>C. A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision pursuant to subdivision B 2. The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to subsection A. Within 60 days of receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.</p><p>2021, Sp. Sess. I, cc. <a href='http://LegacyLIS.virginia.gov/cgi-bin/legp604.exe?212+ful+CHAP0035'>35</a>, <a href='http://LegacyLIS.virginia.gov/cgi-bin/legp604.exe?212+ful+CHAP0036'>36</a>; 2022, c. <a href='http://LegacyLIS.virginia.gov/cgi-bin/legp604.exe?221+ful+CHAP0423'>423</a>.</p></section><input type='hidden' class='dataType' id='dataTable' value='CoV'/><input type='hidden' class='dataType' id='dataMember' value='id'/><input type='hidden' class='dataType' id='dataField' value='body'/></span> </article> <div id="HistoryNote"><p class='sidenote'>The chapters of the acts of assembly referenced in the historical citation at the end of this section may not constitute a comprehensive list of such chapters and may exclude chapters whose provisions have expired.</p></div> <nav class="content-footer-menu"><ul><li><a title='搂 59.1-576. Scope; exemptions' href='/vacode/title59.1/chapter53/section59.1-576/''><i class='fa fa-long-arrow-left'></i></a> Section <a title='搂 59.1-578. (Effective until January 1, 2025) Data controller responsibilities; transparency' href='/vacode/title59.1/chapter53/section59.1-578/''><i class='fa fa-long-arrow-right'></i></a></li></ul></nav> </div> <div class="slot-9"> <nav id="section-menu"> <ul class="section-header-menu"> <li class="selected"> <h3><a href="/vacode">Code of Virginia</a></h3> </li> <ul class="section-sub-menu"> <li><a href="/vacodepopularnames">Popular Names</a></li> </ul> <ul class="section-sub-menu"> <li id="covUpdates"><a href='/vacodeupdates/'>2024 Updates</a></li> </ul> <ul class="section-sub-menu"> <li><span class="form-title">Section Look Up</span></li> <li id='search-box'> <div action='/search' id='search-form' method='get' target='_top'> <input type="text" id='search-text' name='q' placeholder='ex. 2.2-4007.01' readonly onfocus="if (this.hasAttribute('readonly')) {this.removeAttribute('readonly'); this.blur(); this.focus(); }"/> <button id='search-button' type='submit'><span>Go</span></button> </div> </li> </ul> <li> <h3><a href="/admincode">Administrative Code</a></h3> </li> <li> <h3><a href="/constitution">Constitution of Virginia</a></h3> </li> <li> <h3><a href="/charters">Charters</a></h3> </li> <li> <h3><a href="/authorities">Authorities</a></h3> </li> <li> <h3><a href="/compacts">Compacts</a></h3> </li> <li> <h3><a href="/uncodifiedacts">Uncodified Acts</a></h3> </li> </ul> </nav> </div> </div> </div> <script type="text/javascript">var siteurl = 'https://law.lis.virginia.gov';</script> <script src="/Scripts/jquery.min.js" type="text/javascript"></script> <script src="/Scripts/responsive.js" type="text/javascript"></script> <script src="/Scripts/modernizer.js" type="text/javascript" charset="utf-8"></script> <script src="/Scripts/bootstrap.min.js" type="text/javascript" charset="utf-8"></script> <script src="/Scripts/jquery.fancybox.js" type="text/javascript" charset="utf-8"></script> <script src="/Scripts/fancybox/jquery.easing-1.3.pack.js" type="text/javascript"></script> <script src="/Scripts/fancybox/jquery.mousewheel-3.0.4.pack.js" type="text/javascript"></script> <script src="/Scripts/jquery.floatThead.min.js" type="text/javascript"></script> <script src="/Scripts/printThisCoV.js" type="text/javascript"></script> <script src="/Scripts/jquery.cookie.js" type="text/javascript"></script> <script src="/Scripts/search.js" type="text/javascript"></script> <script src="/Scripts/searchCoV.js" type="text/javascript"></script> <script src="/Scripts/isFontFaceSupported.js" type="text/javascript"></script> <script src="/Scripts/jquery.qtip.js" type="text/javascript"></script> <link rel="stylesheet" href="/Content/msgBoxLight.css" /> <script src="/Scripts/jquery.msgBox.js" type="text/javascript" charset="utf-8"></script> <script src="/Scripts/tinymce/tinymce.min.js" type="text/javascript" charset="utf-8"></script> <script src="/Scripts/edit.js" type="text/javascript"></script> <script src="/Scripts/CoVInit.js" type="text/javascript"></script> <script src="/Scripts/report.js" type="text/javascript"></script> <script src="/Scripts/default.js" type="text/javascript"></script> <script src="/Scripts/pdf.js" type="text/javascript"></script> <script type="text/javascript"> $('document').ready(function () { $('#print').click(function () { $("#vacode").printThis(); return (false); }); var val = parseInt($.browser.version); if ($.browser.msie || (val > 7 && val <= 11)) { //stuff here (like adding an IE10 class to the body or html tag $(".input-sm").css("margin-top", "1px"); } $('a.fancybox').fancybox({ type: "iframe", 'width': 650, 'height': 520 }); $("a.single_image").fancybox({ type: "iframe", 'width': 650, 'height': 720 }); $('.fancybox').attr('href', "/emailForm?parent=vacode/" + $('#hidSegments').val()); $('.hdr-read-text a').fancybox({ type: "iframe", 'width': 650, 'height': 701, 'autoDimensions': false, 'autoSize': false, afterClose: function (event, ui) { //parent.document.getElementById("hidBiP").value = "false"; parent.$("#hidBiP").val("false"); } }); var _hidVal = $('#hidBiP').val(); if (_hidVal == 'true') { $('.hdr-read-text a').click(); } if (isFontFaceSupported() == false) { $('.fa').iconfontFallback(); } $('p.hdr-read-text a').qtip({ content: 'Bills currently before the General Assembly', style: { textAlign: 'center', tip: true, classes: 'qtip-rounded qtip-shadow', }, position: { my: 'top center', at: 'bottom center' } }); }); function PrintPreview() { $('table').floatThead('reflow'); $('table').floatThead('reflow'); printWindow = window.open("", "", "location=1,status=1,scrollbars=1,width=650,height=600"); printWindow.document.write('<!DOCTYPE html><html><head>'); printWindow.document.write('<link rel="stylesheet" href="./css/base.css" type="text/css" media="all" />'); printWindow.document.write('<link rel="stylesheet" href="./css/720_grid.css" type="text/css" media="all" />'); printWindow.document.write('<style type="text/css">@media print{.no-print, .no-print *{display: none !important;}h6{display:none !important;}#printPages{display:none !important;}}#printDate {display:none !important;}</style>'); printWindow.document.write('<style type="text/css">#printHeader{display:block;font-size:1em;line-height:1.3em;text-align:left;margin-bottom:.8em;}</style>'); printWindow.document.write('<style type="text/css">body{color:#444;font-family:"PT Serif",Georgia,serif;line-height:1.3em;font-size: .95em;}h2{margin:0 0 .1em 0;font-weight:normal;line-height:1.2em;font-size:1.4em;letter-spacing:.01em;padding:0 .35em 0 0.25em;}'); printWindow.document.write('.hdr-read-text,.read-text,.rptCheckbox{display:none;}ul .outline{margin-bottom:1em;}ul{list-style:none;}.outline ul{margin-left:1em;}a, a:link{color:#1a73ae;text-decoration:none;}'); printWindow.document.write('b{margin:0;padding:0;border:0;font-size:100%;vertical-align:baseline;}.number-descrip-list{line-height:1.55em;margin-bottom:1em;height:auto;}'); printWindow.document.write('.number-descrip-list dt {clear: left;float: left;display: table-cell;font-weight: bold;width: 6.75em;}.number-descrip-list dd {padding-bottom: .125em;display: table-cell;}'); printWindow.document.write('.number-descrip-list-outline{margin-left:1em;line-height:1.55em;}.number-descrip-list-outline dt{width:7em;font-weight:bold;}'); printWindow.document.write('.number-descrip-list-outline dd{display:table-cell;padding-bottom:0;}</style>'); printWindow.document.write('<style type="text/css">h6 {font-family: "Lato", Helvetica, Arial, sans-serif;font-size: 14px;border-bottom: 1px solid #ddd;padding-bottom: 15px;}'); printWindow.document.write('table{border-collapse: collapse;border-spacing: 0;margin-bottom: 15px;}.printButtons {width: 100%;text-align: right;position: absolute;right: 10px;top: 28px;}</style>'); printWindow.document.write('<style>#printPages{position:absolute;left: 120px;top: 30px;}.hiddenTable {display: none !important;}</style>'); printWindow.document.write('</head><body>'); printWindow.document.write('<h6>Print Preview</h6><span id="printPages"></span>') printWindow.document.write('<div class="printButtons">'); //Print and cancel button printWindow.document.write('<input type="button" id="btnPrint" value="Print" class="no-print" onclick="window.print();window.onfocus=function(){window.close();}" />'); printWindow.document.write('<input type="button" id="btnCancel" value="Cancel" class="no-print" onclick="window.close()" />'); printWindow.document.write('</div>'); //You can include any data this way. var _page = '<div id="va_code" class="va_code">' + $('#printStuff').html() + $('#va_code').html() + '</div>'; printWindow.document.write(_page); printWindow.document.write('<scr' + 'ipt type="text/javascript">var divHeight;var obj = document.getElementById("va_code");if(obj.offsetHeight){divHeight=obj.offsetHeight;}else if(obj.style.pixelHeight){divHeight=obj.style.pixelHeight;}document.getElementById("printPages").innerHTML="Approximate Number of Pages: " + Math.ceil(divHeight / 850);</sc' + 'ript>'); printWindow.document.write('</body></html>'); printWindow.document.close(); printWindow.focus(); } </script>  </body> </div> <div class="va-law-footer" id="valawfooter"> <div class="grid"> <div class="row"> <div class="slot-6 foot-callout"> <h4><i class="fa fa-book"></i> Virginia Law Library</h4> <p>The Code of Virginia, Constitution of Virginia, Charters, Authorities, Compacts and Uncodified Acts are now available in EPub eBook format. <a class="more" href="/law-library"><i class="fa fa-arrow-circle-right"></i></a></p> </div> <div class="slot-7 foot-callout"> <h4><i class="fa fa-question-circle"></i> Helpful Resources</h4> <ul> <li><a href="http://codecommission.dls.virginia.gov/">Virginia Code Commission</a></li> <li><a href="http://register.dls.virginia.gov/">Virginia Register of Regulations</a></li> <li><a href="https://www.archives.gov/exhibits/charters/constitution_transcript.html">U.S. Constitution</a></li> </ul> </div> <div class="slot-8 foot-callout"> <h4><a href="/developers"><i class="fa fa-wrench"></i> For Developers</a></h4> <p>The Virginia Law website data is available via a web service. <a class="more" href="/developers"><i class="fa fa-arrow-circle-right"></i></a></p> </div> <div class="slot-9 foot-callout"> <h4 id="twitter"> </h4> <img id="ga-seal" src="/images/ga_seal_lis.png" alt="virginia general assembly seal" /> </div> </div> </div> </div> <div class="footer"> <nav class="footer-links" style="line-height: 1.4;"> <div class="container-fluid"> <div class="row"> <div id='generic_login_div' style="display:none;z-index:9999;padding:10px;" class="corners dropshadow"> <h3>Sign In</h3> <div class='form-row'> <label id='lblusername' for='username'>Username:  </label> <input type='text' class="user" name='username' placeholder="Username" id='username' /> <label id="userError"></label> </div> <div class='form-row'> <label id='lblpassword' for='password'>Password:  </label> <input type='password' class="pass" name='password' placeholder="Password" id='password' /> <label id="passError"></label> </div> <div class='submit-row'> <input type='button' id="btnLogin" class="button" value='Login' /> <a onclick='hideLogin()' class="hover">Cancel</a> </div> </div> <div id="dialog-modal" style="display:none;"></div> <span class="col-xs-12 text-center"> <ul> <li><a href="https://lis.virginia.gov">LIS Home</a></li> <li><a id="aLIAB" href="https://lis.virginia.gov/register-account">Lobbyist-in-a-Box</a></li> </ul> <p> 漏 Copyright Commonwealth of Virginia, <script>document.write(new Date().getFullYear())</script>. All rights reserved. Site developed by the <a href="http://dlas.virginia.gov">Division of Legislative Automated Systems (DLAS)</a>. <a href="" id="signin" onclick="showLogin();return false;">Sign In</a> </p> </span> </div> </div> </nav> </div> </body> </html>    <script src="/Scripts/SwitchMode.js" type="text/javascript"></script>

CINXE.COM

§ 59.1-577. Personal data rights; consumers