Personal data; management and oversight.

Personal data; Virginia Privacy Act. Givesconsumers the right to access their data and determine if it has been sold to a data broker. The measure requires a controller, definedin the bill as a person that, alone or jointly with others, determinesthe purposes and means of the processing of personal data, to facilitaterequests to exercise consumer rights regarding access, correction,deletion, restriction of processing, data portability, objection,and profiling. The measure also (i) requires transparent processingof personal data through a privacy notice, (ii) requires controllersto disclose if they process personal data for direct marketing orsell it to data brokers, and (iii) requires controllers to conducta risk assessment of each of their processing activities involvingpersonal data and an additional risk assessment any time there isa change in processing that materially increases the risk to consumers.The measure applies to any legal entity that conducts business inthe Commonwealth or produces products or services that are intentionallytargeted to residents of the Commonwealth and that (a) controls orprocesses personal data of not fewer than 100,000 consumers or (b)derives over 50 percent of gross revenue from the sale of personaldata and processes or controls personal data of not fewer than 25,000customers. A violation of this measure is made a prohibited practiceunder the Virginia Consumer Protection Act.