                                 CODE OF VIRGINIA

PERSONAL DATA RIGHTS; CONSUMERS (§ 59.1-577)

A. A consumer may invoke the consumer rights authorized pursuant to this
subsection at any time by submitting a request to a controller specifying the
consumer rights the consumer wishes to invoke. A known child&#8217;s parent or
legal guardian may invoke such consumer rights on behalf of the child regarding
processing personal data belonging to the known child. A controller shall comply
with an authenticated consumer request to exercise the right:

   1. To confirm whether or not a controller is processing the consumer&#8217;s
   personal data and to access such personal data;

   2. To correct inaccuracies in the consumer&#8217;s personal data, taking into
   account the nature of the personal data and the purposes of the processing of
   the consumer&#8217;s personal data;

   3. To delete personal data provided by or obtained about the consumer;

   4. To obtain a copy of the consumer&#8217;s personal data that the consumer
   previously provided to the controller in a portable and, to the extent
   technically feasible, readily usable format that allows the consumer to
   transmit the data to another controller without hindrance, where the
   processing is carried out by automated means; and

   5. To opt out of the processing of the personal data for purposes of (i)
   targeted advertising, (ii) the sale of personal data, or (iii) profiling in
   furtherance of decisions that produce legal or similarly significant effects
   concerning the consumer.

B. Except as otherwise provided in this chapter, a controller shall comply with
a request by a consumer to exercise the consumer rights authorized pursuant to
subsection A as follows:

   1. A controller shall respond to the consumer without undue delay, but in all
   cases within 45 days of receipt of the request submitted pursuant to the
   methods described in subsection A. The response period may be extended once by
   45 additional days when reasonably necessary, taking into account the
   complexity and number of the consumer&#8217;s requests, so long as the
   controller informs the consumer of any such extension within the initial
   45-day response period, together with the reason for the extension.

   2. If a controller declines to take action regarding the consumer&#8217;s
   request, the controller shall inform the consumer without undue delay, but in
   all cases and at the latest within 45 days of receipt of the request, of the
   justification for declining to take action and instructions for how to appeal
   the decision pursuant to subsection C.

   3. Information provided in response to a consumer request shall be provided by
   a controller free of charge, up to twice annually per consumer. If requests
   from a consumer are manifestly unfounded, excessive, or repetitive, the
   controller may charge the consumer a reasonable fee to cover the
   administrative costs of complying with the request or decline to act on the
   request. The controller bears the burden of demonstrating the manifestly
   unfounded, excessive, or repetitive nature of the request.

   4. If a controller is unable to authenticate the request using commercially
   reasonable efforts, the controller shall not be required to comply with a
   request to initiate an action under subsection A and may request that the
   consumer provide additional information reasonably necessary to authenticate
   the consumer and the consumer&#8217;s request.

   5. A controller that has obtained personal data about a consumer from a source
   other than the consumer shall be deemed in compliance with a consumer&#8217;s
   request to delete such data pursuant to subdivision A 3 by either (i)
   retaining a record of the deletion request and the minimum data necessary for
   the purpose of ensuring the consumer&#8217;s personal data remains deleted
   from the business&#8217;s records and not using such retained data for any
   other purpose pursuant to the provisions of this chapter or (ii) opting the
   consumer out of the processing of such personal data for any purpose except
   for those exempted pursuant to the provisions of this chapter.

C. A controller shall establish a process for a consumer to appeal the
controller&#8217;s refusal to take action on a request within a reasonable
period of time after the consumer&#8217;s receipt of the decision pursuant to
subdivision B 2. The appeal process shall be conspicuously available and similar
to the process for submitting requests to initiate action pursuant to subsection
A. Within 60 days of receipt of an appeal, a controller shall inform the
consumer in writing of any action taken or not taken in response to the appeal,
including a written explanation of the reasons for the decisions. If the appeal
is denied, the controller shall also provide the consumer with an online
mechanism, if available, or other method through which the consumer may contact
the Attorney General to submit a complaint.

HISTORY: 2021, Sp. Sess. I, cc. 35, 36; 2022, c. 423.