Ask Reggi Your Question Now
Can I ignore consumer requests for information or deletion in Virginia? What are the requirements?
Consumer Requests for Information or Deletion in Virginia
In Virginia, a licensee cannot ignore consumer requests for information or deletion. A consumer may invoke the consumer rights authorized pursuant to VACV 59.1-577 at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A controller shall comply with an authenticated consumer request to exercise the right to confirm whether or not a controller is processing the consumer’s personal data and to access such personal data, to correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data, to delete personal data provided by or obtained about the consumer, to obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, and to opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer [4.1].
A controller shall respond to the consumer without undue delay, but in all cases within 45 days of receipt of the request submitted pursuant to the methods described in VACV 59.1-577. If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay, but in all cases and at the latest within 45 days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision pursuant to VACV 59.1-577. Information provided in response to a consumer request shall be provided by a controller free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request [4.1].
Therefore, a licensee must comply with consumer requests for information or deletion in Virginia. A consumer may invoke their rights under VACV 59.1-577 at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A controller shall comply with an authenticated consumer request to exercise the right to confirm whether or not a controller is processing the consumer’s personal data and to access such personal data, to correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data, to delete personal data provided by or obtained about the consumer, to obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, and to opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer [4.1].
Source(s):
Jurisdiction
Virginia