Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party email marketing tools that collect personal information in Virginia? What are the requirements?

Using Third-Party Email Marketing Tools that Collect Personal Information in Virginia

Yes, you can use third-party email marketing tools that collect personal information in Virginia, but you must comply with the Virginia Consumer Data Protection Act (VCDPA) [1.1].

The VCDPA requires that any agency maintaining an information system that includes personal information shall collect, maintain, use, and disseminate only that personal information permitted or required by law to be so collected, maintained, used, or disseminated, or necessary to accomplish a proper purpose of the agency [1.1].

If you are a public body with an internet website associated with that public body, you must develop an internet privacy policy and an internet privacy policy statement that explains the policy to the public. The policy shall be consistent with the requirements of the VCDPA [1.1].

If you experience a breach of personal information, you must disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay [2.2]. Notice required by this section may be reasonably delayed to allow the individual or entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system [2.2].

Additional Requirements

If you are a merchant, you must give notice to the purchaser before selling any information that concerns the purchaser and that is gathered in connection with the sale, rental, or exchange of tangible personal property to the purchaser at the merchant’s place of business. Notice required by this section may be by the posting of a sign or any other reasonable method. If requested by a purchaser not to sell such information, the merchant shall not do so [3.1].

Conclusion

In summary, you can use third-party email marketing tools that collect personal information in Virginia, but you must comply with the VCDPA and disclose any breach of personal information. If you are a merchant, you must give notice to the purchaser before selling any information that concerns the purchaser and that is gathered in connection with the sale, rental, or exchange of tangible personal property to the purchaser at the merchant’s place of business.

Source(s):
Jurisdiction

Virginia