Virginia SB 641: Civil action; sale of personal data.

Bill Text

Bill Tracking - 2021 session > Legislation 

• 
• 

• Virginia General Assembly
• LIS Home
• LIS Help
• Privacy Statement
• Live Help 

• LIS Classic
• Login

SEARCH SITE

QUICK LINKS 
- - - - - - - - - - - - - - 
Log in 
LIS Home 
General Assembly Home 
- - - - - - - - - - - - - - 
Session Tracking: 
Bills & Resolutions 
Members 
Committees 
Meetings 
Calendars 
Communications 
House Minutes 
Senate Minutes 
Statistics 
Lobbyist-in-a-Box 
Personal lists 
- - - - - - - - - - - - - - 
Search: 
Code of Virginia 
Administrative Code 
Bills & Resolutions 
Summaries 

OTHER SESSIONS 
- - - - - - - - - - - - - - 
2023 Session 
2022 Session 
2022 Special Session I 
2021 Session 
2021 Special Session I 
2021 Special Session II 
2020 Session 
2020 Special Session I 
2019 Session 
2019 Special Session I 
2018 Session 
2018 Special Session I 
2018 Special Session II 
2017 Session 
2016 Session 
2015 Session 
2015 Special Session I 
2014 Session 
2014 Special Session I 
2013 Session 
2013 Special Session I 
2012 Session 
2012 Special Session I 
2011 Session 
2011 Special Session I 
2010 Session 
2009 Session 
2009 Special Session I 
2008 Session 
2008 Special Session I 
2008 Special Session II 
2007 Session 
2006 Session 
2006 Special Session I 
2005 Session 
2004 Session 
2004 Special Session I 
2004 Special Session II 
2003 Session 
2002 Session 
2001 Session 
2001 Special Session I 
2000 Session 
1999 Session 
1998 Session 
1998 Special Session I 
1997 Session 
1996 Session 
1995 Session 
1994 Session 
1994 Special Session I 
1994 Special Session II 

VIRGINIA LAW PORTAL

• Code of Virginia
• Virginia Administrative Code 

• Constitution of Virginia
• Charters
• Authorities
• Compacts 

• Uncodified Acts
• RIS Users (account required) 
SEARCHABLE DATABASES

• Bills & Resolutions
session legislation
• Bill Summaries
session summaries 

• Reports to the General Assembly
House and Senate documents 

• Legislative Liaisons
State agency contactsACROSS SESSIONS

• Subject Index: Since 1995
• Bills & Resolutions: Since 1994
• Summaries: Since 1994 
Developed and maintained by the Division of Legislative Automated Systems.

2021 SESSION

• history | 
hilite | 
pdf | 
print version 
20104658D

SENATE BILL NO. 641 

Offered January 8, 2020 

Prefiled January 7, 2020 

A BILL to amend the Code of Virginia by adding a section 
 numbered 8.01-40.5, relating to civil action; sale of personal data. 
---------- 

Patron-- Surovell 

---------- 

Referred to Committee on the Judiciary 

---------- 

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding a section 
 numbered 8.01-40.5 as follows:

� 8.01-40.5. Civil 
 action for sale of personal data.

A. As 
 used in this section:

"Consumer" 
 means a natural person who 
 is a resident and domiciliary of 
 the Commonwealth.

"Data 
 seller" means a person 
 that disseminates, obtains, maintains, or collects personal data about a 
 consumer for a fee.

"Personal 
 data" includes any information 
 that could be used to identify an individual consumer, including 
 such consumer's date of birth, social security 
 number, credit card information 
 (including account number, expiration date, and security code), passwords, 
 personal identification numbers (PINs), 
 or information about an individual consumer's character, habits, spending, hobbies, or 
 personal interests.

"Public record information" 
 shall refer to publicly available information from federal, state, or local 
 government entities.

B. Data sellers 
 shall:

1. Implement and 
 maintain reasonable security procedures and practices to protect 
 (i) the confidentiality of a 
 consumer's personal data 
 and (ii) the accuracy of public record information.

2. Implement 
 processes to affirmatively obtain the express 
 consent of a parent or guardian of a 
 minor before selling the personal 
 data of such minor.

3. Implement 
 procedures for consumers to submit a 
 request to obtain any of their own personal data 
 maintained by the data seller, including, at a 
 minimum, a toll-free telephone number, and to obtain a copy of such 
 data or any of such data sold to another 
 entity by the data seller regarding the 
 consumer.

4. Refrain 
 from maintaining or selling 
 personal data about a consumer 
 that it knows to be inaccurate.

5. Provide a link on 
 the homepage of the website of 
 the data seller labeled "Do Not Sell My Personal Information" 
 that directs a consumer to a webpage enabling him or his authorized 
 representative to opt out of the sale of the consumer's personal data.

6. In 
 the event of a data breach, notify all affected consumers via mail or email 
 within 30 days of the discovery of the breach. A copy of the notice shall also 
 be sent to the Office of the 
 Attorney General.

C. The 
 provisions of this section shall not apply to the Commonwealth or 
 any agency, commission, instrumentality, or 
 political subdivision thereof; any 
 clerk of court; any