Processes de-identified data, in Virginia

Va. Code Ann. §§ 59.1-575 and 59.1-581 · Read the law's page

• Before treating data as de-identified, take reasonable measures to ensure that it cannot be associated with a natural person (section 59.1-581(A)(1)).
• Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (section 59.1-581(A)(2)).
• Contractually obligate every recipient of the de-identified data to comply with all provisions of the Consumer Data Protection Act (section 59.1-581(A)(3)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breaches of those commitments (section 59.1-581(E)).

Va. Code Ann. § 59.1-593 · Read the law's page

• To treat genetic information as deidentified, take reasonable measures to ensure that it cannot be associated with a consumer or household (section 59.1-593, definition of deidentified data, clause (i)).
• Publicly commit to maintain and use the information only in deidentified form and not to attempt to reidentify it, except solely to test whether your deidentification processes satisfy the definition, and then neither use nor disclose any information reidentified in that test and destroy it when the assessment is complete (section 59.1-593, clause (ii)).
• Contractually obligate every recipient of the information to take reasonable measures to ensure that it cannot be associated with a consumer or household and to commit to using it only in deidentified form and not to reidentify it (section 59.1-593, clause (iii)).

Va. Code Ann. § 38.2-613(B)(8) · Read the law's page

• If you are an insurance institution, agent or insurance-support organization disclosing personal or privileged information about an individual for an actuarial or research study without the individual's written authorization, make sure no individual may be identified in any actuarial or research report, return or destroy the materials that allow the individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to disclose the information unless the disclosure would otherwise be permitted by section 38.2-613 if made by an insurance institution, agent or insurance-support organization (section 38.2-613(B)(8)).