Makes employment decisions, in Virginia

Va. Code Ann. § 40.1-28.7:1 · Read the law's page

• Do not request, require, solicit or administer a genetic test, as defined in section 38.2-508.4, to any person as a condition of employment.
• Do not refuse to hire, fail to promote, discharge or otherwise adversely affect the terms or conditions of employment of an employee or prospective employee solely on the basis of a genetic characteristic or the results of a genetic test, as those terms are defined in section 38.2-508.4, regardless of how you obtained the information or results.

Va. Code Ann. § 59.1-577 · Read the law's page

• Give a Virginia consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Virginia consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Va. Code Ann. § 59.1-580 · Read the law's page

• Conduct and document a data protection assessment of your processing of personal data for targeted advertising, its sale, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, the processing of sensitive data, and any other processing that presents a heightened risk of harm to Virginia consumers (section 59.1-580(A)).
• If you offer an online service, product or feature directed to consumers you have actual knowledge are children, conduct a data protection assessment of it that addresses its purpose, the categories of known children's personal data it processes and your purposes for processing them (section 59.1-580(B)).
• In each assessment, identify and weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer as the safeguards you employ mitigate them, factoring in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer (section 59.1-580(C)).
• Make a data protection assessment available to the Attorney General when the Attorney General requests it under a civil investigative demand (section 59.1-580(D)).