Law / United States / 
Virginia
Virginia Consumer Data Protection Act (VCDPA), de-identified data
Va. Code Ann. §§ 59.1-575 and 59.1-581
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- Before treating data as de-identified, take reasonable measures to ensure that it cannot be associated with a natural person (section 59.1-581(A)(1)).
- Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (section 59.1-581(A)(2)).
- Contractually obligate every recipient of the de-identified data to comply with all provisions of the Consumer Data Protection Act (section 59.1-581(A)(3)).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breaches of those commitments (section 59.1-581(E)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 59.1-575 and 59.1-581 state the conditions for treating data as de-identified and the oversight duty for disclosed de-identified data. They state no log or record duty.
- Kind
- None
- As of
What this law does
A controller in possession of de-identified data must take reasonable measures to ensure that the data cannot be associated with a natural person, publicly commit to maintaining and using it without attempting to re-identify it, and contractually obligate any recipients to comply with all provisions of the Consumer Data Protection Act.
The Virginia Consumer Data Protection Act defines de-identified data as data that cannot reasonably be linked to an identified or identifiable natural person, or a device linked to such person, and its definition of personal data does not include de-identified data.
A controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to and must take appropriate steps to address any breaches of those commitments. Nothing in the Virginia Consumer Data Protection Act requires a controller or processor to re-identify de-identified data or pseudonymous data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .