As we previously reported, significant data privacy bills, titled the Consumer Data Protection Act, are working their way through the Virginia legislature. If enacted, Virginia would be the second state to enact major data privacy legislation of general applicability.

As of today, Virginia’s Senate and House of Delegates have passed identical bills, and they now move on to Virginia’s Governor, Ralph Northam. On the Senate floor today, there was debate that the bills were flawed for not including a private right of action and leaving enforcement to the Office of the Attorney General. This caused some senators to oppose the bills, but they ultimately passed by a vote of 32-7.

Governor Northam could enact the bills by signing them into law, or he could use his line item veto authority to make amendments. The Governor could also veto the bills in their entirety, but that does not seem likely at this point. The Governor is expected to act by the end of March.

We will continue to monitor the legislative process closely and provide updates as the bills progress.