The proposed Consumer Data Protection Act establishes a comprehensive framework for the control and processing of personal data in West Virginia, targeting businesses that either control or process personal data of at least 100,000 consumers or derive over 50% of their revenue from the sale of personal data involving at least 25,000 consumers. The bill outlines the responsibilities and privacy protection standards for data controllers and processors, while explicitly exempting state and local governmental entities, financial institutions, and certain health-related data governed by federal law. It grants consumers rights to access, correct, delete, and obtain copies of their personal data, as well as the ability to opt out of targeted advertising.

Additionally, the bill designates the Attorney General as the exclusive authority to enforce violations and establishes a Consumer Privacy Fund to support these enforcement efforts. It mandates that data controllers respond to consumer requests within 45 days and provides for an appeal process if requests are denied. The legislation also requires data protection assessments for specific processing activities and emphasizes the need for data security practices. The bill is set to take effect on January 1, 2024, and aims to enhance consumer privacy rights while providing clear guidelines for data handling by businesses.

Statutes affected:
Introduced Version: 46A-6O-1, 46A-6O-2, 46A-6O-3, 46A-6O-4, 46A-6O-5, 46A-6O-6, 46A-6O-7, 46A-6O-8, 46A-6O-9, 46A-6O-10, 46A-6O-11, 46A-6O-12, 46A-6O-13