The proposed Consumer Data Protection Act establishes a comprehensive framework for the control and processing of personal data in West Virginia. It applies to businesses that either control or process personal data of at least 100,000 consumers or derive over 50% of their revenue from the sale of personal data involving at least 25,000 consumers. The bill outlines the responsibilities and privacy protection standards for data controllers and processors, while exempting state and local governmental entities, financial institutions, and certain health-related data governed by federal law. Key provisions include consumer rights to access, correct, delete, and obtain copies of their personal data, as well as the ability to opt out of targeted advertising.

Significant insertions in the bill include requirements for data controllers to monitor compliance with contractual commitments regarding pseudonymous and de-identified data, and the establishment of a Consumer Privacy Fund to support enforcement efforts by the Attorney General, who is granted exclusive authority to enforce violations. The bill also specifies that localities cannot enact conflicting laws regarding personal data control or processing, ensuring a uniform approach across the state. The legislation is set to take effect on January 1, 2024, aiming to enhance consumer protection and accountability in the handling of personal data.

Statutes affected:
Introduced Version: 46A-6O-1, 46A-6O-2, 46A-6O-3, 46A-6O-4, 46A-6O-5, 46A-6O-6, 46A-6O-7, 46A-6O-8, 46A-6O-9, 46A-6O-10, 46A-6O-11, 46A-6O-12, 46A-6O-13