Earlier this year, several pieces of privacy related legislation pending in the 2020 General Assembly session were referred by a standing committee of the Virginia House of Delegates to the Joint Commission on Technology and Science (JCOTS) for study outside of the regular legislative session. JCOTS has taken its first steps toward establishing study committees to look at several issues prior to the 2021 regular legislative session.

Specifically, JCOTS established the following study committees:

  • Data Protection & Privacy Advisory Committee
  • Children’s Online Protection Advisory Committee
  • Facial Recognition within Law Enforcement Advisory Committee

JCOTS will also continue its ongoing study of Artificial Intelligence.

Although a work plan for each committee has not been published, it is likely the committees, comprised entirely of legislators, will evaluate the policy issues raised by several bills introduced in the 2020 session. Typically, the Commission does not do a line-by-line review/mark up of the bills referred to it from the legislature. Instead, it is expected the referred bills will be used to highlight the policy issues that are involved in legislating on a particular topic. That said, it is helpful to be aware of the bills that were referred to the Commission since the provisions of those bills, along with the positive and negative attributes of them, will probably be considered by the committees in determining whether to recommend legislation on these topics.

It is anticipated that the Commission staff will make presentations to each study committee on things such as what other states are doing in that specific area of law. The staff also may invite presenters from industry or advocacy organizations to give presentations or provide information to assist the committees in determining the public policy issues to be addressed. It is likely that the committees will use the 2020 legislation referred to the Commission as a starting point of the discussion.

The Data Protection and Privacy Advisory Committee is chaired by Delegate Hala Ayala (D) who is in her second term as a member of the House of Delegates and in her professional life is a cybersecurity specialist. She is a new member on JCOTS and is a recently announced candidate for the Democratic nomination for Lt. Governor in the 2021 election. The committee is expected to discuss the following bills from the 2020 legislative session:

  • HB473(Delegate Sickles): Personal data; Virginia Privacy Act. Gives consumers the right to access their data and determine if it has been sold to a data broker. The measure requires a controller (defined in the bill as a person that, alone or jointly with others, determines the purposes and means of the processing of personal data) to facilitate requests to exercise consumer rights regarding access, correction, deletion, restriction of processing, data portability, objection, and profiling. The measure applies to any legal entity that conducts business in the Commonwealth or produces products or services that are intentionally targeted to residents of the Commonwealth and that (a) controls or processes personal data of not fewer than 100,000 consumers or (b) derives over 50 percent of gross revenue from the sale of personal data and processes or controls personal data of not fewer than 25,000 customers.
  • HB884 (Delegate Subramanyam): Safe destruction of records containing personal identifying information. Requires a commercial entity that is in possession of, or has within its custody or control, records that (i) contain consumers’ unencrypted, unredacted personal identifying information and (ii) are no longer needed by the commercial entity to take reasonable steps to destroy, or arrange for the destruction of, the records by shredding, erasing, or otherwise destroying or modifying the personal identifying information in the records to make it unreadable or indecipherable.
  • HB954 (Delegate Ayala): Cybersecurity; care and disposal of customer records; security for connected devices. Requires any business to take all reasonable steps to dispose of, or arrange for the disposal of, customer records within its custody or control containing personal information when the records are no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.
  • HB1215 (Delegate Tran): Biometric data; employer policy on storage, protection, and destruction; civil penalty. Establishes the parameters for the capture and safekeeping of biometric data by employers. The bill defines “biometric data” as a retina or iris scan, fingerprint, voiceprint, record of hand or face geometry, or any other means of information, regardless of how it is captured or stored, that is used to identify an individual based on biological identifiers.

The Children’s Online Protection Advisory Committee is chaired by Senator Barbara Favola (D). Delegate Ayala is a member of this committee and sponsored several bills in the 2020 session related to online privacy for children. It is anticipated the committee will discuss these bills as part of its study:

  • HB952(Delegate Ayala): Digital services; protection for minors. Requires the operator of a digital service, which is defined as a website, online service, online application, or mobile application, to permit minors to remove, or to request and obtain removal of, content or information posted on a digital service. The measure prohibits an operator of a digital service directed to minors from marketing or advertising to minors specified products or services that minors are prohibited from buying. The measure also prohibits marketing or advertising certain products on the basis of personal information specific to a minor or knowingly using, disclosing, compiling, or allowing a third party to do so.
  • HB955(Delegate Ayala): Children’s online privacy protection. Prohibits any person who operates a website for commercial purposes and who collects or maintains personal information from or about the users of or visitors to such website or online service from releasing personal information collected from minors for any purpose, except where the personal information is provided to a person other than an operator that provides support for the internal operations of the website, online service, online application, or mobile application of the operator, but excluding any activity relating to targeted marketing directed to minors, and does not disclose or use that personal information for any other purpose.
  • HB956(Delegate Ayala): Virginia Consumer Protection Act; advertising or offering for sale of Internet-connected devices targeting children; prohibition. Prohibits the advertising or offering for sale of Internet-connected devices for which the target market consists of consumers below 18 years of age by making it unlawful under the Virginia Consumer Protection Act.

* Summaries provided by the Virginia Division of Legislative Services as posted on the Legislative Information Services website. To view the full legislative text, use the hyperlinked bill number for each bill.

The Facial Recognition within Law Enforcement Advisory Committee is chaired by Delegate Cliff Hayes (D) who is also the chairman of JCOTS. The Commission previously received presentations on facial recognition and artificial intelligence. The 2020 General Assembly also considered, but did not advance, a resolution (House Joint Resolution 59) directing JCOTS to study the proliferation of facial recognition and artificial intelligence.

Because of the pandemic, JCOTS has only recently established its study committees to evaluate these issues. It is likely the study committees will meet 2-3 times prior to the beginning of the 2021 legislative session in January. The Commission has any number of options as it relates to a final product for the studies. Those options range from producing a final study report outlining the policy issues the state should address in legislation to drafting specific legislation with the endorsement of the Commission for consideration in the 2021 General Assembly session.

Interested parties operating in industries touched by these specific privacy issues should closely monitor the activities of the Commission as they may presage legislation that will appear in January of 2021 for consideration by the Virginia legislature.