**the following is not legal advice, nor expert privacy advice as I am not a lawyer nor data professional. as with all things on this website and in life, practice discernment and do your own thorough research.**

The Virginia CDPA states that any Virginia resident can request the deletion of their data from businesses that profit from the sale or distribution of data on a large scale. It states that the business must respond within 45 days to the request (they may request an extension of an additional 45 days).

The business will either grant the request or decline the deletion request; they must provide justification. They can also request additional information. If the business declines the decision, they must provide clear instructions for appealing the decision.

Once the Virginia resident files an appeal, the business has 60 days to provide a written explanation for their decision. If the appeal is denied by the business, the business must provide the resident with an online or other method for contacting the Attorney General to submit a complaint.

Read more in this summary provided by the Virginia Attorney General’s office.

Virginia Code Section:

Chapter 53. Consumer Data Protection Act.

§ 59.1-577. Personal data rights; consumers.
A. A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child’s parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right:

3. To delete personal data provided by or obtained about the consumer;
4. To obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Sample Email:

Dear [company name],

I am submitting a request for implementation of the following rights under § 59.1-577A(3) of the Virginia VCDCPA which grant Virginia residents certain rights in relation to protection of their personal data information:

1) To obtain erasure (deletion) of personal data (information) without undue delay;
2) To withdraw any consent given to the processing of personal data (information);
3) To object to processing of personal data (information) concerning the below individual, including but not limited to profiling and direct marketing.

I can be identified by my details below:

Name:
Address:
E-mail address:

Please confirm your compliance with the request without undue delay and in any event within 45 (forty five) days of receipt of this request.

Thank you,