Law note · Virginia
Breach of personal information notification
An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to the Office of the Attorney General and any affected Virginia resident without unreasonable delay following discovery.
'Personal information' here (a Social Security, driver's license or state ID, passport, or military ID number, or a financial account number with an access code, each combined with a name) is narrower than VCDPA's 'personal data' and excludes information obtained from publicly available government records.
Unlike VCDPA, which bars a private plaintiff outright, this breach-notification chapter expressly preserves an individual's right to recover direct economic damages for a violation of the notification duty. This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.
What it asks of an app
- Notify the Virginia Office of the Attorney General and each affected Virginia resident of a breach of system security involving personal information without unreasonable delay after discovery.
- Do not rely on this statute to cover information obtained from publicly available government records; the notification duty's personal information definition excludes it.
- Expect an individual affected by a violation of this notification duty to be able to sue for direct economic damages; unlike VCDPA, this chapter does not bar a private plaintiff.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Virginia statute text, Title 18.2 Chapter 6, Code of Virginia