It is often said that businesses need transparency and certainty. The same is true of consumers. As implementation is anticipated, please address the following: ISSUE 1: Each individual consumer must themselves contact each entity with whom we interact if we desire to protect our data. We must ascertain the procedure developed by each business entity and follow their directions. If we disagree with the outcome, we can only appeal to the company, using company designed procedures. This is an unfair burden on consumers. Most consumers are unaware of the legal names of the companies that collect our data, or the relationships among companies, and may not even be able to list all we must notify. ACT: Develop standard protocol for how consumers notify business of our desire to protect our data. Consider something like the Do Not Call List so consumers can make one contact or make the procedure standard so consumers can learn one process. ISSUE 2: Consumers need education. The legislation addresses business education only. Consumers at various life cycle stages, with various broadband, and various exposure to data collection and use have different education needs. Since consumers get “take it or leave it” contracts written in legalese, most never attempt to read/understand. Consumers must learn rights & responsibilities. ACT: Establish a consumer education work group. Consider the model used by the SCC for energy education. Ask Cooperative Extension’s Family & Consumer Science and 4-H Programs to do education programming. Provide funding for public service media, exhibits at local events, etc. ISSUE 3: Many consumers, are unaware of the risks of sharing/not data. Possibly because they have not experienced the negative impacts of improper use of personal data. Consumers need a standardized protocol to request data & to learn about risks and responsibilities of handling/transferring data. ACT: Develop consumer education/ public media strategies to teach consumers about data sharing risks/ responsibilities. ISSUE 4: The legislation has an opt-out system. This means no protection unless we: 1) know the law exists, 2) figure out and act on the requirements. ACT: Change to an opt-in system with a standard procedure. ISSUE 5: Only the state AG can enforce. No dependable stream of funding. When businesses know consumers have no remedy, they won't protect consumer data. Companies get a “right to cure” with no public notification of improper action, no competitor alert, & no fee and penalty funding. Can an office with 2 attorneys and 2 staff do the job? ACT: Give consumers a private right of action. Change the AGs funding source. Allow for funding & staffing growth for enforcement and education to automatically adjust. ISSUE 6: Businesses have been closely involved & heavily consulted; Business implementation was addressed in prior meetings. However, there has been minimal involvement of consumers/ consumer representatives who are not primarily affiliated with business. As implementation is anticipated, it is critically important that consumers’ needs are addressed. ACT: Invite a panel of consumers and consumer focused representatives who are not primarily affiliated with business to the September meeting of this work group. The Virginia Citizens Consumer Council would be glad to help coordinate this effort.

On behalf of Consumer Federation of America, a nonprofit association of consumer groups across the country, including in Virginia, I sent the work group staff a letter dated August 13, addressed to the chair, and requested that it be distributed to all of the members of the work group. In the letter I outlined some of the most important changes that should be made to the CDPA in order to provide effective privacy protection for Virginians. These include treating affiliates of companies as third parties, requiring meaningful data minimization, broadening the definition of "sale" and changing the definitions of personal data and publicly available information, enabling consumers to avoid all targeted advertising and profiling, eliminating the provision that allows companies to charge consumers more or provide them with a lower quality of products and services if consumers exercise their privacy rights under the statute, and strengthening enforcement. Since it is not possible to have a substantive discussion of these and other issues in the short amount of time available for public input at the end of the work group meetings, I suggest that the agenda for a future meeting include a panel of experts from nonprofit consumer and privacy organizations that are independent of funding from businesses. Their perspectives are vital as the work group considers recommendations to improve the statute.