Comparing the Data Protection Assessment Requirements Across the Next Generation of U.S. State Privacy Laws

Virginia Consumer Data Protection Act (VDCPA), in force Jan 1, 2023

“Heightened risk of harm”
VDCPA requires controllers¹to prepare DPIAs for any activities that present a “heightened risk of harm” to consumers. 

Definition

“Heightened risk of harm” is not defined, however, DPIAs are specifically mandated for:

• Targeted advertising;
• Sales of personal data;
• Processing personal data for profiling which creates certain risks for consumers (including unfair or deceptive treat; unlawful disparate treatment; financial, physical, or reputational injury; and other risks); and
• Processing sensitive data.²

Benefits v risks
The DPIA must “identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.”³

Conducting and documenting the DPIA
In conducting and documenting the DPIA, controllers must consider:
“[t]he use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed.”⁴

Government Investigations
Upon request by the state Attorney General, in connection with an investigation, controllers must disclose any DPIAs relevant to the investigation.⁵

Privilege waiver?
The disclosure of a DPIA does not constitute a waiver of any attorney-client privilege or work-product protection that might otherwise exist with respect to the assessment and any information contained in the assessment.⁶

Confidentiality
The disclosures will be deemed confidential and exempted from state public inspection and copying law (i.e., State FOIA laws).⁷

Colorado Privacy Act (CPA), in force Jul 1, 2023

Closely Mirrors VDCPA
Like the VDCPA, the CPA requires controllers to conduct DPIAs for any activities that present a heightened risk of harm to consumers, and specifically mandates DPIAs in the same contexts as the VDCPA.⁸

Unlike the VDCPA, the risk of reputational injury would not warrant a DPIA in the context of profiling.

Required Content Mirrors VDCPA
The content requirements for DPIAs under the CPA mirror those of the VDCPA.

Mirrors VDCPA
The disclosure requirements for DPIAs under the CPA mirror those of the VDCPA.

California Privacy Regulations Act (CPRA), in force Jan 1, 2023

“Significant Risk”
Within the rulemaking provisions of the CPRA, the Attorney General is charged with the issuance of regulations requiring risk assessments for processing activities that present “significant risk” to consumers’ privacy or security.⁹   Therefore, this requirement may be added by the July 1, 2022 deadline for adopting final regulations.

Definition
“Significant risk” is not defined in the CPRA but may be fleshed out by the regulations.

Required Content Mirrors the GDPR
A “risk assessment” required under the CPRA must:

• indicate whether the processing involves sensitive personal information, and
• identify and weigh the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with such processing, with the goal of restricting or prohibiting such processing if the risks to the privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public.¹⁰

Submission to CPPA
Businesses will be required to submit their “risk assessments” to the California Privacy Protection Agency on a regular basis.¹¹

Further reporting?
Again, we expect that the DPIA reporting requirements will be expanded by the regulations.

The good news for organizations seeking to understand how to adapt their privacy programs to these new laws is that the data protection assessment requirements of these laws are similar enough that organizations will likely not need to develop separate DPIA policies and procedures to address each law.