The following are points of emphasis that arose during the six Work Group meetings:

• Consider leadership, outside of the Office of Attorney General, to lead an educational initiative to assist small to medium-sized businesses in complying with the VCDPA;

• Submit a budget amendment to fund two staff members, and two attorneys through general funds to lead enforcement of the VCDPA from day one of enactment;

• Replace the Consumer Privacy Fund with the existing general funds;

• Allow the Office of the Attorney General to pursue actual damages based on consumer harm, should they exist;

• Employ an "ability to cure" option for violations, should a potential cure exist;

• Authorize consumers to assert and requiring companies to honor a global opt-out setting as a single-step for consumers to opt-out of data collection;

• Sunset the "right to cure" provision after the initial years of VCDPA enactment to prevent companies from exploiting this provision;

• Amend the "right to delete" provision to be a "right to opt out of sale" provision in order to promote compliance and restrict further dissemination of consumer personal data;

• Consider a narrow exemption for § 501(c)(4) nonprofit organizations established to detect or prevent insurance-related crime or fraud;

• Study specific data privacy protection provisions for children;

• Request an annual report from the Office of the Attorney General on enforcement of the VCDPA;

• Encourage the development of third-party software and browser extensions to allow users to universally opt out of data collection, rather than individually from each website;

• Recruit nonprofit consumer and privacy organizations to address concerns with the definitions of "sale," "personal data," and "publicly available information" in the VCDPA;

• Consider whether the definition of "sensitive data" should include general demographic data used to promote diversity and outreach to underserved populations;

• Create a website dedicated to educating consumers about their rights under the VCDPA;

• Direct an agency to promulgate regulations because the current VCDPA does not allow the Office of the Attorney General to promulgate regulations; and

• Post and promote sample data protection forms on an educational website to provide guidance to smaller businesses seeking to comply with the VCDPA.

Delegate Hayes and Senator Marsden will present the Work Group's recommendations based on these points of emphasis during the upcoming legislative session.