Client Alert: Virginia Attorney General Signals Increased Focus on Civil Enforcement and Data Privacy

Virginia Attorney General Jay Jones spoke to the Virginia Bar Association’s White Collar Forum in Richmond last week, where he discussed his Administration’s approach to white collar and consumer-protection enforcement. Attorney General Jones emphasized the importance of achieving practical results that protect Virginia consumers, including through civil enforcement rather than relying exclusively on criminal prosecution. He also specifically highlighted the protection of Virginians’ privacy and personal information, highlighting enforcement of the Virginia Consumer Data Protection Act (“VCDPA”) and related privacy and cybersecurity requirements as an important consumer-protection priority.

For Virginia businesses, the message is significant. White Collar enforcement has long been accomplished primarily through criminal rather than civil means. The OAG’s new prioritization of protecting consumers through civil enforcement means that white collar defense attorneys and their clients should focus efforts on compliance with civil consumer protection laws, as even non-criminal compliance issues are likely to draw government scrutiy.

Further, consumer-protection compliance increasingly carries real financial and regulatory risk even when the conduct does not result in criminal prosecution. Companies doing business in Virginia should treat data privacy and cybersecurity compliance as an enforcement issue, not simply an information-governance exercise. Businesses subject to the VCDPA should review their privacy notices, consumer-rights procedures, data-processing practices, sensitive-data controls, vendor relationships, and cybersecurity safeguards now, before an OAG inquiry or civil investigative demand puts those practices under scrutiny.

The VCDPA places enforcement authority exclusively with the Attorney General and gives the OAG meaningful civil-enforcement tools. Where violations are not timely cured as provided by the statute, the Attorney General may seek injunctive relief and civil penalties of up to $7,500 for each violation, as well as reasonable investigative expenses and attorneys’ fees.

Gentry Locke’s White Collar Defense, Investigations, and Compliance attorneys are experienced in defending clients facing government enforcement from the OAG in both criminal and civil matters, including the Virginia Consumer Protection Act and data privacy compliance and enforcement under VCDPA.