Richmond Software Development, Designed for Virginia's Privacy Law

Who the Act applies to, and what it asks of software

The Act applies to businesses that operate in Virginia or target its residents and that control or process the personal data of at least 100,000 Virginia consumers during a calendar year, or of at least 25,000 while deriving over half of gross revenue from the sale of personal data. It exempts some organizations outright, including state and local government bodies, financial institutions subject to the federal Gramm-Leach-Bliley Act, and HIPAA covered entities and business associates. Whether your company is covered is a question for your counsel. If it is, the business has obligations its software should support:

• →Consumer requests to confirm and access, correct, delete and obtain a portable copy of personal data.
• →Opt-outs from targeted advertising, from sale, and from profiling in furtherance of decisions with legal or similarly significant effects.
• →Data protection assessments, which a controller must conduct and document for activities such as targeted advertising, the sale of personal data, processing sensitive data, and profiling that presents a reasonably foreseeable risk of harm.

The Act also requires a processor, a company handling data on a controller's instructions, to help the controller respond to requests and secure the data, and a contract between the two governs that processing.

AI features and the profiling opt-out

An AI model whose output feeds a decision about a consumer's lending, housing, insurance, education, employment or health care may be profiling under the Act. Before such a feature is built, we work out with your counsel whether an opt-out or an assessment applies, and design the fallback path a consumer gets after opting out. Where the feature calls for it, we keep a record of what the model saw and why it decided, because an assessment and a complaint both need one.

The industries Richmond is built on

The Greater Richmond Partnership targets finance and insurance, logistics and e-commerce, data centers, life sciences and advanced manufacturing, among other sectors. The Federal Reserve Bank of Richmond is headquartered in the city and serves the Fifth District, which covers Virginia, the Carolinas, Maryland, Washington, D.C. and most of West Virginia. For Richmond buyers, that points to three kinds of work:

• →Financial and insurance applications with explainable decisions; see fintech.
• →Order, inventory and fulfillment software for distributors and online sellers; see e-commerce and logistics.
• →Data systems that hold personal data in fewer places and know where each copy lives; see database design and development.

Selling to the Commonwealth

The State Capitol stands on Bank Street in Richmond. eVA is Virginia's eProcurement marketplace for state agencies, which local governments can also use, and suppliers register there before taking part. We join public sector work as a subcontractor on a prime contractor's team or by answering an RFP.