Virginia Code § 59.1-580 — Data protection assessments for risky profiling and processing

AI-use reference. Current. Applies to: Covered controllers Requirements or purpose: Document assessments for targeted ads, sale, sensitive data and risky profiling, including risks of unfair/deceptive treatment, unlawful disparate impact, injury or substantial privacy intrusion. Balance benefits/risks and safeguards; provide assessments to Attorney General on request. Limits: § 59.1-576 exempts state/local governmental bodies, HIPAA entities/business associates, specified financial entities/data, nonprofits and higher education; numerous data exemptions also apply. Not a city-wide AI regulation; applicability to a private supplier depends on its activities and exemptions. Assessments confidential and FOIA-exempt; no automatic publication duty. SectionF limits application to processing activities created/generated after Jan 1, 2023 and is not retroactive.