2025 SESSION
INTRODUCED
25102828D
HOUSE BILL NO. 2268
Offered January 8, 2025
Prefiled January 7, 2025
A BILL to amend and reenact 30-85 of the Code of Virginia and to amend the Code of Virginia by adding in Chapter 5 of Title 2.2 an article numbered 5, consisting of a section numbered 2.2-525, relating to Department of Law; Division of Emerging Technologies, Cybersecurity, and Data Privacy established.
PatronAnthony
Committee Referral Pending
Be it enacted by the General Assembly of Virginia:
1. That 30-85 of the Code of Virginia is amended and reenacted and that the Code of Virginia is amended by adding in Chapter 5 of Title 2.2 an article numbered 5, consisting of a section numbered 2.2-525, as follows:
Article 5.
Division of Emerging Technologies, Cybersecurity, and Data Privacy.
2.2-525. Division of Emerging Technologies, Cybersecurity, and Data Privacy created; duties.
A. There is created in the Department of Law a Division of Emerging Technologies, Cybersecurity, and Data Privacy (the Division) that shall oversee and enforce laws governing cybersecurity, data privacy, and the use of artificial intelligence (AI) and other emerging technologies.
B. The duties of the Division shall be to:
1. Investigate complaints regarding violations of laws governing cybersecurity, data privacy, and the use of AI, including violations of the Consumer Data Protection Act ( 59.1-575 et seq.);
2. Conduct audits of public and private entities to ensure compliance with applicable state laws governing cybersecurity, data privacy, and the use of AI and automated systems;
3. Issue corrective action plans and cease and desist orders, seek injunctions, and refer cases for civil or criminal prosecution as necessary under existing state laws;
4. Make such studies related to enforcing laws of the Commonwealth governing cybersecurity, data privacy, and the use of AI or other emerging technologies as deemed necessary and recommend to the Governor and General Assembly the enactment of any legislation deemed necessary to address any emerging challenges and technological advancements;
5. Submit an annual report to the Joint Commission on Technology and Science by November 1 of each year detailing (i) trends in enforcement, audit findings, and compliance rates under cybersecurity, data privacy, and AI-related laws and (ii) legislative recommendations for addressing emerging challenges and technological advancements;
6. Maintain a public website summarizing the Division's enforcement actions, compliance rates under cybersecurity, data privacy, and AI-related laws, and trends in emerging technologies and technological advancements. Any sensitive or confidential security information shall be excluded from such public website;
7. Conduct public outreach campaigns to educate individuals and businesses about their rights and obligations under laws governing cybersecurity, data privacy, and the use of AI;
8. Collaborate with the Virginia Information Technologies Agency to conduct cybersecurity risk assessments and develop mitigation strategies for such risks; and
9. Collaborate with the Department of Criminal Justice Services to ensure that law-enforcement use of automated systems complies with applicable state laws.
C. The Attorney General may employ and fix the salaries of such attorneys, employees and consultants, within the amounts appropriated to the Attorney General for providing legal service for the Commonwealth, and other services as may be provided for by law, as he may deem necessary in the operation of the Division to carry out its functions.
30-85. Commission established; powers and duties.
The Joint Commission on Technology and Science (JCOTS) is hereby established as a permanent legislative agency of the Commonwealth. JCOTS shall generally study all aspects of technology and science and endeavor to stimulate, encourage, promote, and assist in the development of technology and science in the Commonwealth and sound public policies related thereto. In addition, JCOTS shall:
1. Evaluate the impact of existing statutes and proposed legislation related to technology and science in the Commonwealth;
2. Advise the General Assembly, Governor, and agencies, authorities, and institutions of the Commonwealth upon matters related to technology and science;
3. Investigate, research, and consider such issues related to technology and science as may be requested by the General Assembly or determined by JCOTS;
4. Make recommendations to the General Assembly and the Governor;
5. Consult with appropriate entities, public or private, on matters related to technology and science under JCOTS' consideration;
6. Encourage research and development in technology and science;
7. Solicit input from appropriate entities, public or private, on issues related to technology and science;
8. Coordinate its efforts with and assist the efforts of other agencies, authorities, and institutions of the Commonwealth;
9. Accept private or public funds to carry out its purposes; and
10. Collaborate with the Division of Emerging Technologies, Cybersecurity, and Data Privacy (the Division) to (i) receive and review the annual reports submitted to JCOTS by the Division as required by 2.2-525; (ii) hold public hearings to gather community input on the impact of emerging technologies; and (iii) issue legislative recommendations to address gaps in existing laws or emerging risks related to cybersecurity, data privacy, and artificial intelligence;
11. Monitor the implementation and enforcement of laws governing cybersecurity, data privacy, and artificial intelligence; and
12. Annually report its findings and recommendations to the General Assembly and the Governor. JCOTS shall make such further interim reports to the General Assembly and the Governor as it deems advisable or as required by concurrent resolution of the General Assembly or by the Governor. The chairman of JCOTS shall submit to the General Assembly and the Governor an annual executive summary of the interim activity and work of JCOTS no later than the first day of each regular session of the General Assembly. The executive summary shall be submitted as provided in the procedures of the Division of Legislative Automated Systems for the processing of legislative documents and reports and shall be posted on the General Assembly's website.