{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/west-virginia", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/west-virginia.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/west-virginia", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/west-virginia/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/west-virginia/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "west-virginia", "frontmatter": { "title": "West Virginia Consumer Privacy Law", "description": "West Virginia has no comprehensive consumer-privacy statute. The operative state laws are the breach-notification article (W. Va. Code §§ 46A-2A-101 et seq.) and the WVCCPA's deceptive-practices article, layered with FTC Act § 5, GLBA, HIPAA, and COPPA.", "state": "West Virginia", "lastReviewed": "2026-06-12", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "West Virginia breach-notification article, W. Va. Code §§ 46A-2A-101 to 46A-2A-105, plus the WVCCPA unfair-or-deceptive-practices article (W. Va. Code § 46A-6-104) — West Virginia has no comprehensive consumer-privacy law", "appliesTo": "Any individual or entity — corporations, partnerships, limited liability companies, associations, governments, for profit or not — that owns or licenses computerized personal information of West Virginia residents; no revenue or consumer-volume threshold", "privacyPolicyRequired": "No West Virginia statute mandates a general consumer privacy policy or fixes its contents; a policy that misstates actual practices invites FTC Act § 5 and WVCCPA deception exposure, and GLBA, HIPAA, and COPPA supply the contents where those regimes apply", "privateRightOfAction": "Not under the breach-notification article — the Attorney General has exclusive enforcement authority; but WVCCPA § 46A-6-106 gives a consumer a private action for actual damages or $200, whichever is greater, subject to the 45-day right-to-cure notice in § 46A-5-108", "regulator": "West Virginia Attorney General", "bottomLine": "West Virginia has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, notice-at-collection, consent, or processor-contract duties under state law. The operative state statutes are the breach-notification article — enforced exclusively by the Attorney General, with civil penalties capped at $150,000 per breach and available only for repeated and willful violations — and the West Virginia Consumer Credit and Protection Act, whose deceptive-practices article carries a consumer private right of action for actual damages or $200 after a 45-day pre-suit cure window. Everything else in a West Virginia-facing privacy program comes from the federal and sectoral overlay — FTC Act § 5, GLBA, HIPAA, and COPPA — so build to those and to the breach statute, and the program upgrades rather than restarts if West Virginia later enacts an omnibus law.", "lawCoverage": "baseline", "policyMandate": "none", "consumersCanSue": "narrow", "sensitiveDataConsent": "none", "universalOptOutSignal": "notRequired" }, "about": [ "West Virginia consumer privacy law", "West Virginia data breach notification 46A-2A-102", "West Virginia Consumer Credit and Protection Act privacy", "West Virginia no comprehensive privacy law", "West Virginia privacy policy requirements", "West Virginia vendor data processing contracts", "West Virginia Attorney General privacy enforcement", "West Virginia data breach private right of action", "WVCCPA unfair deceptive acts 46A-6-104", "West Virginia right to cure 46A-5-108" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "which-privacy-laws-apply", "label": "Which privacy laws apply to your business in West Virginia?", "heading": "Which privacy laws apply to your business in West Virginia?", "answerText": "There is no comprehensive West Virginia consumer-privacy law. The operative state framework is sectoral. The breach-notification article of the West Virginia Consumer Credit and Protection Act (WVCCPA) reaches any individual or entity that owns or licenses computerized personal information of state residents — and entity is defined to include corporations, partnerships, limited liability companies, associations, governments, and any other legal entity, whether for profit or not. Alongside it, the WVCCPA's general consumer-protection article declares unfair or deceptive acts or practices in any trade or commerce unlawful, which is the hook for privacy-related misrepresentation claims. Neither statute carries a revenue or consumer-volume threshold.", "sources": [ { "id": "q1-stat-102a-duty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(a).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "The breach-notification duty runs to any individual or entity that owns or licenses computerized data that includes personal information of West Virginia residents.", "verbatimQuote": "An individual or entity that owns or licenses computerized data that includes personal information shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-q1-stat-102a-duty" }, { "id": "stat-101-entity", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-101", "citation": "W. Va. Code § 46A-2A-101(2).", "url": "https://code.wvlegislature.gov/46A-2A-101/", "proposition": "The breach-notification article applies to any individual or entity, with entity defined to include corporations, partnerships, limited liability companies, associations, governments, and any other legal entity, for profit or not.", "verbatimQuote": "\"Entity\" includes corporations, business trusts, estates, partnerships, limited partnerships, limited liability partnerships, limited liability companies, associations, organizations, joint ventures, governments, governmental subdivisions, agencies or instrumentalities, or any other legal entity, whether for profit or not for profit.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-101-entity" }, { "id": "stat-6104-udap", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-104", "citation": "W. Va. Code § 46A-6-104.", "url": "https://code.wvlegislature.gov/46A-6-104/", "proposition": "The WVCCPA declares unfair methods of competition and unfair or deceptive acts or practices in any trade or commerce unlawful — the general consumer-protection rule that reaches privacy misrepresentations.", "verbatimQuote": "Unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6104-udap" }, { "id": "stat-6101-purpose", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-101", "citation": "W. Va. Code § 46A-6-101(1).", "url": "https://code.wvlegislature.gov/46A-6-101/", "proposition": "The WVCCPA's consumer-protection article is designed to complement the body of federal law governing unfair, deceptive, and fraudulent acts or practices.", "verbatimQuote": "The Legislature hereby declares that the purpose of this article is to complement the body of federal law governing unfair competition and unfair, deceptive and fraudulent acts or practices in order to protect the public and foster fair and honest competition.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6101-purpose" } ] }, { "slug": "privacy-policy-contents", "label": "What must your West Virginia privacy policy contain?", "heading": "What must your West Virginia privacy policy contain?", "answerText": "No West Virginia statute requires a general consumer privacy policy or fixes what it must say. For most businesses, the governing rule is that whatever you publish has to be true: under Section 5 of the FTC Act, unfair or deceptive acts or practices in or affecting commerce are unlawful, and the WVCCPA reaches any deception, false promise, misrepresentation, or material omission made in connection with the sale or advertisement of goods or services — whether or not anyone was actually misled. Where a sectoral regime applies, that regime supplies the contents instead — a HIPAA covered entity, for example, must give individuals a notice of the uses and disclosures of their protected health information and of their rights and the entity's duties.", "sources": [ { "id": "fed-ftc5-deceptive", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, which reaches a privacy policy that misstates a business's actual data practices.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-ftc5-deceptive" }, { "id": "stat-6102-deception", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-102", "citation": "W. Va. Code § 46A-6-102(7)(M).", "url": "https://code.wvlegislature.gov/46A-6-102/", "proposition": "The WVCCPA defines unfair or deceptive acts to include any deception, false promise, misrepresentation, or concealment or omission of material fact in connection with the sale or advertisement of goods or services, whether or not anyone was in fact misled.", "verbatimQuote": "The act, use or employment by any person of any deception, fraud, false pretense, false promise or misrepresentation, or the concealment, suppression or omission of any material fact with intent that others rely upon such concealment, suppression or omission, in connection with the sale or advertisement of any goods or services, whether or not any person has in fact been misled, deceived or damaged thereby;", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6102-deception" }, { "id": "stat-6101-ftc-guided", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-101", "citation": "W. Va. Code § 46A-6-101(1).", "url": "https://code.wvlegislature.gov/46A-6-101/", "proposition": "West Virginia courts construing the WVCCPA's deceptive-practices article are directed to be guided by FTC policies and federal interpretations of FTC Act § 5.", "verbatimQuote": "It is the intent of the Legislature that, in construing this article, the courts be guided by the policies of the Federal Trade Commission and interpretations given by the Federal Trade Commission and the federal courts to Section 5(a)(1) of the Federal Trade Commission Act (15 U. S. C. § 45(a)(1)), as from time to time amended, and to the various other federal statutes dealing with the same or similar matters.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6101-ftc-guided" }, { "id": "fed-hipaa-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Notice of Privacy Practices", "citation": "45 C.F.R. § 164.520.", "url": "https://www.law.cornell.edu/cfr/text/45/164.520", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information", "proposition": "A HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.", "verbatimQuote": "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-hipaa-notice" }, { "id": "fed-glba-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "GLBA Privacy Notice Requirement", "citation": "15 U.S.C. § 6802(a).", "url": "https://www.law.cornell.edu/uscode/text/15/6802", "deepLink": "https://www.law.cornell.edu/uscode/text/15/6802#:~:text=Except%20as%20otherwise%20provided%20in,section%206803%20of%20this%20title.", "proposition": "GLBA bars a financial institution from disclosing nonpublic personal information to a nonaffiliated third party unless it has provided the consumer a privacy notice complying with the statute's notice rules.", "verbatimQuote": "Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-glba-notice" }, { "id": "fed-coppa-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "COPPA Notice and Parental-Consent Requirement", "citation": "15 U.S.C. § 6502(b)(1)(A).", "url": "https://www.law.cornell.edu/uscode/text/15/6502", "deepLink": "https://www.law.cornell.edu/uscode/text/15/6502#:~:text=require%20the%20operator%20of%20any,of%20personal%20information%20from%20children%3B", "proposition": "COPPA regulations require an operator of a website or online service directed to children to post notice of what information it collects from children, how it uses it, and its disclosure practices, and to obtain verifiable parental consent.", "verbatimQuote": "require the operator of any website or online service directed to children that collects personal information from children or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child— (i) to provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and (ii) to obtain verifiable parental consent for the collection, use, or disclosure of personal information from children;", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-coppa-notice" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with vendors say?", "heading": "What must your contracts with vendors say?", "answerText": "West Virginia has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general private-sector contracts. Where a federal sectoral regime is in scope, it supplies the contracting obligations: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract and to require them to implement appropriate safeguards, and HIPAA requires a business-associate agreement with mandatory data-protection, breach-reporting, and downstream-subcontractor terms before protected health information is shared. The one state-law touchpoint is breach response: a vendor that maintains computerized personal information it does not own or license must notify the owner or licensee of any breach as soon as practicable after discovery.", "sources": [ { "id": "fed-glba-safeguards", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "GLBA Safeguards Rule", "citation": "16 C.F.R. § 314.4(f)(2).", "url": "https://www.law.cornell.edu/cfr/text/16/314.4", "deepLink": "https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards", "proposition": "The GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.", "verbatimQuote": "Requiring your service providers by contract to implement and maintain such safeguards", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-glba-safeguards" }, { "id": "fed-hipaa-baa", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Business Associate Contracts", "citation": "45 C.F.R. § 164.504(e)(2).", "url": "https://www.law.cornell.edu/cfr/text/45/164.504", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,with%20respect%20to%20such%20information%3B", "proposition": "HIPAA requires a business-associate contract that establishes permitted uses and disclosures of protected health information and binds the business associate to safeguard the information, report unauthorized uses and breaches, and flow the same restrictions down to subcontractors.", "verbatimQuote": "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-fed-hipaa-baa" }, { "id": "stat-102c-maintainer", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(c).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "An entity that maintains computerized personal information it does not own or license must notify the owner or licensee of any breach of the security of the system as soon as practicable following discovery.", "verbatimQuote": "An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the system as soon as practicable following discovery, if the personal information was or the entity reasonably believes was accessed and acquired by an unauthorized person.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102c-maintainer" } ] }, { "slug": "breach-notification", "label": "When must you notify people of a data breach in West Virginia?", "heading": "When must you notify people of a data breach in West Virginia?", "answerText": "An individual or entity that owns or licenses computerized personal information must notify any West Virginia resident whose unencrypted and unredacted personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person — where the incident causes, or the entity reasonably believes it has caused or will cause, identity theft or other fraud — and the notice must be made without unreasonable delay. A reportable breach of the security of a system is the unauthorized access and acquisition of unencrypted, unredacted computerized data that compromises personal information and leads the entity reasonably to believe identity theft or other fraud has resulted or will result. Personal information means a resident's first name or first initial and last name linked to a Social Security number, driver's license or state ID number, or a financial-account or card number with its required access code. If more than one thousand persons must be notified, the entity must also alert the nationwide consumer reporting agencies without unreasonable delay.", "sources": [ { "id": "stat-102a-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(a).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "An entity that owns or licenses computerized personal information must notify affected West Virginia residents of a breach that it reasonably believes has caused or will cause identity theft or other fraud, without unreasonable delay.", "verbatimQuote": "An individual or entity that owns or licenses computerized data that includes personal information shall give notice of any breach of the security of the system following discovery or notification of the breach of the security of the system to any resident of this state whose unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired by an unauthorized person and that causes, or the individual or entity reasonably believes has caused or will cause, identity theft or other fraud to any resident of this state. Except as provided in subsection (e) of this section or in order to take any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system, the notice shall be made without unreasonable delay.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102a-notice" }, { "id": "stat-101-breach-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-101", "citation": "W. Va. Code § 46A-2A-101(1).", "url": "https://code.wvlegislature.gov/46A-2A-101/", "proposition": "A breach of the security of a system is the unauthorized access and acquisition of unencrypted, unredacted computerized data that compromises personal information and causes the entity reasonably to believe identity theft or other fraud has resulted or will result.", "verbatimQuote": "\"Breach of the security of a system\" means the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes the individual or entity to reasonably believe that the breach of security has caused or will cause identity theft or other fraud to any resident of this state.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-101-breach-def" }, { "id": "stat-101-pi-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-101", "citation": "W. Va. Code § 46A-2A-101(6).", "url": "https://code.wvlegislature.gov/46A-2A-101/", "proposition": "Personal information is a resident's first name or first initial and last name linked to an unencrypted, unredacted Social Security number, driver's license or state ID number, or financial-account or card number with its required access code.", "verbatimQuote": "\"Personal information\" means the first name or first initial and last name linked to any one or more of the following data elements that relate to a resident of this state, when the data elements are neither encrypted nor redacted: (A) Social security number; (B) Driver's license number or state identification card number issued in lieu of a driver's license; or (C) Financial account number, or credit card, or debit card number in combination with any required security code, access code or password that would permit access to a resident's financial accounts.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-101-pi-def" }, { "id": "stat-102b-encrypted", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(b).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "Notice is required even for encrypted data if the information is acquired in unencrypted form or the breach involves a person with access to the encryption key, where identity theft or other fraud is reasonably believed to result.", "verbatimQuote": "An individual or entity must give notice of the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form or if the security breach involves a person with access to the encryption key and the individual or entity reasonably believes that such breach has caused or will cause identity theft or other fraud to any resident of this state.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102b-encrypted" }, { "id": "stat-102f-cra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(f).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "If more than one thousand persons must be notified of a breach, the entity must also notify the nationwide consumer reporting agencies without unreasonable delay of the timing, distribution, and content of the notices.", "verbatimQuote": "If an entity is required to notify more than one thousand persons of a breach of security pursuant to this article, the entity shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined by 15 U.S.C. §1681a (p), of the timing, distribution and content of the notices.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102f-cra" }, { "id": "stat-103a-safeharbor", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-103", "citation": "W. Va. Code § 46A-2A-103(a).", "url": "https://code.wvlegislature.gov/46A-2A-103/", "proposition": "An entity that follows its own breach-notification procedures under an information privacy or security policy consistent with the article's timing requirements is deemed compliant when it notifies residents under those procedures.", "verbatimQuote": "An entity that maintains its own notification procedures as part of an information privacy or security policy for the treatment of personal information and that are consistent with the timing requirements of this article shall be deemed to be in compliance with the notification requirements of this article if it notifies residents of this state in accordance with its procedures in the event of a breach of security of the system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-103a-safeharbor" }, { "id": "stat-102d-contents", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(d).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "The breach notice must describe the categories of information involved, give a telephone number or website contact point, and include the toll-free numbers and addresses of the major credit reporting agencies with fraud-alert and security-freeze information.", "verbatimQuote": "The notice shall include: (1) To the extent possible, a description of the categories of information that were reasonably believed to have been accessed or acquired by an unauthorized person, including social security numbers, driver's licenses or state identification numbers and financial data; (2) A telephone number or website address that the individual may use to contact the entity or the agent of the entity and from whom the individual may learn: (A) What types of information the entity maintained about that individual or about individuals in general; and (B) Whether or not the entity maintained information about that individual. (3) The toll-free contact telephone numbers and addresses for the major credit reporting agencies and information on how to place a fraud alert or security freeze.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102d-contents" }, { "id": "stat-102e-delay", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-102", "citation": "W. Va. Code § 46A-2A-102(e).", "url": "https://code.wvlegislature.gov/46A-2A-102/", "proposition": "Breach notice may be delayed if a law-enforcement agency determines and advises that notice would impede a criminal or civil investigation or homeland or national security, and must then be made without unreasonable delay once that concern lapses.", "verbatimQuote": "Notice required by this section may be delayed if a law-enforcement agency determines and advises the individual or entity that the notice will impede a criminal or civil investigation or homeland or national security. Notice required by this section must be made without unreasonable delay after the law-enforcement agency determines that notification will no longer impede the investigation or jeopardize national or homeland security.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-102e-delay" }, { "id": "stat-103bc-regulator", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-103", "citation": "W. Va. Code § 46A-2A-103(b)-(c).", "url": "https://code.wvlegislature.gov/46A-2A-103/", "proposition": "A financial institution that follows the Federal Interagency Guidance on response programs, or an entity that complies with its primary or functional regulator's notification rules or guidelines, is deemed in compliance with the breach-notification article.", "verbatimQuote": "A financial institution that responds in accordance with the notification guidelines prescribed by the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice is deemed to be in compliance with this article. (c) An entity that complies with the notification requirements or procedures pursuant to the rules, regulation, procedures or guidelines established by the entity's primary or functional regulator shall be in compliance with this article.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-103bc-regulator" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business in West Virginia over privacy?", "heading": "Can a consumer sue your business in West Virginia over privacy?", "answerText": "Not under the breach-notification article — the Attorney General has exclusive authority to bring an action for its violation. The WVCCPA is a different story. Any person who purchases or leases goods or services and suffers an ascertainable loss from an unfair or deceptive practice may sue in circuit court to recover actual damages or $200, whichever is greater. Two significant limits apply: damages require proof of an actual out-of-pocket loss proximately caused by the violation, and no WVCCPA action may be filed until 45 days after the consumer has sent the business a written, certified-mail notice of the alleged violation and its factual basis.", "sources": [ { "id": "stat-104b-ag-exclusive", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-104", "citation": "W. Va. Code § 46A-2A-104(b).", "url": "https://code.wvlegislature.gov/46A-2A-104/", "proposition": "The Attorney General has exclusive authority to bring an action for a violation of the breach-notification article, so consumers have no private right of action under it.", "verbatimQuote": "Except as provided by subsection (c) of this section, the Attorney General shall have exclusive authority to bring action.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-104b-ag-exclusive" }, { "id": "stat-6106-pra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-106", "citation": "W. Va. Code § 46A-6-106(a).", "url": "https://code.wvlegislature.gov/46A-6-106/", "proposition": "A person who purchases or leases goods or services and suffers an ascertainable loss from a prohibited practice may sue in circuit court to recover actual damages or $200, whichever is greater.", "verbatimQuote": "Subject to subsection (b) of this section, any person who purchases or leases goods or services and thereby suffers an ascertainable loss of money or property, real or personal, as a result of the use or employment by another person of a method, act, or practice prohibited or declared to be unlawful by the provisions of this article may bring an action in the circuit court of the county in which the seller or lessor resides or has his or her principal place of business or is doing business, or as provided for in §46A-1-1 and §46A-1-2 of this code, to recover actual damages or $200, whichever is greater.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6106-pra" }, { "id": "stat-6106-outofpocket", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-6-106", "citation": "W. Va. Code § 46A-6-106(b).", "url": "https://code.wvlegislature.gov/46A-6-106/", "proposition": "A WVCCPA damages award requires proof that the person seeking damages suffered an actual out-of-pocket loss proximately caused by the violation.", "verbatimQuote": "An award of damages in an action pursuant to subsection (a) of this section may not be made without proof that the person seeking damages suffered an actual out-of-pocket loss that was proximately caused by a violation of this article.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-6106-outofpocket" }, { "id": "stat-5108-cure", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-5-108", "citation": "W. Va. Code § 46A-5-108(a).", "url": "https://code.wvlegislature.gov/46A-5-108/", "proposition": "No WVCCPA action may be brought until 45 days after the consumer has informed the business in writing, by certified mail, of the alleged violation and its factual basis.", "verbatimQuote": "An action may not be brought pursuant to this article and §46A-2-1 et seq., §46A-3-1 et seq., §46A-4-1 et seq., and §46A-6-1 et seq. of this code until 45 days after the consumer has informed the creditor, debt collector, seller, or lessor in writing and by certified mail, return receipt requested, to the creditor’s, debt collector’s, seller’s, or lessor’s registered agent identified by the creditor, debt collector, seller, or lessor at the Office of the West Virginia Secretary of State or, if not registered with the West Virginia Secretary of State, then to the creditor’s, debt collector’s, seller’s, or lessor’s principal place of business, of the alleged violation and the factual basis for the violation.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-5108-cure" }, { "id": "stat-5108-tolling", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-5-108", "citation": "W. Va. Code § 46A-5-108(c).", "url": "https://code.wvlegislature.gov/46A-5-108/", "proposition": "The statute of limitations is tolled during the 45-day cure window or while an accepted cure offer is being performed, whichever is longer.", "verbatimQuote": "Any applicable statute of limitations is tolled for the 45-day period set forth in subsection (a) of this section or for the period the effectuation of the cure offer is being performed, whichever is longer.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-5108-tolling" }, { "id": "stat-5108-defense", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-5-108", "citation": "W. Va. Code § 46A-5-108(e).", "url": "https://code.wvlegislature.gov/46A-5-108/", "proposition": "It is a complete defense to a WVCCPA action that a cure offer was made, accepted, and the agreed-upon cure performed, and the business is then entitled to its reasonable attorney fees and costs of defending the action.", "verbatimQuote": "Where an action is brought under this article or §46A-2-1 et seq., §46A-3-1 et seq., §46A-4-1 et seq., and §46A-6-1 et seq. of this code, it is a complete defense that a cure offer was made, accepted, and the agreed upon cure was performed. If the court determines that the cure offer was accepted and the agreed upon cure performed, the creditor, debt collector, seller, or lessor is entitled to reasonable attorney’s fees and costs attendant to defending the action.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-5108-defense" }, { "id": "stat-5108-fees", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-5-108", "citation": "W. Va. Code § 46A-5-108(f).", "url": "https://code.wvlegislature.gov/46A-5-108/", "proposition": "A business that timely delivers a cure offer is not liable for the consumer's attorney fees and court costs incurred after delivery unless the relief ultimately awarded, excluding fees and costs, exceeds the value of the cure offer.", "verbatimQuote": "The creditor, debt collector, seller, or lessor is not liable for the consumer’s attorney’s fees and court costs incurred following delivery of the cure offer unless the actual damages, civil penalties, and any other monetary or equitable relief provided for under this article and §46A-2-1 et seq., §46A-3-1 et seq., §46A-4-1 et seq., and §46A-6-1 et seq. of this code are found to have been sustained and awarded, without consideration of attorney’s fees and court costs, exceed the value of the cure offer.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-5108-fees" } ] }, { "slug": "ag-enforcement", "label": "How is privacy law enforced in West Virginia?", "heading": "How is privacy law enforced in West Virginia?", "answerText": "By the Attorney General. A failure to comply with the breach-notification article's notice provisions constitutes an unfair or deceptive act under the WVCCPA, enforceable by the Attorney General under that chapter's enforcement provisions. The penalty structure is forgiving by design: no civil penalty may be assessed unless the court finds a course of repeated and willful violations, and no penalty may exceed $150,000 per breach or per series of similar breaches discovered in a single investigation. Licensed financial institutions are carved out entirely — violations by them are enforceable exclusively by the institution's primary functional regulator.", "sources": [ { "id": "stat-104a-bridge", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-104", "citation": "W. Va. Code § 46A-2A-104(a).", "url": "https://code.wvlegislature.gov/46A-2A-104/", "proposition": "Failure to comply with the breach-notification article's notice provisions constitutes an unfair or deceptive act under the WVCCPA, enforceable by the Attorney General.", "verbatimQuote": "Except as provided by subsection (c) of this section, failure to comply with the notice provisions of this article constitutes an unfair or deceptive act of practice in violation of section one hundred four, article six, chapter forty-six-a of this code, which may be enforced by the Attorney General pursuant to the enforcement provisions of this chapter.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-104a-bridge" }, { "id": "stat-104-penalty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-104", "citation": "W. Va. Code § 46A-2A-104(b).", "url": "https://code.wvlegislature.gov/46A-2A-104/", "proposition": "Civil penalties for breach-notice violations require a course of repeated and willful violations and are capped at $150,000 per breach or per series of similar breaches discovered in a single investigation.", "verbatimQuote": "No civil penalty may be assessed in an action unless the court finds that the defendant has engaged in a course of repeated and willful violations of this article. No civil penalty shall exceed $150,000 per breach of security of the system or series of breaches of a similar nature that are discovered in a single investigation.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-104-penalty" }, { "id": "stat-104c-fininst", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "W. Va. Code § 46A-2A-104", "citation": "W. Va. Code § 46A-2A-104(c).", "url": "https://code.wvlegislature.gov/46A-2A-104/", "proposition": "A breach-notification violation by a licensed financial institution is enforceable exclusively by the institution's primary functional regulator.", "verbatimQuote": "A violation of this article by a licensed financial institution shall be enforceable exclusively by the financial institution's primary functional regulator.", "anchor": "https://openagreements.org/practice-guides/privacy/us/west-virginia#src-stat-104c-fininst" } ] } ] } }