Fingerprinting in connection with business transactions

Virginia's only general biometric-type rule for businesses: unless the parties agree otherwise, anyone who requires fingerprints in a business transaction must return or destroy the prints and all copies, including electronic copies, within 21 days after the transaction ends. Virginia has no BIPA-style biometric privacy statute; biometric data used to identify a person is otherwise 'sensitive data' under the VCDPA.