1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

In January 2019, West Virginia revised its Industrial Hemp Development Act (“the IHDA”). W. Va. Code § 19-12E-3 to -11. IHDA establishes hemp-derived cannabinoids are not controlled substances. W. Va. Code § 19-12E-5(f)(2). Under this law, products intended for ingestion containing CBD are considered foods instead of controlled substances or adulterated products. W. Va. Code § 19-12E-5(f)(3). Also, hemp derivatives, including CBD can be added to cosmetics, personal care products, and products intended for animal or human consumption without being considered an adulteration of the products. W. Va. Code § 19-12E-5(f)(6). The sale of hemp and CBD products produced in other states is permitted as long as the exporting state maintains substantially similar processing requirements as West Virginia. W. Va. Code § 19-12E-5(f)(5).

Industrial hemp may be cultivated and sold by any individual who obtains licensure from the West Virginia Department of Agriculture (“the Department”). W. Va. Code § 19-12E-5(a). The application process includes providing the name and address of the applicant, the legal description and GPS coordinates of the land area to be used for the production of industrial hemp. W. Va. Code §19-12E-5(b). Applicants must also submit fingerprints for a state and national criminal history background check. W. Va. Code §19-12E-5(b). Also, applicants must provide the Department written consent permitting the Department and law enforcement to enter all premises where industrial hemp is grown, cultivated, processed, or stored to conduct physical inspections or otherwise ensure compliance. W. Va. Code § 19-12E-5(e). An individual does not need a license to possess, handle, transport, or sell products or extracts containing CBD. W. Va. Code § 19-12E-5(f)(1).

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

West Virginia has not adopted its own version of GDPR.

In 2019, West Virginia enacted West Virginia Code § 5A-6B-1 to-6 which establishes the West Virginia Cybersecurity Office within the Office of Technology. The Cybersecurity Office is empowered to implement policies and procedures that protect and prevent cyber threats to the State of West Virginia. The Cybersecurity Office has the power to govern the cyber security programs for all state agencies, excluding higher education institutions, the State Police, state constitutional officers, the Legislature, and the Judiciary. W. Va. Code § 5A-6B-3.