Oregon steps up for privacy! On July 18, 2023, Oregon’s Governor Tina Kotek signed Senate Bill 619, the new Oregon Consumer Privacy Act, into law. This law will kick in on July 1, 2024.
This move follows similar steps by states like Colorado, Virginia, Utah, and Connecticut, but Oregon’s got its unique points.
- Who’s covered by the Oregon Consumer Privacy Act?
- Who’s Not Covered by the Oregon Consumer Privacy Act?
- Key Terms to Know: Oregon Privacy Law
- What Should Businesses (Controllers) Do?
- What About Those Processing the Data?
- User Rights under the Oregon Privacy Law
- Enforcement and Penalties under the Oregon Privacy Law
Who’s covered by the Oregon Consumer Privacy Act?
The law applies to businesses operating in Oregon or providing products or services to residents of Oregon that:
- Control or process personal data of 100,000+ Oregon consumers; or
- Control or process personal data of 25,000+ Oregon consumers and get 25% of their annual revenue from selling this data.
Note: Non-profit businesses get an extra year (until July 1, 2025) before this applies to them.
Who’s Not Covered Oregon Consumer Privacy Act?
- The law skips over employment-related or B2B data.
- Health information gets a pass, especially if it is subject to the Health Insurance Portability and Accountability Act (HIPAA) rules.
- Data that is processed under federal laws like the Fair Credit Reporting Act or the Driver’s Privacy Protection Act isn’t part of this.
- If the data is public or has no personal identifiers, it’s exempted.
Key Terms to Know: Oregon Privacy Law
- “Sale” means trading personal data for money or something valuable. But if data is shared with affiliates or during business changes like mergers, it’s not a “sale.”
- “Biometric data” covers details of one’s biological characteristics. But photos or videos don’t count unless they’re used to identify someone.
- “Profiling”, among others, is using personal data to predict someone’s behavior, preferences, or location.
- “Sensitive data”, personal data that:
- Reveals a consumer’s racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a victim of crime or citizenship or immigration status;
- Is a child’s personal data;
- Accurately identifies within a radius of 1,750 feet (0.53 km) a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, a Global Positioning System that provides latitude and longitude coordinates; or
- Is genetic or biometric data.
What Should Businesses (Controllers) Do?
- Clearly tell consumers what data they’re collecting and why. If they’re using it for targeted ads, they must mention it.
- Let consumers access or delete their data or correct it if it’s wrong.
- If businesses want to use the data differently than they said, or if it’s sensitive, they need the consumer’s clear OK. Consumers should also be able to take back this consent anytime.
- July 1, 2026, businesses must recognize “Global Privacy Control” signals from browsers like Chrome, which allow users to opt out of data sales or targeted ads.
- Businesses need to do risk checks when using data in ways that might harm consumers.
What About Those Processing the Data?
People or businesses processing data on behalf of others (called “processors”) need to:
- Follow instructions and help meet the law’s requirements.
- Use safeguards to protect data.
- Sign a contract detailing their role and responsibilities.
User Rights under the Oregon Privacy Law
Oregonian consumers can:
- Know and access their data.
- Transfer, correct, or delete their data.
- Choose not to sell their data, avoid targeted ads, or prevent profiling.
- Use the Global Privacy Control from July 1, 2026, to opt out of data sales or targeted ads.
What Does “Consent” Mean here? Consent means a consumer clearly says “yes.” Tricks or confusing methods to get consent aren’t allowed. Also, doing nothing isn’t seen as saying “yes.” To profile, serve ads, or sell data of 13 to 15-year-olds, businesses need clear consent.
Enforcement and Penalties under the Oregon Privacy Law
Starting July 1, 2024, only the Oregon attorney general can act on violations. Businesses could face a fine of up to $7,500 for each mistake. But, businesses get a 30-day window to fix things before any penalty.
By next year, businesses will have to be ready for 11 privacy laws. While many elements are common, each state law has its quirks. Companies should plan now, especially if they deal with sensitive data or do target advertising, to ensure they’re on the right track.