New data protection law in Oregon

On June 22, SB 619, the Oregon Consumer Privacy Act (OCPA), was passed by lawmakers in Salem. If signed into law by Governor Kotek, Oregon will be the eleventh US state (and the sixth in 2023) to enact comprehensive privacy laws governing the collection, use and Transmission on consumer data. Most of the OCPA’s requirements will take effect on July 1, 2024 (with the exception of nonprofit organizations, for which the law will take effect on July 1, 2025).

For businesses in Oregon or those operating in Oregon, the new privacy law has several important implications. Here are the key provisions that businesses should be aware of:

1. wide area of application

Unlike many other state data protection laws, the OCPA does not automatically exclude companies that already comply with federal laws regarding Data protection are subject to. There are only exceptions for certain data that is already covered by laws such as the Health Insurance Portability and Accountability the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA). Furthermore, nonprofit organizations are not considered an exception under the OCPA, except in the case of organizations that “detect and prevent insurance fraud” or are classified as “financial institutions” under state law.

2. extended Definitions of collected data

The OCPA refers to “personal data” and also defines a category of “sensitive data” that is subject to special protection. However, the OCPA’s definition of “personal information” is unique in that it explicitly includes “inferred data”—that is, inferences about a customer—as well as data associated with a “device” that can reasonably be attributed to one or more individuals in a “household.” Unlike similar laws, the OCPA does not provide a specific definition or exceptions for pseudonymized data.

The definition of “sensitive data” in Oregon law is also broader than in other states and includes, among other things, “ancestry,” “gender identity as transgender or non-binary,” and “victim status of a crime.” In addition, the OCPA defines the term “biometric data” broadly and includes information that enables the unique identification of an individual. However, there is an exception for “facial mapping or facial geometry,” provided that these technologies are not used to uniquely identify an individual.

3. new consumer rights

The OCPA grants consumers a number of rights that are now largely standard, such as the right to confirmation of the

Data processing, access, Correction, Deletionportability of personal data and the right to object to the targeted Advertisingto object to data sales and significant profiling decisions. One interesting aspect of the OCPA, however, is the right of consumers to request a list of "specific third parties" to whom a business may personal data discloses. This presents an operational challenge and is similar to the requirements set forth in recently enacted healthcare privacy laws in Washington State and Nevada. In addition, the OCPA is the first comprehensive privacy law to explicitly recognize the right to Deletion of "derived data".

4. Stricter obligations for data controllers

The OCPA specifies for affected companies a number of obligations that are already familiar from other data protection laws, such as maintaining adequate Data securitycontractual requirements for processors, publication of data protection declarations and obtaining consent for the processing of personal data. Processing sensitive data. However, the obligations in the OCPA are somewhat stricter than in comparable laws in other states. For example, data controllers must have an explicit Consent to profile data from youth ages 13 to 15 to make meaningful decisions. Additionally, the OCPA indicates that design mechanisms intended to interfere with consumer choice may invalidate consumer consent under the Act. Finally, the law requires that privacy impact assessments be retained for a period of five years. Only Colorado has established similar retention periods in its implementing regulations.

5. Use and Exchange of Data for Research Purposes

The OCPA provides exceptions to consumer rights and obligations for certain uses of personal data, such as internal business operations that meet consumer expectations, responding to investigative requests from law enforcement agencies, and maintaining the Data security. Unlike other data protection laws, however, the OCPA does not contain any specific requirements regarding the use of data for research purposes. As long as the use of identifying data complies with applicable law, companies are exempt from the consumer rights and obligations set forth in the law.

Oregon’s new data protection law brings changes and challenges for businesses. It is important for businesses—especially those based in Oregon or those doing business in Oregon—to carefully review the provisions of the OCPA and take appropriate measures to comply with the law’s requirements and ensure the protection of consumer data.