The Oregon House on Friday unanimously passed the Oregon Consumer Privacy Act, which means the bill is now heading the desk of Gov. Tina Kotek for signature or veto. The bill makes Oregon the latest in a growing number of states to enact comprehensive data privacy legislation aimed at giving consumers more control over how companies store and use data.
Oregon is the 11th state overall, and sixth this year, to enact a consumer data privacy bill. If enacted, the bill would go into effect on July 1, 2024.
“Working with 150 consumer privacy experts and stakeholders over the last three years, my team put together what we believe to be the best comprehensive consumer privacy law in the nation,“ said Oregon Attorney General Ellen Rosenblum. “The Oregon Consumer Privacy Act defines personal and biometric data broadly, protects consumer data rights holistically, and holds companies that have access to our data to high standards. This is a huge win for Oregonians and sets a high-water mark for consumer data privacy nationwide.”
Among the provisions of the bill are:
- Right to Know
- Right to Correction
- Right to Deletion
- Right to Opt Out
- Right to Data Portability
- Sensitive Data Protections
- Special Protections for Youth
Unlike other state bills, though, the OCPA does not include an entity-level exemption for financial institutions regulated by the Gramm-Leach-Bliley Act. The bill also does not include a HIPAA covered entity exemption like some other state privacy laws.
In order to be subject to the OCPA, businesses must control or process the personal data of more than 100,000 consumers and/or devices linked to consumers, or at least 25,000 consumers while deriving at least 25% of their gross revenue from personal data sales, according to a legislative summary of the bill.
Another interesting wrinkle is that Oregon residents will be able to obtain a list of specific third parties to which a company has disclosed the consumer’s personal data or any personal data. No other state has such a third-party disclosure provision, according to a published report.