Oregon is the latest state to join the growing patchwork of U.S. state privacy laws. On July 18, 2023, the Oregon Governor signed S.B. 619, enacting what will become the eleventh state privacy law. The Oregon law follows many of the essential elements of its state counterparts. Below, we’ve highlighted some key takeaways to help prepare your business for when it goes into effect.

Scope

Oregon’s law applies to any person that conducts business in the state, or that provides products or services to residents of the state, and that during a calendar year, controls or processes:

• The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or
• The personal data of 25,000 or more consumers, while deriving 25% or more of the person’s annual gross revenue from selling personal data.

Consumer and Data Rights

The Oregon statute will enable consumers to exercise a number of rights, including:

• Obtaining confirmation that a data controller is processing or has processed a consumer’s personal data, including the categories of personal data that the controller has processed;
• Obtaining a list of specific third parties to which the controller has disclosed the consumer’s personal data, or any personal data in general;
• Requiring a controller to correct inaccuracies in the personal data concerning the consumer, specifically taking into account the nature of the personal data and the controller’s purpose for processing such personal data;
• Requiring a controller to delete personal data concerning the consumer, including any personal data that the consumer provided to the controller or any personal data that the controller obtained from another source; and
• Opting out from a controller’s processing of personal data concerning the consumer that the controller processes for: (1) targeted advertising; (2) the sale of data; or (3) profiling in furtherance of decisions that produce legal effects of similar significance.

Enforcement

Similar to other state privacy laws, the Oregon law does not permit a private right of action, meaning the Oregon Attorney General will have the sole authority to enforce the law.

Effective Date

The Oregon law will go into effect in July 2024. Given the similarities to the other state privacy laws, businesses will likely already have many of these key requirements in place. However, businesses should prepare to assess their operations in Oregon and plan now for implementation, including how these requirements can be integrated into current state privacy law processes.

Our Data Privacy and Cybersecurity practice regularly advises companies on how to meet the requirements of new laws like this one. If you have any questions concerning this law or any other data privacy or cybersecurity laws, please do not hesitate to contact any member of our team.