Oregon Joins Growing List of States to Pass Comprehensive Data Privacy Law
Oregon joined 12 other states to pass a comprehensive data privacy law. Gov. Tina Kotek signed the Oregon Consumer Privacy Act (OCPA) into law on July 18. It goes into effect July 1, 2024.
Oregon’s legislation is modeled on the Virginia Consumer Data Protection Act (VCDPA).
The act contains an exemption for personal data subject to the Gramm-Leach-Bliley Act (GLBA), along with an exemption for publicly available information. ALTA has held that any comprehensive data privacy legislation should include an exemption for entities subject to the GLBA. Since 1999, this federal law has strictly limited financial institutions’ use and sharing of customers’ personal information. Additionally, financial institutions are required to assure the security of this information and provide comprehensive disclosures to consumers. Click here to view ALTA’s principles for data privacy laws.
OCPA applies to businesses that conduct business in Oregon or provide products and services to residents of Oregon. It also applies to business that control or process the personal data of either of the following:
- Consumers and/or devices linked to consumers numbering 100,000 or more, other than personal data controlled or processed solely for the purpose of completing payment transactions.
- Consumers numbering 25,000 or more, while deriving 25% or more of the business’s annual gross revenues from selling personal data.
There is no revenue threshold or small business carveout. Like Virginia, the OCPA does not include B2B or employee data.
Comments