Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Oregon: Bill on consumer data protection signed by Governor

Senate Bill 619 for an Act relating to protections for the personal data of consumers was signed, on July 18, 2023, by the Governor of Oregon, thereby becoming law. In particular, the Act introduces provisions to, among other things:

  • permit consumers to obtain confirmation from a controller as to whether it is processing the consumer's personal data, categories of personal data the controller is processing, a list of specific third parties to which the controller has disclosed the consumer's personal data, and a copy of all of consumers' personal data;
  • permit consumers to require a controller to correct inaccuracies in their personal data, delete personal data, or opt out from processing under certain circumstances;
  • require controllers to provide consumers with a reasonably accessible, clear, and meaningful privacy notice that lists categories of personal data processed, describes the controller's purpose for processing personal data, describes how consumers may exercise their rights, and lists categories of personal data that the controller shares with third parties, as well as other information;
  • outline the specific duties, and prohibit specified actions of the controller and the processor;
  • permit the Attorney General to investigate violations of the Act and bring an action to seek civil penalties of not more than $7,500 for each violation; and
  • permit a consumer, or class of consumers, to bring an action for ascertainable loss of money or property resulting from violations of the Act.

Notably, the Act will enter into force on July 1, 2024, except for non-profit entities, to which the Act will not apply until July 1, 2025. In addition, the requirement to recognize and process universal opt-out preference signals will commence on January 1, 2026, which also marks the date when the 30-day cure period for violations will sunset. 

You can read the Act, as enrolled, here and view its history here.