Oregon Consumer Privacy Act: A Comprehensive Look at the State's New Data Privacy Law

Data privacy continues to be a pressing concern, and states across the United States are taking steps to protect their residents’ personally identifiable information (PII). Oregon is the latest state poised to join a growing list of states with comprehensive data privacy legislation. The Oregon Consumer Privacy Act (OCPA) is set to become effective on July 1, 2024. This makes Oregon the 11th state to enact comprehensive consumer data privacy legislation and the sixth state to do so in 2023. Notably, Oregon is the first Democrat-controlled state to pass a consumer data privacy bill in 2023, highlighting the growing bipartisan concern for protecting individuals’ privacy rights.

This article will delve into the key provisions of the OCPA and explore how it compares to similar laws in other states.

The Strongest State Data Privacy Act Yet?

The introduction of all these new state-level privacy laws reflects a broader trend of increasing emphasis on consumer data privacy and protection. These regulations aim to provide individuals with greater control over their personal information and impose obligations on businesses to handle data responsibly.

According to Kiteworks’ 2023 Sensitive Content Communications Privacy and Compliance Report, a majority of U.S. respondents (53%) have already established a formalized process to comply with the new state-level privacy regulations, while 36% are actively working on developing one. These findings indicate that businesses recognize the importance of adhering to the evolving privacy landscape and are taking steps to meet the requirements imposed by these new regulations.

The OCPA draws inspiration from the Connecticut Data Privacy Act and the Colorado Privacy Act, but includes unique provisions that set it apart from other state laws.

While it is challenging to determine the “strongest” state privacy law, Oregon’s legislation can be considered in the same higher tier as Colorado and Connecticut, meaning they have implemented a more consumer-friendly law on several issues relative to other states.

Who’s Protected Under the Oregon Consumer Privacy Act?

The Oregon Consumer Privacy Act applies to a wide range of businesses operating in Oregon or providing products or services to Oregon residents. The applicability of the OCPA is based on specific criteria outlined in the legislation.

For example, the OCPA covers persons that conduct business in Oregon or provide products or services to Oregon residents. It applies to entities that, during a calendar year, control or process the personal data of a certain number of consumers. The threshold for applicability is defined as follows:

1. Personal Data Threshold: The OCPA applies to persons who control or process the personal data of 100,000 or more consumers, excluding personal data controlled or processed solely for completing a payment transaction.
2. Revenue Threshold: Alternatively, the OCPA applies to persons who control or process the personal data of 25,000 or more consumers, while deriving 25% or more of their annual gross revenue from selling personal data.

To put the thresholds into perspective, Oregon has a population of approximately 4.24 million people. With the 100,000 personal data threshold, it encompasses approximately 2.35% of the state’s population.

Also, it’s important to note that the term “consumer” in the OCPA refers to natural persons who reside in Oregon and engage with businesses in any capacity other than in a commercial or employment context. This means that employee data and business-to-business data are generally excluded from the scope of the OCPA.

Exemptions and Scope of Applicability Under the OCPA

The OCPA also provides exemptions for certain types of data and organizations. Personal data subject to the Gramm-Leach-Bliley Act (GLBA), for example, are exempt from the OCPA’s provisions. The OCPA also does not include an exemption specifically for HIPAA-covered entities, however, it does include exemptions for HIPAA-covered data.

The OCPA does not provide a general exemption for nonprofits either, however, it does include specific exemptions for certain types of nonprofit activities. The OCPA, for example, does not apply to nonprofit organizations established to detect and prevent insurance fraud. It also does not apply to the non-commercial activities of nonprofit organizations that provide programming to radio or television networks.

By setting clear thresholds and defining applicability, the OCPA ensures that businesses operating in Oregon or serving Oregon residents are subject to the privacy obligations outlined in the legislation. This helps protect the privacy rights of consumers while providing a framework for businesses to handle personal data responsibly and transparently.

Understanding OCPA’s Definition of Personal Data

Under the OCPA, the definition of “personal data” is broad and encompasses various types of information, including data, derived data, or unique identifiers that are reasonably linkable to a consumer or a device that identifies one or more consumers in a household.

The OCPA’s definition of personal data is intentionally comprehensive to account for the evolving nature of data collection and the potential privacy implications associated with it. It recognizes that personal data can go beyond traditional identifiers like names and addresses and includes data that, when combined or analyzed, can reveal information about an individual.

It’s important to note that the OCPA explicitly excludes de-identified data from the definition of personal data. “De-identified data” refers to information that has been processed or modified in such a way that it can no longer be used to identify an individual directly or indirectly. This exclusion acknowledges that data that has been effectively de-identified and cannot be re-identified does not fall within the scope of personal data under the OCPA.

Compliance Considerations for Covered Entities

Covered entities, which are businesses subject to the OCPA’s requirements, need to carefully review their data collection and processing procedures to ensure compliance with the definition of personal data. They should assess the types of data they collect, whether directly from consumers or through other sources, and determine if the information meets the criteria outlined in the OCPA’s definition.

In addition, covered entities should also evaluate their public-facing disclosures, such as privacy policies and notices, to ensure that they accurately reflect the types of personal data they collect and process. Transparency and clear communication with consumers about data collection practices are essential under the OCPA, and organizations must provide individuals with a comprehensive understanding of the personal data they collect and how it is used.

Key Consumer Rights Under the OCPA

The Oregon Consumer Privacy Act (OCPA) empowers Oregon consumers by granting them various rights regarding their personal data. These rights ensure that individuals have control over their information and can make informed decisions about its collection and use. Here are the key consumer rights provided by the OCPA.

Right of Access

Oregon consumers have the right to request and obtain confirmation from data controllers regarding the processing of their personal data. They can also request a copy of their processed personal data to understand how their information is being used.

Right of Correction

The OCPA also provides Oregonians with the right of correction. If individuals discover inaccuracies or errors in their personal data held by data controllers, they have the authority to request the correction or rectification of that information. This empowers individuals to ensure that their records are accurate and up to date, promoting data integrity and reliability.

Right of Deletion

Another important consumer right under the OCPA is the right of deletion. Consumers have the ability to request the removal of their personal data from data controllers’ records. This right enables individuals to have their information deleted when it is no longer necessary for the purposes for which it was collected or when they withdraw their consent for its processing. It gives individuals control over their data and the ability to manage its retention according to their preferences.

Right to Opt Out

The OCPA recognizes and respects the right of consumers to make choices regarding their personal data. It grants individuals the right to opt out of certain activities related to their information. This includes the ability to opt out of targeted advertising, where personal data is used by advertisers to send personalized advertisements. Additionally, consumers can opt out of the sale of their personal data, preventing it from being transferred or sold to third parties without their consent. This right empowers individuals to protect their privacy and control how their data is utilized.

Right to Data Portability

Under the OCPA, consumers enjoy the right to data portability. This means that individuals have the right to receive their personal data in a portable and usable format. This allows them to easily transfer their information between different services or platforms, enhancing consumer mobility and flexibility and enabling individuals to switch providers or utilize their data for personal purposes in a seamless manner.

Universal Opt-out Mechanisms for Consumer Control

A notable requirement introduced by the OCPA is the recognition of universal opt-out mechanisms by data controllers starting January 1, 2026. This means that businesses must honor universal mechanisms that allow consumers to opt out of the sale or sharing of their personal data across multiple platforms or services. This provision aims to provide consumers with a consistent and streamlined way to exercise their opt-out preferences.

These consumer rights under the OCPA are designed to ensure transparency, control, and accountability in the handling of personal data. By granting individuals the ability to access, correct, delete, opt out, and obtain their data, the OCPA empowers consumers to take an active role in managing their privacy and protecting their personal information.

Responsibilities and Duties of Controllers Under the OCPA

Controllers subject to the OCPA have various obligations to ensure the protection and responsible handling of Oregonians’ personal data. These obligations include:

1. Privacy Notice Provisioning: Controllers must provide a privacy notice that includes specific content as required by the OCPA. The notice should inform consumers about the purposes of data processing and the categories of third parties with whom the controller shares personal data.
2. Limitation of Processing: Controllers must limit the processing of personal data to what is reasonably necessary and relevant for the stated purposes.
3. Consumer Privacy Rights: Controllers must establish a secure and reliable means for consumers to exercise their privacy rights under the OCPA.
4. Consent for Sensitive Data: Controllers must obtain consumer consent before processing sensitive data. Sensitive data typically includes information such as health data, racial or ethnic origin, religious beliefs, or biometric information.
5. Processor Contracts: Controllers must enter into contracts with their processors. These contracts outline the responsibilities and obligations of the processors when handling personal data on behalf of the controller.
6. Data Protection Assessments: Controllers must conduct and document data protection assessments for specific processing activities that pose a heightened risk of harm to consumers.

By imposing these obligations on controllers, the OCPA aims to safeguard consumer privacy, enhance transparency, and promote responsible data practices. Compliance with these requirements enables controllers to build trust with consumers and demonstrate their commitment to protecting personal data in accordance with the law.

Kiteworks touts a long list of compliance and certification achievements.

The Role of Data Protection Assessments Under the OCPA

The OCPA, in line with other states’ data privacy laws, mandates that data controllers perform data protection assessments for certain processing activities that pose an increased risk to consumers’ privacy. These assessments serve as a mechanism to evaluate and mitigate potential risks associated with the handling of personal data. The key aspects of data protection assessments under the OCPA include:

1. Assessment Requirement: Data controllers are obligated to conduct data protection assessments for processing activities that involve sensitive personal data or personal data used for targeted advertising, selling, or profiling. The assessments aim to identify and address any foreseeable risks to consumers’ privacy arising from these specific processing activities.
2. Heightened Risk: The requirement for data protection assessments focuses on activities that pose an increased risk to individuals’ privacy. This includes processing sensitive personal data, which typically includes information that, if mishandled, could result in harm or discrimination to the individual. Additionally, assessments are necessary for processing activities involving personal data used for targeted advertising, selling, or profiling, which can potentially impact individuals’ rights and interests.
3. Retention Period: Data controllers are required to retain the results of the data protection assessments for a minimum of five years. This retention period ensures that the assessments can be referred to, if needed, for purposes such as compliance verification or regulatory inquiries.

By implementing data protection assessments, the OCPA encourages data controllers to assess the privacy implications of their processing activities and take appropriate measures to safeguard consumers’ personal data. These assessments promote proactive risk management, enabling organizations to identify and mitigate potential privacy risks before they lead to adverse consequences for individuals.

It is crucial for data controllers to comply with the OCPA’s data protection assessment requirements by conducting thorough assessments, documenting the findings, and implementing appropriate safeguards based on the assessment outcomes. By doing so, organizations can demonstrate their commitment to protecting consumer privacy and align with the principles of responsible data handling and privacy best practices.

Upholding Privacy Rights: OCPA Enforcement Measures and Remedies

The OCPA establishes an enforcement framework and remedies for violations of the law. The enforcement authority rests with the Oregon Attorney General, who is responsible for upholding the provisions of the OCPA. Here are the key elements regarding enforcement and remedies under the OCPA:

1. Enforcement Authority: The Oregon Attorney General has the power to enforce the OCPA and take action against violators. This authority enables the Attorney General to investigate potential violations, ensure compliance with the law, and hold accountable those who fail to meet the requirements of the OCPA.
2. Civil Penalties: The OCPA grants the Attorney General the ability to impose civil penalties on entities found to be in violation of the law. These penalties can amount to a maximum of $7,500 per violation, providing a strong deterrent for noncompliance and reinforcing the importance of adhering to the privacy obligations outlined in the OCPA.
3. Injunctive Relief and Equitable Remedies: In addition to civil penalties, the Attorney General can seek injunctive relief or pursue other equitable remedies against violators. This allows the Attorney General to take legal action to halt ongoing violations, enforce compliance, or provide appropriate remedies to affected individuals.
4. Right to Cure: The OCPA includes a right to cure provision, which allows entities to rectify violations within a specified period. Until January 1, 2026, entities found to be in violation of the OCPA have an opportunity to correct the noncompliance and bring themselves into alignment with the law.
5. No Private Right of Action: Unlike some other privacy laws, the OCPA does not grant consumers a private right of action to sue for violations. This means that individuals cannot directly initiate legal proceedings against entities for alleged violations of the OCPA. Enforcement actions and remedies are primarily handled by the Oregon Attorney General’s office.

By granting enforcement authority to the Oregon Attorney General, the OCPA ensures that violations of the law are properly addressed and that entities face consequences for noncompliance. The availability of civil penalties, injunctive relief, and equitable remedies provides a range of enforcement tools to promote adherence to the OCPA’s privacy requirements. The absence of a private right of action emphasizes the role of the Attorney General’s office in upholding the provisions of the OCPA and safeguarding consumers’ privacy rights.

Kiteworks Helps Organizations Comply With OCPA

The Kiteworks Private Content Network (PCN) helps organizations demonstrate compliance with the OCPA. Kiteworks unifies all content communication channels—email, file sharing, managed file transfer, web forms, and more—into one platform so organizations can track, control, and secure consumers’ private data.

The Kiteworks Private Content Network is protected by a hardened virtual appliance, which is designed with an embedded network firewall and web application firewall. It ensures zero-trust, least-privilege access and minimizes the attack surface.

The Kiteworks PCN provides robust protection against data leakage and malware threats through its integration capabilities with data loss prevention and advanced threat protection solutions. Kiteworks’ DLP integrations ensure that PII is prevented from leaking out of the organization. Files are scanned for sensitive data in real time, and applied policies prevent unauthorized access or transmission of PII. Likewise, Kiteworks’ ATP integrations help organizations prevent malware from coming into the organization and compromising PII. Every incoming file is scanned for malicious code and infected files are removed and quarantined for further inspection.

Every file is encrypted in transit and at rest to provide an additional layer of protection against unauthorized access. Automated, end-to-end encryption ensures that even if data is intercepted, it remains secure and unreadable. Further, Kiteworks employs digital rights management capabilities to control access to PII. Organizations leverage Kiteworks to define and enforce access permissions based on job roles, ensuring that only authorized internal personnel can view or handle sensitive information.

All file activity is tracked, recorded, and entered into a comprehensive audit log, including who has accessed, modified, downloaded, uploaded, or shared a file. This audit log not only enables organizations to track and monitor user activities but also facilitates compliance with various data privacy regulations. The integration of Kiteworks’ audit log with security information and event management (SIEM) solutions allows for centralized monitoring and analysis, aiding organizations in demonstrating compliance with regulations like the OCPA, the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and many more.

In addition, Kiteworks provides organizations with secure web forms, which are essential for addressing consent requirements under the OCPA. These tools empower organizations to establish reliable opt-in mechanisms and consent procedures, ensuring compliance with the OCPA and other data privacy regulations’ consent provisions. As a result, businesses can confidently manage and track user consent for the processing of personal information, maintaining transparency and accountability.

With Kiteworks as your trusted solution, businesses can effectively navigate the complexities of the Oregon Consumer Privacy Act, ensuring compliance while prioritizing data privacy and security.

To learn more about how the Kiteworks Private Content Network enables organizations to demonstrate compliance with the OCPA and other privacy regulations, you can schedule a custom-tailored demo today.

 

Back to Risk & Compliance Glossary