Oregon Consumer Privacy Act

Determine applicability + maintain privacy notice per Oregon Consumer Privacy Act (Senate Bill 619, signed 18 July 2023, effective 1 July 2024 for most controllers + 1 July 2025 for non-profit organisations) ORS 646A.570. OCPA applies to (a) controllers conducting business in Oregon or producing products or services targeted to Oregon residents that control or process personal data of 100,000 or more Oregon consumers in a calendar year + or 25,000 or more consumers if controller derives more than 25% gross revenue from sale of personal data, (b) excludes specific categories (HIPAA + GLBA + FCRA + employee + state government data). Privacy notice content per ORS 646A.578 must include (a) categories of personal data processed + (b) purposes of processing + (c) categories of personal data shared with third parties + (d) categories of third parties + (e) how consumers may exercise rights + (

• Oregon OCPA evidence for OREGONCPA-1

• compliance nominal

Conduct data protection assessments + apply privacy by design + maintain security practices per Oregon OCPA per ORS 646A.580. Data Protection Assessments (DPAs) per ORS 646A.580 are required for processing activities that present a heightened risk of harm including (a) sale of personal data, (b) targeted advertising, (c) profiling producing legal or similarly significant effects, (d) processing sensitive data, (e) processing for purposes other than the purpose for which the data was collected (further processing). DPAs must (a) identify + weigh benefits flowing to controller + consumer + other interested parties + the public + (b) consider risks to the rights of consumers + (c) document mitigations + (d) be available to Attorney General on request. Privacy by design and default per general OCPA obligations must (a) embed privacy considerations in system design + procurement + change mana

• Oregon OCPA evidence for OREGONCPA-5

• compliance nominal

Operate consent + sensitive data + children/teen protections per Oregon OCPA per ORS 646A.572 + 646A.576 + 646A.578. Consent must be (a) freely given + specific + informed + unambiguous + (b) not via acceptance of general or broad terms of use + (c) revocable + with revocation as easy as initially given. Consent for sensitive personal data processing is required per ORS 646A.572 + with sensitive data including racial/ethnic origin + national origin + religious beliefs + mental/physical health condition or diagnosis + sex life + sexual orientation + status as transgender or non-binary + status as victim of crime + citizenship/immigration status + genetic/biometric data + precise geolocation + child data + criminal records + persons under 16 personal data + similar. Children and teen data protections per ORS 646A.572 include (a) opt-in consent required for sale or targeted advertising for

• Oregon OCPA evidence for OREGONCPA-3

• compliance nominal

Honor consumer rights per Oregon OCPA per ORS 646A.574. Rights include (a) right of access including obtaining list of specific third parties to which the controller has disclosed personal data per the consumer or any consumer (Oregon-unique provision distinguishing OCPA from other state laws), (b) right to correction of inaccurate personal data, (c) right to deletion of personal data, (d) right to portability of personal data in a readily usable format, (e) right to opt out of sale of personal data + targeted advertising + profiling in furtherance of decisions producing legal or similarly significant effects on the consumer. Authorised agent requests must be honored where consumer authorises agent in writing or via permitted technical means. Rights handling must (a) verify consumer identity using commercially reasonable methods + (b) respond within 45 days extendable + (c) provide twice

• Oregon OCPA evidence for OREGONCPA-2

• compliance nominal

Operate within Oregon OCPA enforcement framework + maintain training + compliance monitoring per ORS 646A.583 + 646A.586. Cure Period and Attorney General Enforcement: (a) Oregon Attorney General has exclusive enforcement authority through ORS 646A.583, (b) initial 30-day cure period available for alleged violations during 1 July 2024 through 1 January 2026 (sunsetting after that date), (c) civil penalty up to USD 7,500 per violation, (d) Attorney General may issue investigative demands + bring civil action. Non Profit Effective Date and Phased Compliance: (a) non-profit organisations have 1 July 2025 effective date allowing additional preparation time, (b) phased compliance approach permits operational readiness build. Compliance monitoring and auditing must (a) implement internal compliance programme covering policy + procedure + training + measurement, (b) conduct periodic audit + ass

• Oregon OCPA evidence for OREGONCPA-8

• compliance nominal

Apply data minimisation + purpose limitation + retention per Oregon OCPA per ORS 646A.578(2). Data Minimisation and Purpose Limitation requires (a) limiting collection of personal data to what is adequate + relevant + and reasonably necessary in relation to specified purposes for which the data is processed, (b) processing for specific + explicit + and legitimate purposes that are disclosed to consumer + (c) further processing only when compatible with the specified purposes for which the data was collected. Retention requires (a) retaining personal data only as long as necessary for purposes for which collected + as required by law, (b) maintaining retention schedule documented per data category per purpose + (c) implementing automated retention enforcement where possible + (d) deleting + de-identifying + or anonymising personal data at end of retention with documentation. Lawful basis

• Oregon OCPA evidence for OREGONCPA-6

• compliance nominal

Operate processor contracts + cross-border transfers + data processing agreements per Oregon OCPA per ORS 646A.584. Processor Contracts and Obligations must (a) bind processors via written contract per ORS 646A.584, (b) include processing instructions + duration + nature + purpose + categories of data + obligations of processor including confidentiality + assistance + breach notification + deletion or return + audit cooperation, (c) flow down to subcontractors with controller approval + (d) maintain processor inventory + ongoing monitoring. Cross-border transfer safeguards must (a) implement appropriate safeguards for international transfers + (b) align with applicable federal export controls + sanctions, (c) consider data localisation requirements in target jurisdictions, (d) align with broader corporate data flow governance. Data processing agreements must (a) be in writing with proces

• Oregon OCPA evidence for OREGONCPA-7

• compliance nominal

Honor universal opt-out + targeted advertising + profiling per Oregon OCPA per ORS 646A.574. Universal Opt Out Mechanism Recognition must (a) recognise opt-out signals communicated by platforms + technologies + or mechanisms that clearly indicate consumer intent to opt out (Global Privacy Control / GPC + similar), (b) treat as valid opt-out request per ORS 646A.574(5), (c) align with multi-state UOOM specifications (Colorado + Connecticut + California + similar). Targeted advertising opt-out must apply to advertising based on personal data obtained from consumer activity across non-affiliated websites or applications. Profiling opt-out applies to (a) profiling in furtherance of decisions that produce legal or similarly significant effects on the consumer + (b) such as financial + lending + housing + insurance + education + criminal justice + employment + healthcare + access to essential

• Oregon OCPA evidence for OREGONCPA-4

• compliance nominal