Oregon Becomes 11th State To Enact A Comprehensive Data Privacy Law

On July 18, 2023, Oregon Governor Tina Kotek signed Senate Bill 619, referred to as the "Oregon Consumer Privacy Act" ("OCPA" or "the Act"), making Oregon the 11th state to enact a comprehensive data privacy law.

Notable provisions include:

• The OCPA will apply to an entity that: (i) conducts business in Oregon or that provides products or services to state residents; and that (ii) controls or processes (1) the personal data of at least 100,000 Oregon consumers or (2) the personal data of at least 25,000 Oregon consumers, while deriving 25% or more of the entity's annual gross revenue from selling personal data.
• The Act goes into effect on July 1, 2024, for subject businesses, but 501(c)(3) nonprofit companies have a one-year exemption expiring on July 1, 2025. The law, like that of many other states with comprehensive privacy legislation, does not apply to employee data and B2B data.