Oregon Passes Comprehensive Privacy Law

Oregon has joined a growing list of states that have passed comprehensive state privacy legislation. On June 22, 2023, both Houses of the Oregon State Legislature passed Senate Bill 619 (the Act), which now awaits the governor's signature. Notably, the Act follows the now common template used by states such as Colorado, Virginia, and Connecticut.

Scope and applicability

The Act applies to any business (not-for-profit businesses are excluded until July 1, 2025) that does business in Oregon and controls or processes the personal information of (i) at least 100,000 Oregon residents or (ii) at least 25,000 Oregon residents while deriving at least 25% of its revenue from the sale of personal information. The Act does not apply to personal information collected in the context of employment or business-to-business relationships.