Oregon Consumer Privacy Act Passes House, Heads to Governor’s Desk

For Immediate Release

June 22, 2023

Press contact:

Hannah Kurowski

[email protected]

Senate Bill 619 empowers all Oregonians to protect their privacy online, especially children under 15

SALEM, Ore. – Today, the House passed the Oregon Consumer Privacy Act (Senate Bill 619), which will empower Oregonians with the knowledge and control they need to protect their privacy. The legislation provides Oregonians with a number of important rights over their personal information and imposes specific obligations on large businesses who collect, use, store, disclose, analyze, delete or modify consumers’ personal data (“controllers”).

“Consumers should have a say over how their data is used and companies shouldn’t be able to target and exploit them,” said Representative Paul Holvey (D-Eugene), chief sponsor of the bill. “SB 619 will make sure Oregonians are protected and in control of their data.”

In the absence of federal data privacy legislation, Senate Bill 619 establishes multiple rights for Oregon consumers, which include:

• Right to Know: Consumers will have the right to know whether controllers are processing their data, as well as the categories of data being processed and third parties the data has been disclosed to. Consumers will also have a right to obtain a copy of the consumer’s personal data that a controller has or is processing.
• Right to Correction: Consumers will have the right to correct inaccuracies in their data;
• Right to Deletion: Consumers will have the right to require a controller to delete their personal data held by a controller;
• Right to Opt Out: Consumers will have the right to opt out of the processing of their personal data for targeted advertising, sale or profiling of the consumer in a way that produces legal effects; and
• Right to Data Portability: When consumers exercise their right to obtain a copy of their personal data held by a controller, it must be provided in a portable and usable format.

Currently, businesses using Oregonians’ personal data must comply with the requirements of the federal Children’s Online Privacy Protection Act (COPPA) when processing the data of children under 13. Under SB 619, they will also be required to obtain “opt in” consent for targeted advertising or sale of personal data of a youth 13 to 15 years old.

The bill passed unanimously and now heads to the Governor’s desk for consideration.