Processes biometric data, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 646A.593 · Read the law's page

• If you are a business entity or part of one that collects and sells or licenses brokered personal data to another person (a resident individual's name, address, date or place of birth, mother's maiden name, biometric information, Social Security or other government identification number, or other information that can reasonably be associated with the individual), register with the Department of Consumer and Business Services before you collect, sell or license that data within Oregon.
• You need not register if your collection, sale or licensing involves only publicly available information related to an individual's business or profession, publicly available information in a health or safety alert service, information lawfully available from federal, state or local government records, journals, books, periodicals, newspapers, magazines, news media or educational works, developing or maintaining an electronic commerce service or software, directory assistance or directory information services for a telecommunications carrier, or a single or occasional sale of business assets outside the ordinary conduct of the business.
• You are not a data broker for information about a resident individual who is or was your customer, subscriber or user, your employee or agent or in a contractual relationship with you, your investor or donor, or in another relationship with you of a similar nature.
• You are also not a data broker if you perform services for, act on behalf of or act as an agent of a business entity that holds one of those relationships with the individual.
• You are not a data broker to the extent your activities are subject to regulation under the federal Fair Credit Reporting Act as a consumer reporting agency, a person that furnishes information to one or a user of a consumer report, or under Title V of the Gramm-Leach-Bliley Act as a financial institution, an affiliate or a nonaffiliated third party.
• To register, submit on the department's form your name, street address, telephone number, primary website and email address, pay the fee the department sets by rule, and declare whether a resident individual may opt out of all or part of your collection, sale or licensing of brokered personal data, which activities or data the opt-out covers, how to exercise it, and whether another person may exercise it on the individual's behalf.
• Keep your registration current: it is valid only until December 31 of the year in which the department approves it.

ORS 646A.570(3), (18) · Read the law's page

• Obtain a lawful basis and, for sensitive data, opt-in consent before processing an Oregon consumer's genetic or biometric data.
• Treat facial mapping or facial geometry generated or used to identify a specific Oregon consumer as covered biometric data, even when derived from a photograph, video, or audio recording. Oregon's exclusion does not reach data generated or used for that purpose.

Or. Rev. Stat. §§ 646A.570 to 646A.589 · Read the law's page

• Before processing sensitive data about an Oregon consumer, including a scraped fingerprint, voiceprint, retinal or iris scan, other biometric or genetic data point, or a consumer's precise location accurate within 1,750 feet, obtain the consumer's consent first.
• OCPA's own personal-data definition excludes data lawfully available through government records or widely distributed media, or that a controller reasonably understands the consumer to have made public themselves (ORS 646A.570(13)(b)); this exclusion reaches 'sensitive data' too, since sensitive data is itself defined as personal data. It does not exempt data merely observable online that was not made public by the consumer, a government record, or distributed media, so scraped data of unclear public provenance should still be treated as covered.
• Do not sell a consumer's precise location data, accurate within a radius of 1,750 feet, whether or not the consumer consents (ORS 646A.578(2)(d)(B), added by HB 2008).