Law / United States / 
Oregon
Oregon Consumer Privacy Act, deidentified data
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- If you hold deidentified data, take reasonable measures to ensure that it cannot be associated with an individual (ORS 646A.583(1)(a)(A)).
- Publicly commit to maintaining and using the deidentified data without attempting to reidentify it, except that you may attempt to reidentify it solely to test your deidentification methods (ORS 646A.583(1)(a)(B) and (1)(c)).
- Enter into a contract with each recipient of the deidentified data requiring the recipient to comply with your obligations under ORS 646A.570 to 646A.589 (ORS 646A.583(1)(a)(C)).
- If you disclose deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (ORS 646A.583(1)(b)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
ORS 646A.583 sets the conditions a controller meets when it holds or discloses deidentified data. It names no log or record the controller keeps and no retention period.
- Kind
- None
- As of
What this law does
ORS 646A.570(11) defines deidentified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable consumer, or to a device linked or reasonably linkable to a consumer.
Under ORS 646A.583, a controller that possesses deidentified data must take reasonable measures to ensure that the deidentified data cannot be associated with an individual, publicly commit to maintaining and using it without attempting to reidentify it, and contract with each recipient so that the recipient must comply with the controller's obligations under ORS 646A.570 to 646A.589.
A controller that discloses deidentified data must exercise reasonable oversight to monitor compliance with the contractual commitments to which the data is subject and must take appropriate steps to address any breaches of those commitments. Oregon's Consumer Privacy Act does not prohibit a controller from attempting to reidentify deidentified data solely for the purpose of testing the controller's methods for deidentifying data. Under ORS 646A.570(13)(b), personal data does not include deidentified data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .