Law / United States / 
Oregon
Oregon Consumer Privacy Act, sensitive data categories and biometric data definition
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a lawful basis and, for sensitive data, opt-in consent before processing an Oregon consumer's genetic or biometric data.
- Treat facial mapping or facial geometry generated or used to identify a specific Oregon consumer as covered biometric data, even when derived from a photograph, video, or audio recording. Oregon's exclusion does not reach data generated or used for that purpose.
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice, Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
- Guidance body
- Oregon Department of Justice, Consumer Protection
- Open questions
- Is gait data extracted from a video recording 'biometric data' under ORS 646A.570(3)(a) when the controller did not generate it to identify a specific consumer, given the exception for data from an audio or video recording in paragraph (3)(b)(C)?
What it makes you log
Logging duty
Subsections (3) and (18) of ORS 646A.570 define biometric data and sensitive data. A definition names no log, record, retention period or reader of a record. The record duty that attaches to sensitive data sits in a section this row does not cite: ORS 646A.586(1)(b)(B) makes processing sensitive data a heightened-risk activity for which the controller must conduct and document a data protection assessment, kept at least five years under ORS 646A.586(6). The reach comes from the definition of consumer in ORS 646A.570(7), the term these definitions use.
- Kind
- None
- As of
What this law does
OCPA defines sensitive data as personal data that reveals a consumer's racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a victim of crime or citizenship or immigration status; is a child's personal data; accurately identifies within a radius of 1,750 feet a consumer's present or past location, or the present or past location of a device that links or is linkable to a consumer; or is genetic or biometric data, which it lists independently and does not qualify with a for-the-purpose-of-uniquely-identifying clause the way several peer states phrase it.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a consumer, and Oregon's clawback is the most explicit of any state in this batch: it separately and by name brings facial mapping or facial geometry back into biometric data whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .