Law / United States / 
Oregon
Oregon Consumer Privacy Act, consumer rights
ORS 646A.574, 646A.576, 646A.578
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give an Oregon consumer a means to confirm whether you process their personal data, disclose the categories processed, provide a portable copy, correct it, and delete it.NIST Privacy FrameworkCT.PO-P3
- Offer an Oregon consumer an opt-out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request without undue delay and within 45 days of receipt, decide an appeal within 45 days, and honor a consent revocation within 15 days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice, Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/
- Guidance body
- Oregon Department of Justice, Consumer Protection
- Open questions
- Must a controller give a consumer the list of specific third parties that received the consumer's personal data or any personal data, which the Department's FAQs describe as a consumer right, when ORS 646A.574(1)(a)(B) provides that list at the controller's option?
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller may deny an opt-out request as fraudulent only on a good-faith, reasonable and documented belief, which cannot be shown without a record of the grounds. Other record-like text in the cited sections is not a duty to keep a log: a controller that obtains data from another source may satisfy a deletion request either by deleting the data and retaining a record of the request or by opting the consumer out, which is one of two routes (ORS 646A.576(7)); the decision on an appeal is a written notice to the consumer (ORS 646A.576(6)(d)); and the right to a copy of the consumer's own personal data (ORS 646A.574(1)(a)(C)) is access to the data, not to a log. The data protection assessment record (ORS 646A.586) sits in a section this row does not cite. The reach comes from the definition of consumer in ORS 646A.570(7), the term these sections use.
- Kind
- Implicit
- As of
- Provision
- ORS 646A.576(5)(e)(B)
- Trigger
- consent_or_optout
What this law does
OCPA gives an Oregon consumer the right to confirm processing, obtain a categories disclosure, receive a portable copy, correct, delete, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.
A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available; an appeal of a refusal must be decided within 45 days; and consent revocation must be honored no later than 15 days after receipt.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .