Law / United States / 
Oregon
Oregon data broker registration with the Department of Consumer and Business Services
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a business entity or part of one that collects and sells or licenses brokered personal data to another person (a resident individual's name, address, date or place of birth, mother's maiden name, biometric information, Social Security or other government identification number, or other information that can reasonably be associated with the individual), register with the Department of Consumer and Business Services before you collect, sell or license that data within Oregon.
- You need not register if your collection, sale or licensing involves only publicly available information related to an individual's business or profession, publicly available information in a health or safety alert service, information lawfully available from federal, state or local government records, journals, books, periodicals, newspapers, magazines, news media or educational works, developing or maintaining an electronic commerce service or software, directory assistance or directory information services for a telecommunications carrier, or a single or occasional sale of business assets outside the ordinary conduct of the business.
- You are not a data broker for information about a resident individual who is or was your customer, subscriber or user, your employee or agent or in a contractual relationship with you, your investor or donor, or in another relationship with you of a similar nature.
- You are also not a data broker if you perform services for, act on behalf of or act as an agent of a business entity that holds one of those relationships with the individual.
- You are not a data broker to the extent your activities are subject to regulation under the federal Fair Credit Reporting Act as a consumer reporting agency, a person that furnishes information to one or a user of a consumer report, or under Title V of the Gramm-Leach-Bliley Act as a financial institution, an affiliate or a nonaffiliated third party.
- To register, submit on the department's form your name, street address, telephone number, primary website and email address, pay the fee the department sets by rule, and declare whether a resident individual may opt out of all or part of your collection, sale or licensing of brokered personal data, which activities or data the opt-out covers, how to exercise it, and whether another person may exercise it on the individual's behalf.
- Keep your registration current: it is valid only until December 31 of the year in which the department approves it.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
ORS 646A.593(7): the Department of Consumer and Business Services may impose a civil penalty of up to $500 for each violation of a requirement of the section or of a rule adopted under it, or $500 for each day of a continuing violation; the total imposed on one data broker may not exceed $10,000 in a calendar year.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 10,000
- Per violation unit
- Violation
- Per violation amount
- 500
Who enforces it
Enforcement body
Department of Consumer and Business Services, which may impose a civil penalty under ORS 646A.593(7).
What this law does
A data broker is a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person. Brokered personal data is computerized data about a resident individual that is categorized or organized for sale or licensing, including the individual's name, address, date or place of birth, biometric information and Social Security number.
A data broker may not collect, sell or license brokered personal data within Oregon unless it first registers with the Department of Consumer and Business Services. A data broker need not register if its collection, sale or licensing involves only a listed category, including publicly available information related to a resident individual's business or profession and information lawfully available from government records.
The definition of data broker excludes a business entity that collects information about a resident individual who is or was its customer, subscriber or user, its employee or agent or in a contractual relationship with it, its investor or donor, or in another relationship with it of a similar nature. The definition also excludes a business entity that performs services for, acts on behalf of or acts as an agent of a business entity that holds such a relationship with the individual.
The definition also excludes a consumer reporting agency, a person that furnishes information to one and a user of a consumer report, each to the extent the federal Fair Credit Reporting Act regulates its activities, and a financial institution, an affiliate or a nonaffiliated third party, each to the extent Title V of the Gramm-Leach-Bliley Act regulates its activities.
To register, a data broker submits its name, street address, telephone number, primary website and email address, pays a fee the department sets by rule, and declares whether and how a resident individual may opt out of its collection, sale or licensing. A registration is valid until December 31 of the year in which the department approves it. The department makes the information that business entities submit for registration publicly available on or by means of its website.
The department may impose a civil penalty of up to $500 for each violation, or $500 for each day of a continuing violation, and the total imposed on a data broker may not exceed $10,000 in a calendar year. Section 1 of House Bill 2052 of 2023 became operative on .
When LexLint raises it
When your app profile says your app crawls the web.