# Oregon OCPA Compliance Assessment

## Organization Information

| Field | Value |
|-------|-------|
| **Organization** | Liberty Commerce Inc. |
| **Assessment Date** | 2026-03-14 |
| **Oregon Consumer Count** | 72,000 |
| **Revenue from Sale** | 12% |
| **OCPA Applicable** | Below thresholds; compliance maintained for multi-state consistency |

## De-Identified Data Compliance (§646A.586)

| Check | Item | Status |
|-------|------|--------|
| DI-01 | Direct identifiers removed | PASS |
| DI-02 | Technical safeguards (k-anonymity ≥5) | PASS |
| DI-03 | Public commitment posted | PASS |
| DI-04 | Recipient contracts executed | PASS |
| DI-05 | Oversight mechanism in place | PASS |
| DI-06 | Risk assessment conducted (quarterly) | PASS |
| DI-07 | Remediation process defined | PASS |
| DI-08 | Access controls implemented | PASS |
| DI-09 | Re-identification keys separated | PASS |
| DI-10 | Destruction policy defined | PASS |

## Employee Data Exemption Application

| Provision | Exempt | Status |
|-----------|--------|--------|
| Consumer rights requests | Yes | N/A |
| Privacy notice | No — required | Implemented |
| Data minimization | No — required | Implemented |
| Sensitive data consent | No — required | Implemented |
| Processor contracts | No — required | Implemented |
| DPIAs for employee profiling | No — required | Completed |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| CPO | Sarah Mitchell | 2026-03-14 |
| DPO | Robert Kim | 2026-03-14 |