# Regulatory Standards — Oregon OCPA

## Primary Legislation

### Oregon Consumer Privacy Act — ORS §646A.570 through §646A.604

Enacted: July 18, 2023 (SB 619). Effective: July 1, 2024.

- **§646A.570**: Short title
- **§646A.572**: Applicability, exemptions, employee data partial exemption
- **§646A.574**: Definitions (including de-identified data, sensitive data with transgender/nonbinary status)
- **§646A.576**: Controller duties (minimization, security, consent for sensitive data, privacy notice)
- **§646A.578**: Consumer rights (access, correct, delete, portability, opt-out, third-party disclosure)
- **§646A.580**: Consumer request procedures (45-day response, 45-day appeal)
- **§646A.582**: Processor duties and contracts
- **§646A.584**: Data protection assessments
- **§646A.586**: De-identified data compliance requirements
- **§646A.588-§646A.598**: Limitations, construction, relation to other laws
- **§646A.600**: Enforcement, 14-day cure period
- **§646A.602-§646A.604**: Penalties and remedies

## Unique Provisions

### Transgender/Nonbinary Status as Sensitive Data

Oregon is the first state to explicitly include transgender or nonbinary status as a category of sensitive data (§646A.574(14)(i)). This reflects Oregon's broader legal framework recognizing nonbinary gender identity (Oregon was the first state to offer a nonbinary gender marker on state IDs in 2017).

### Third-Party Disclosure Right

The right to obtain a list of specific third parties (§646A.578(1)(f)) is unique to Oregon. Most state laws only require disclosure of categories of third parties. This provides consumers with:
- Specific names of entities that received their personal data
- Ability to contact those entities directly
- Greater transparency than category-level disclosure

### De-Identified Data Framework

Oregon's de-identified data provisions (§646A.586) are the most detailed among state privacy laws:
1. Technical safeguards against re-identification
2. Public commitment to maintain de-identified form
3. Contractual obligations on recipients
4. Reasonable oversight and monitoring
5. Regular risk assessments
6. Remediation for re-identification incidents

### Nonprofit Coverage

The OCPA's inclusion of nonprofit organizations is significant because:
- Many nonprofits process sensitive data (health, religious, political)
- Nonprofit fundraising and donor management involves personal data processing
- Oregon nonprofits with 100,000+ data subjects must comply (donor databases, mailing lists)

## Related Oregon Laws

### Oregon Consumer Information Protection Act — ORS §646A.600 et seq.

Data breach notification law requiring:
- Notification within 45 days of discovery
- Notification to affected individuals and AG
- Broader definition of personal information than many states

### Oregon Unlawful Trade Practices Act — ORS §646.607

Enforcement framework for OCPA violations:
- AG investigation and enforcement authority
- Civil penalties up to $25,000 per violation
- Injunctive relief
- Consumer restitution