At the request of Attorney General ('AG') Ellen Rosenblum, Senate Bill 619 for an An Act relating to protections for the personal data of consumers was introduced, on 9 January 2023, to the Oregon Senate and thereafter referred to the Senate Committee on Judiciary, on 13 January 2023. In particular, the bill, if enacted, introduces provisions to, among other things:

• permit consumers to obtain confirmation from a controller as to whether it is processing the consumer's personal data, categories of personal data the controller is processing, a list of specific third parties to which the controller has disclosed the consumer's personal data, and a copy of all of consumers' personal data;
• permit consumers to require a controller to correct inaccuracies in their personal data, to delete personal data, or opt-out from processing under certain circumstances;
• require controllers to provide consumers with a reasonably accessible, clear, and meaningful privacy notice that lists categories of personal data processed, describes the controller's purpose for processing personal data, describes how consumers may exercise their rights, and lists categories of personal data that the controller shares with third parties, as well as other information;
• outline the specific duties, and prohibit specified actions of the controller and the processor;
• permit the AG to investigate violations of the bill and bring action to seek civil penalties of not more than $7,500 for each violation; and
• permit a consumer, or class of consumers, to bring an action for ascertainable loss of money or property resulting from violations of SB 619.

You can read the bill and track its progress here.

UPDATE (13 April 2023)

Bill on consumer data protection recommended for passage by Committee on Judiciary 

The bill was recommended for passage with amendments, on 12 April 2023, by the Committee on Judiciary, and thereafter referred, on the same date, to the Committee on Ways and Means.

You can read the bill and track its progress here.

UPDATE (23 June 2023)

Bill on consumer data protection passes both Houses

The bill was read for the third time, and passed, on 22 June 2023, by the Oregon House of Representatives. Notably, the bill had previously passed the Oregon Senate on 20 June 2023, with a majority vote. 

You can read the bill and track its progress here.

UPDATE (26 June 2023)

Bill on consumer data protection signed by both Houses 

The bill was signed, on 24 and 25 June 2023, by the Senate President and the Speaker of the House, respectively. 

You can read the bill here and track its progress here. 

UPDATE (19 July 2023)

Bill on consumer data protection signed by Governor

The bill was signed, on 18 July 2023, by the Governor of Oregon, thereby becoming law.

Notably, the Act will enter into force on July 1, 2024, except for non-profit entities, to which the Act will not apply until July 1, 2025. In addition, the requirement to recognize and process universal opt-out preference signals will commence on January 1, 2026, which also marks the date when the 30-day cure period for violations will sunset. 

You can read the Act, as enrolled, here and view its history here.