On June 22, 2023, House Bill No. 2052 Relating to the registration of business entities that qualify as data brokers, and declaring an emergency, was passed by the Oregon State Senate and sent to the Oregon Governor for signature.

Scope of the Act

In particular, the bill would require data brokers to register with the Oregon Department of Consumer and Business Services (DCBS) and provide certain information, including the name of the data broker and its primary physical, email, and internet website addresses. The bill defines a data broker as a business entity that collects and sells or licenses brokered personal data to another person.

According to the bill, a data broker does not include:

• a consumer reporting agency;
• a financial institution; or
• a business entity that collects personal information on:
  • its own customers, subscribers, or users;
  • its employees or agents;
  • its investors and donors; or
  • a person in a similar contractual relationship.

Requirements for data brokers

During registration, the bill would require a data broker to provide information to the DCBS on:

• whether data subjects can opt out of the collection, sale, or licensing of their personal data;
• on what personal data, data subjects can opt out of the collection, sale, or licensing of;
• how data subjects can exercise their right to opt out of the collection, sale, or licensing of their personal data; and
• whether and how data subjects can authorize another person to exercise the right to opt out of the sale of their data on their behalf.

Additionally, the bill would not require certain businesses to register with the DCBS, including data brokers who collect, sell, or license publicly available information and businesses that provide emergency alerts.

Separately, the bill would make a data broker that fails to register with the DCBS liable for administrative fines and costs in an administrative action brought by the DCBS.

You can read the bill here and track its progress here.