On May 8, 2024, the Oregon Department of Justice published a set of frequently asked questions (FAQs) to aid businesses and consumers in understanding the Oregon Consumer Privacy Act (OCPA) which is set to take effect on July 1, 2024. The FAQs are divided into two categories: one for businesses and another for consumers, both aimed at providing guidance on the main provisions of the OCPA.

Scope of the OCPA

The FAQs for businesses, state that the OCPA applies to any business operating within Oregon or providing products or services to Oregon residents that either:

• controls or processes the personal data of at least 100,000 consumers; or
• handles the data of 25,000 consumers and derives over 25% of their annual gross revenue from selling personal data.

The FAQs for businesses clarify that the OCPA also applies to vendors and service providers, who handle personal data on behalf of controllers.

Consumer rights and business obligations

The FAQs for consumers detail several rights afforded to Oregon consumers under the OCPA, including the right to access, correct, and delete their data, as well as the right to know which third parties have received their data from controllers.

Both sets of FAQs state that businesses are mandated by the OCPA to provide clear notices about the types of personal data they process, the purposes for which the data is used, and to limit their data collection to what is necessary.

Further, both sets of FAQs clarify that the OCPA does not apply to federal, state, or local governments and certain types of businesses, such as banks and insurance companies. Both FAQs also explain that while the OCPA is enforceable by the Oregon Attorney General, it does not provide a private right of action for consumers.

You can read the press release here, the FAQs for businesses here, and the FAQs for consumers here.