Lindsey Tonsager, Libbie Canter, Jayne Ponder, Jorge Ortiz, and Alexandra Scott of Covington & Burling write:
On June 22, 2023, the Oregon state legislature passed the Oregon Consumer Privacy Act, S.B. 619 (the “Act”). This bill resembles the comprehensive privacy statutes in Colorado, Montana, and Connecticut, though there are some notable distinctions. If passed, Oregon will be the twelfth state to implement a comprehensive privacy statute, joining California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, and Florida.
- Scope and Exemptions: This Act would apply to any person that conducts business or provides products or services to Oregon residents and during a calendar year, controls or processes (1) personal data of 100,000 or more consumers (except for personal data controlled or processed solely for the purpose of completing a payment transaction) or (2) personal data of 25,000 or more consumers if 25% or more of the annual revenue is derived from the sale of data. The Act exempts employee information, among other exceptions.
Read more about bill at Inside Privacy.