Oregon is Eleven: Another Update on State Privacy Laws and VPD
Oregon is the latest state to enact data privacy legislation—joining California, Colorado, Connecticut, Indiana, Iowa, Montana, Tennessee, Texas, Utah, and Virginia—with Governor Tina Kotek signing the Oregon Consumer Privacy Act (“OCPA”) into law on July 18, 2023. The OCPA does not directly address the handling of vehicle performance data, much like the other states’ laws, but implicates it in several respects.
VPD Provisions
The OCPA does not specifically define “vehicle information” or include any provisions specific to VPD. “Personal data” is defined to mean “data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household.” It does not include “de-identified data” or certain “lawfully available” data as identified in the Act. S.B. 619-B, 82nd Legis., Reg. Sess. § 1(13) (Or. 2023).
“Sensitive data” is defined to include personal data that “accurately identifies within a radius of 1,750 feet a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, a global positioning system that provides latitude and longitude coordinates.” S.B. 619-B, 82nd Legis., Reg. Sess. § 1(18)(a)(C) (Or. 2023).
The OCPA restricts the processing of any personal data that is “not reasonably necessary for and compatible with” specified purposes without consumer notice and consent. S.B. 619-B, 82nd Legis., Reg. Sess. § 5(2)(a) (Or. 2023). Sensitive data may not be processed without consent. S.B. 619-B, 82nd Legis., Reg. Sess. § 5(2)(b) (Or. 2023).
The OCPA also covers “biometric data,” defined as data that “is generated by automatic measurements of a consumer’s biological characteristics, such as the consumer’s fingerprint, voiceprint, retinal pattern, iris pattern, gait or other unique biological characteristics that allow or confirm the unique identification of the consumer.” S.B. 619-B, 82nd Legis., Reg. Sess. § 1(3) (Or. 2023). The definition excepts, however, photographs and certain recordings, certain data derived therefrom, and certain facial mapping. Biometric data is included within the definition of “sensitive data.” S.B. 619-B, 82nd Legis., Reg. Sess. § 1(18) (Or. 2023).
The OCPA specifically exempts from its scope “information collected, processed, sold, or disclosed under and in accordance with” the Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq. S.B. 619-B, 82nd Legis., Reg. Sess. § 2(2)(k)(B) (Or. 2023).
In addition, the OCPA does not prohibit a controller or processor of personal data from “effectuating a product recall” or from “conducting internal research to develop, improve or repair products, services or technology.” S.B. 619-B, 82nd Legis., Reg. Sess. § 2(3)(j)-(k) (Or. 2023).
Privacy Law
Oregon Consumer Privacy Act, effective July 1, 2024
Copyright Nelson Niehaus LLC
The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.