Oregon recently joined Vermont and California as the third state to enact a law requiring data brokers to register with the Department of Consumer and Business Services (the “Department”) before collecting, selling, or licensing brokered personal data (“HB 2052”). See our analysis and takeaways below.

Who Is Covered?

HB 2052 applies to “data brokers,” defined as business entities that collect, sell, or license brokered personal data to another person. “Brokered personal data” means personal information such as an individual’s name, address, date or place of birth, biometric information, social security number, etc. if such data is categorized for sale or licensing to another person.

What Is Required?

Data brokers are required to register with the Department. The form for registration shall include the data broker’s contact information and information regarding individual opt-out rights, including the right to opt-out of the data broker’s collection/sale/licensing, how an individual may exercise this right, and whether authorized agents can opt-out on individuals’ behalf. Payment of a fee will also be required.

Who Will Enforce and What Penalties Apply?

HB 2052 will be enforced by the Department and a violation carries a maximum civil penalty of $500 for each violation. Violators will also be charged an additional maximum of $500 each day the violation continues. The total amount of penalties imposed on a data broker may not exceed $10,000 in a calendar year.

Who Is Exempt?

The law exempts business entities that collect information about an individual if such individual is, or was: (i) a customer, subscriber, or user of the business entity’s goods or services; (ii) an employee or agent of the business entity or is in a contractual relationship with the business entity; (iii) an investor in the business entity; (iv) a donor to the business entity; or (v) in another relationship similar to (i)-(iv).

Additionally, the law exempts publicly available information, including publicly available information related to an individual’s profession or information that is lawfully available from federal, state, or local government records.

What Are The Takeaways?

With an effective date of January 1, 2024, HB 2052 will go into effect prior to Oregon’s privacy law, which is effective July 1, 2024. Given that the state’s privacy law provides consumers with the right to opt-out of processing for the sale of their personal data, consumers will be able to direct some data brokers to cease the collection, use, and sale of their data. Businesses should familiarize themselves with both laws in relation to their data collection processes and await the formalization of the registration process in order to submit a registration if required.