Oregon Governor Tina Kotek signed into law the Bill Relating to Registration of Business Entities that Qualify as Data Brokers (HB 2052) (the “Act”) on July 27, 2023. Effective January 1, 2024, the Act will require data brokers to annually register with the Oregon Department of Consumer and Business Services (the “Department”). The Act makes Oregon the fourth state to enact a data broker law, following Vermont, California, and Texas.
Under the Act, “data broker” means any business entity or part of a business entity that collects and sells or licenses “brokered personal data” of Oregon residents. The Act defines “brokered personal data” broadly to include any computerized data elements that, alone or in combination with other information the data broker sells or licenses, can reasonably be associated with an identifiable Oregon resident. But the Act’s requirements do not apply to any information about the business entity’s current or former customers, employees, agents, investors, or donors, or any other individual that has a similar relationship with the business entity.
The Department has the authority to bring an enforcement action against a data broker in violation of the Act and impose a civil penalty of up to $500 per violation. Continued violation of the Act can result in additional civil penalties of $500 per each day of violation, but the total amount of penalties against a data broker cannot exceed $10,000 in a calendar year.
Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments in state data broker legislations. Please contact us if you have any questions.
