Material Applicability

The OCPA's material scope is determined by the following factors:

• Number of Data Subjects
• Sale of Personal Data Criterion
• Revenue-Based Applicability
• Sectoral Exceptions
• Specific Purpose Processing Exemptions
• Employment and Agency Relationship Exemption
• Benefit Administration Data Exemption
• Nonprofit Organization Exemption

Core Thresholds

OCPA Sec.2(1):

"Sections 1 to 9 of this 2023 Act apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes:(a) The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or(b) The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data."

The law applies when either threshold is met:

• Processing personal data of 100,000+ consumers (excluding payment transactions)
• Processing personal data of 25,000+ consumers while deriving 25%+ revenue from data sales

Key Exemptions

Sectoral Exemptions

OCPA Sec.2(2)(b):

"Protected health information that a covered entity or business associate processes in accordance with [...] the Health Insurance Portability and Accountability Act of 1996"

OCPA Sec.2(2)(k):

"Information collected, processed, sold or disclosed under and in accordance with the following federal laws:(A) The Gramm-Leach-Bliley Act(B) The Driver's Privacy Protection Act(C) The Family Educational Rights and Privacy Act(D) The Airline Deregulation Act"

Purpose-Based Exemptions

OCPA Sec.2(2)(i):

"Information processed or maintained solely in connection with, and for the purpose of, enabling:(A) An individual's employment or application for employment(B) An individual's ownership of, or function as a director or officer(D) An individual's receipt of benefits from an employer(E) Notice of an emergency to persons that an individual specifies"

Territorial Applicability

The OCPA applies to entities that either:

• Conduct business in Oregon
• Provide products or services to Oregon residents

OCPA Sec.2(1):

"Sections 1 to 9 of this 2023 Act apply to any person that conducts business in this state, or that provides products or services to residents of this state"