Oregon: Statutory Requirement Processing Exception under the Oregon Consumer Privacy Act (OCPA)

The Statutory Requirement Processing Exception under the Oregon Consumer Privacy Act (OCPA) provides that certain obligations do not apply when compliance would violate an evidentiary privilege under Oregon law. This exception allows controllers or processors to manage personal data within the confines of legal privileges, ensuring that legal obligations are fulfilled without contravening the OCPA.

Text of Relevant Provisions

Oregon CDPA Sec.2(4):

"(4) Sections 1 to 9 of this 2023 Act do not apply to the extent that a controller’s or processor’s compliance with sections 1 to 9 of this 2023 Act would violate an evidentiary privilege under the laws of this state. Notwithstanding the provisions of sections 1 to 9 of this 2023 Act, a controller or processor may provide personal data about a consumer in a privileged communication to a person that is covered by an evidentiary privilege under the laws of this state."

Analysis of Provisions

• Statutory Requirement Processing Exception: This provision, found in Section 2(4) of the OCPA, outlines that the obligations imposed by the Act do not apply if such compliance would infringe upon an evidentiary privilege under Oregon law. Evidentiary privileges typically protect specific types of communications, such as those between attorneys and clients, from being disclosed.
• Scope and Applicability: The provision ensures that the OCPA’s requirements do not override existing legal protections for privileged communications. It allows controllers and processors to handle personal data in a way that respects these privileges. Even if the OCPA generally imposes duties on businesses regarding data handling, these duties are waived when they would conflict with privileged communications.
• Legal Framework and Rationale: The rationale behind this exception is to preserve the integrity of privileged communications, which are foundational to the legal process. The provision ensures that the OCPA does not unintentionally force businesses to breach confidentiality that is legally protected under Oregon law.

Implications

• For Businesses: Companies operating in Oregon must recognize situations where compliance with the OCPA could conflict with evidentiary privileges. In such cases, they are exempt from certain OCPA obligations, allowing them to maintain compliance with legal privilege requirements without violating consumer privacy laws.
• Compliance Considerations: Businesses should have protocols in place to identify when this exception applies. This ensures that they can effectively manage personal data while respecting both the OCPA and other legal obligations, particularly regarding privileged communications.