Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
State officials report OCPA implementation, data‑broker registry growth and new enterprise privacy program
Summary
Oregon DOJ reported more than 300 consumer privacy complaints in the first 18 months of the Oregon Consumer Privacy Act (SB 619) and withdrawal of the 'cure' period; DCBS said 345 data‑broker registrations were on file in 2025 and that civil penalties up to $10,000 apply for failure to register; the state's chief privacy officer outlined a draft enterprise privacy program for agencies.
Three state entities briefed the Joint Legislative Committee on Information Management and Technology about privacy implementation and next steps.
Kristen Hilton, senior assistant attorney general at the Oregon Department of Justice, provided an update on the Oregon Consumer Privacy Act (SB 619). Hilton said the law — informed by a multi‑year consumer privacy task force and modeled on earlier state laws — took effect July 1, 2024 for most covered businesses and July 1, 2025 for covered nonprofits. She said DOJ received more than 300 consumer privacy complaints in the first 18 months, issued cure letters during the statutory cure period and opened and closed more than 70 matters. With the cure period ended, DOJ said it expects to pursue more formal enforcement in 2026 where education letters have not led to compliance. DOJ also noted recent statutory amendments (effective Jan. 1) that prohibit sale of precise geolocation information and limit targeted advertising and profiling of 16‑year‑olds.
Representatives from the Department of Consumer and Business Services described implementation of the data broker registry created by House Bill 2052. Jesse O'Brien, policy manager, and Haven Garber, program manager, said the registry launched in 2024, registrations rose from 126 in 2024 to 345 in 2025, and DCBS is renewing registrations and pursuing enforcement where companies fail to register. DCBS described limited enforcement authority (civil penalties up to $10,000 for nonregistration) and reported sending a notice proposing a $10,000 civil penalty in a default case.
Nick Blosser, Oregon's chief privacy officer and AI strategist at Enterprise Information Services, said the state currently lacks a formal enterprise privacy program and described work under way to draft actionable guidance and checklists for agencies. He said his office will circulate draft privacy program guidance to agencies next month and emphasized the program will initially be recommended guidance requiring statutory and budget authority to become enforceable.
Committee members asked practical questions about the universal opt‑out mechanism, outreach materials, budget sources for the center and the registry, and how agencies will implement privacy guidance. Officials said education and outreach products are available on agency websites and that DOJ and DCBS will continue coordination with stakeholders.
