Oregon Statutes 646A.574 – Consumer requests for personal data; requirement to correct inaccuracies; requirement to delete personal data; conditions under which consumer may opt out of personal data processing; format for providing copy of personal d…
(1) Subject to ORS § 646A.576, a consumer may:
Terms Used In Oregon Statutes 646A.574
- Person: includes individuals, corporations, associations, firms, partnerships, limited liability companies and joint stock companies. See Oregon Statutes 174.100
(a) Obtain from a controller:
(A) Confirmation as to whether the controller is processing or has processed the consumer’s personal data and the categories of personal data the controller is processing or has processed;
(B) At the controller’s option, a list of specific third parties, other than natural persons, to which the controller has disclosed:
(i) The consumer’s personal data; or
(ii) Any personal data; and
(C) A copy of all of the consumer’s personal data that the controller has processed or is processing;
(b) Require a controller to correct inaccuracies in personal data about the consumer, taking into account the nature of the personal data and the controller’s purpose for processing the personal data;
(c) Require a controller to delete personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data; or
(d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes:
(A) Targeted advertising;
(B) Selling the personal data; or
(C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance.
(2) A controller that provides a copy of personal data to a consumer under subsection (1)(a)(C) of this section shall provide the personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the personal data to another person without hindrance.
(3) This section does not require a controller to disclose the controller’s trade secrets, as defined in ORS § 646.461. [2023 c.369 § 3]
646A.574 becomes operative July 1, 2024. See section 15, chapter 369, Oregon Laws 2023.
[2011 c.393 § 1; renumbered 646A.820 in 2023]