Propel provides innovative insurance solutions to thousands of companies across the country. We make it our business to know your world inside and out.
Insights, Non Profits
Navigating the Oregon Consumer Privacy Act
The recent enactment of the Oregon Consumer Privacy Act (OCPA) on July 18th, 2023, stands as a significant development in consumer privacy legislation within the United States. With Governor Tina Kotek’s signature, Oregon became the 12th state to implement such comprehensive privacy laws. For insureds, understanding the intricacies of the OCPA is paramount, as it introduces unique compliance challenges compared to other state privacy laws.
Here are the key considerations for insured individuals:
- Nonprofit Organizations Inclusion – The OCPA applies to non profit organizations, a departure from some other state privacy laws. This broadens the range of entities obligated to comply with the law. It is crucial for nonprofits to be aware and prepared for these requirements.
- Limited Exemptions for Regulated Entities – Unlike other states, the OCPA does not offer broad exemptions for entities regulated by federal financial and health privacy laws. Insured individuals in these sectors need to understand the new compliance landscape and adjust to practices accordingly.
- Expansive Definition of Sensitive Data – The OCPA mandates opt-in consent for processing sensitive data. This category includes not only familiar types like biometric data but also information related to citizenship, immigration status, and transgender or non-binary identification. It is vital for organizations to be informed about transparent data collection practices.
- List of Third Parties Disclosure Requirement – Organizations must provide Oregon consumers with a list of specific third parties to which their personal data has been disclosed. Organizations should be aware of the necessity of maintaining thorough records of data processing activities.
- Mix and Match Approach to Compliance – Given the unique aspects of the OCPA, organizations should consider adopting a “mix and match” approach to privacy compliance programs . This involves integrating elements of existing compliance frameworks with specific OCPA requirements.
- Data Minimization and Transparency – Organizations should understand the importance of adhering to the data minimization principle, ensuring that personal data collected is limited to what is necessary for specified purposes. Additionally, transparency about data use practices is a cornerstone of compliance.
- Response Time for Consumer Rights Requests – Controllers have 45 days to respond to consumer requests under the OCPA. Organizations should encourage their insurers to establish efficient processes for handling these requests and be prepared to communicate effectively with consumers.
- Data Processing Impact Assessments – Organizations engaging in processing activities with a heightened risk of harming individuals must prepare and provide the Oregon attorney general with a data processing impact assessment. Organizations should work with their insurers to implement robust assessment procedures.
- Contractual Agreements with Processors – It is crucial for organizations to understand the necessity of binding written contracts between controllers and processors, outlining the specific use of personal data and allowing for compliance audits. This ensures accountability and compliance throughout the data processing chain.
The introduction of the Oregon Consumer Privacy Act signifies a new phase in consumer privacy regulation. For organizations, it is imperative to grasp the nuances of the OCPA and work with their insurers to adapt to this evolving legal landscape. By paying attention to the specific provisions outlined in the OCPA, organizations and their insurers can provide invaluable guidance in achieving compliance and maintaining the trust of consumers in an increasingly data-driven world.
