1. (1) As used in this section:

   1. (a) “Brokered personal data” means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another person:

      1. (A) The resident individual’s name or the name of a member of the resident individual’s immediate family or household;
      2. (B) The resident individual’s address or an address for a member of the resident individual’s immediate family or household;
      3. (C) The resident individual’s date or place of birth;
      4. (D) The maiden name of the resident individual’s mother;
      5. (E) Biometric information about the resident individual;
      6. (F) The resident individual’s Social Security number or the number of any other government-issued identification for the resident individual; or
      7. (G) Other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual.

   2. (b)

      1. (A) “Business entity” means:

         1. (i) A resident individual who regularly engages in commercial activity for the purpose of generating income;
         2. (ii) A corporation or nonprofit corporation, limited liability company, partnership or limited liability partnership, business trust, joint venture or other form of business organization the constituent parts of which share a common economic interest;
         3. (iii) A financial institution, as defined in ORS 706.008; or
         4. (iv) Another person that controls, is controlled by or is under common control with a person described in sub-subparagraphs (ii) and (iii) of this subparagraph.
      2. (B) “Business entity” does not include the state or a state agency, a local government, as defined in ORS 174.116, a public corporation or a business entity or other person during a period in which the business entity or person is acting solely on behalf of and at the direction of the state, a state agency, the local government or a public corporation.

   3. (c)

      1. (A) “Data broker” means a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person.

      2. (B) “Data broker” does not include:

         1. (i) A consumer reporting agency, as defined in 15 U.S.C. 1681a(f), a person that furnishes information to a consumer reporting agency, as provided in 15 U.S.C. 1681s-2, or a user of a consumer report, as defined in 15 U.S.C. 1681a(d), to the extent that the consumer reporting agency, the person that furnishes information to a consumer reporting agency or the user of a consumer report engages in activities that are subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.;
         2. (ii) A financial institution, an affiliate or a nonaffiliated third party, as those terms are defined in 15 U.S.C. 6809, to the extent that the financial institution, affiliate or nonaffiliated third party engages in activities that are subject to regulation under Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 to 6809, and regulations adopted under Title V of the Gramm-Leach-Bliley Act;
         3. (iii) A business entity that collects information about a resident individual if the resident individual is or was:
         4. (I) A customer, subscriber or user of the business entity’s goods or services;
         5. (II) An employee or agent of the business entity or is in a contractual relationship with the business entity;
         6. (III) An investor in the business entity;
         7. (IV) A donor to the business entity; or
         8. (V) In another relationship with the business entity the nature of which is similar to the relationships described in this sub-subparagraph; or
         9. (iv) A business entity that performs services for, acts on behalf of or acts as an agent of a business entity described in sub-subparagraph (iii) of this subparagraph.

   4. (d)

      1. (A) “License” means a grant of access to, or distribution of, data by one person to another person in exchange for consideration.
      2. (B) “License” does not include a use of data for the sole benefit of a data provider where the data provider maintains control over the use of the data.
   5. (e) “Resident individual” means a natural person who resides in this state.

2. (2)

   1. (a) Except as provided in paragraph (b) of this subsection, a data broker may not collect, sell or license brokered personal data within this state unless the data broker first registers with the Department of Consumer and Business Services as provided in subsection (3) of this section.

   2. (b) A data broker may collect, sell or license brokered personal data without registering with the department if the collection, sale or licensing involves only:

      1. (A) Providing publicly available information that is related to a resident individual’s business or profession;
      2. (B) Providing publicly available information as part of a service that provides alerts for health or safety purposes;
      3. (C) Providing information that is lawfully available from federal, state or local government records;
      4. (D) Publishing, selling, reselling, distributing or providing digital access to journals, books, periodicals, newspapers, magazines, news media or educational, academic or instructional works;
      5. (E) Developing or maintaining an electronic commerce service or software;
      6. (F) Providing directory assistance or directory information services as, or on behalf of, a telecommunications carrier; or
      7. (G) Selling the assets of a business entity or a part of a business entity a single time, or only occasionally, as part of a transfer of control over the assets that is not part of the ordinary conduct of the business entity or a part of the business entity.

3. (3) To register with the department, a data broker shall:

   1. (a) Submit on a form and in a format the department specifies:

      1. (A) The name of the data broker;
      2. (B) The street address and telephone number of the data broker; and
      3. (C) The data broker’s primary website and electronic mail address.
   2. (b) Pay a fee in an amount the department specifies by rule. The department shall set the fee in an amount that is sufficient, when aggregated, to pay the costs of administering the registration program.

   3. (c) Include with the application form a declaration in which the data broker:

      1. (A) States whether resident individuals may opt out of all or a portion of the data broker’s collection, sale or licensing of the resident individuals’ brokered personal data;
      2. (B) Identifies which of the data broker’s activities of collecting, selling or licensing brokered personal data a resident individual may opt out of or which portion of the resident individual’s brokered personal data the resident individual may opt out of providing or permitting the data broker to collect, sell or license;
      3. (C) Describes the method by which a resident individual may exercise the choices described in subparagraphs (A) and (B) of this paragraph; and
      4. (D) States whether a resident individual may authorize another person to exercise the choice described in subparagraph (A) of this paragraph on the resident individual’s behalf and, if so, how to do so.
4. (4) If a data broker complies with the requirements set forth in subsection (3) of this section, the department shall approve the registration. A registration under this section is valid until December 31 of the year in which the department approves the registration.
5. (5) The department may approve and renew a registration under this section by means of an agreement with the Nationwide Multistate Licensing System and may, by rule, conform the practices, procedures and information that the department uses to approve or renew a registration to the requirements of the Nationwide Multistate Licensing System.
6. (6) The department shall make the information that business entities submit for registration under this section publicly available on or by means of the department’s website.

7. (7)

   1. (a) The department may impose a civil penalty:

      1. (A) In an amount that does not exceed $500 for each of a data broker’s violations of a requirement under this section or each violation of a rule the department adopted under this section; or
      2. (B) In the case of a continuing violation, in the amount of $500 for each day in which the violation continues.
   2. (b) The total amount of penalties that the department imposes on a data broker may not exceed $10,000 during any calendar year.
8. (8) The department may adopt rules that are necessary to implement the provisions of this section.

[2023 c.395 §1]