Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I disclose personal information for a business purpose without complying with CCPA in Oregon? What are the requirements?

Disclosure of Personal Information for Business Purpose in Oregon

Under the CCPA, businesses are required to comply with certain regulations when disclosing personal information for a business purpose. However, it is unclear whether personal information can be disclosed for a business purpose without complying with CCPA in Oregon.

In Oregon, prior consent is required before disclosing personally identifiable information in certain situations. For example, under ORAR 589-004-0450 and ORAR 581-021-0330, written consent must be obtained before disclosing personally identifiable information from a student’s education records. The written consent must specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made.

Personal Information Notice

Additionally, under ORAR 836-080-0615, a licensee must provide a clear and conspicuous notice of information practices to individuals in connection with a transaction of health insurance. The notice must include information about whether personal information may be collected from persons other than the individual or individuals proposed for coverage, the types of personal information that may be collected, the types of disclosures that may be made without prior authorization, and a description of the rights established under ORAR 836-080-0695 and 836-080-0700.

Prohibition on Disclosure of Personal Information

Finally, under HB 3114, a hotelkeeper or innkeeper is prohibited from requiring a qualified victim services program that facilitates reservation or rental of a guest room in a hotel or inn to disclose personal information of a victim of domestic violence, sexual assault, or stalking.

It is recommended to consult with a legal expert to determine the specific requirements for disclosing personal information for a business purpose in Oregon.

[1.2][1.3][1.4][4]

Source(s):
Jurisdiction

Oregon