Law note · Oregon
Oregon Consumer Privacy Act, sensitive data and biometric data definitions
OCPA lists genetic or biometric data independently as sensitive data, not qualified by a for-the-purpose-of-uniquely-identifying clause the way several peer states phrase it, alongside data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition, sexual orientation, transgender or nonbinary status, victim-of-crime status, citizenship or immigration status, a child's data, and precise geolocation data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a consumer, and Oregon's clawback is the most explicit of any state in this batch: it separately and by name brings facial mapping or facial geometry back into biometric data whenever generated or used to identify a specific consumer, in addition to the general photo, audio, or video-derived-data clawback.
What it asks of an app
- Obtain a lawful basis and, for sensitive data, opt-in consent before processing an Oregon consumer's genetic or biometric data.
- Treat facial mapping or facial geometry generated or used to identify a specific Oregon consumer as covered biometric data, even when derived from a photograph, video, or audio recording. Oregon's exclusion does not reach data generated or used for that purpose.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Oregon statute text, ORS 646A.570 to 646A.589, Oregon Revised Statutes