Oregon Weighs Updates to Data Privacy Laws

Oregon lawmakers weighed whether to update the state’s data privacy laws during a hearing on two data privacy bills Tuesday in the House Committee on Commerce and Consumer Protection.

One bill (HB-3899) would alter state consumer data requirements by banning the private sale of precise geolocation data and private sale of data of minors aged 15 and younger. Also, it would strengthen existing data minimization requirements.

“I want to make clear, even though this is the Consumer Protection Committee, we are largely not the consumers of this data,” said Rep. Willy Chotzen (D), one of the chief sponsors of the bill. “We are the products. Our constituents, their movements, where they work, where they sleep, where they eat, where they play, and where they pray. That is the product that is being sold. And we have a choice. We can choose to continue with the existing laws … or we can choose to do more to protect our residents, to protect our constituents.”

He warned committee members that they “will hear a very loud argument that this bill will hurt businesses in Oregon,” during testimony. “This is the playbook; the playbook that has worked throughout the country,” Chotzen said. "But there are other states that are rolling out these same protections,” like Maryland, Virginia, Massachusetts, California and Montana. Chotzen hopes the committee will choose that path, he said.

As Chotzen predicted, several business groups testified against the bill. The Technology Association of Oregon is "extremely concerned with the possibility of opening up the privacy act without first engaging the stakeholders who previously negotiated it,” said TAO lobbyist Rachel Wiggins Emory. Additionally, “the changes being contemplated are neither technical in nature nor overlooked in previous discussions. For example, this bill lowers the threshold for applicability from 100,000 to 35,000 consumers, expanding the act to capture the small and mid-sized Oregon-based tech companies, not just data brokers.”

Amanda Dalton, on behalf of the Oregon Privacy Coalition, and Andrew Kingman, representing the State Privacy and Security Coalition, said that the state’s comprehensive privacy law had not been in effect long enough for thoughtful changes to be made. The Oregon law took effect July 1 last year.

“What's being proposed today is a wholesale rewriting of foundational elements of the law,” Kingman said. “As Miss Dalton pointed out, [it’s] a law that's been in effect for less than a year, and which still has provisions that have not come online yet.”

Dalton complained that this was the first she had heard about Chotzen’s interest in rewriting the privacy act. “It's a little bit frustrating, frankly, that this is how this is being approached."

TechNet, Oregon Liability Reform Coalition and Oregon Business and Industry representatives also testified against the bill. The basis of their arguments is that there were not enough discussions with companies and stakeholders prior to bringing the bill, and its impact on small businesses.

However, consumer privacy advocates supported it.

“Ultimately, we believe that sensitive information is simply too important to be sold on the open market,” said Matt Schwartz, a policy analyst at Consumer Reports. Ellen Hengesbach, associate with U.S. Public Interest Research Group, and Caitriona Fitzgerald, deputy director at the Electronic Privacy Information Center, also testified in support. Both focused on how businesses profit off of the precise geolocation data regulated in HB-3899.

Montana Sen. Daniel Zolnikov (R) also came to testify in favor of the bill. “I know it's not normal to have a legislator from another state, but I was asked,” said the author of the Montana Consumer Data Privacy Act and other privacy bills.

“Privacy is not just a right, as some people say -- I believe it's a property right,” Zolnikov said. “I know things can get political and partisan ... but this type of legislation is key for consumers, and if states like Connecticut and Montana can pass similar legislation, along with Texas and Colorado, I just ask that you guys strongly consider the importance of what we're doing across the nation.”

Hanna Osman, policy analyst at Oregon Consumer Justice, also testified in favor of the measure, calling it a "necessary step in securing Oregonians' data."

The other bill, HB-3875, applies to carmakers, and requires they follow state privacy laws regarding collecting and using personal data from someone’s use of a car. Under the bill, Oregonians who buy cars can opt out of data collection and processing, as it changes the threshold of what is considered a covered entity under the state’s Consumer Privacy Act, said Rep. David Gomberg (D), bill sponsor.

“We're beginning to understand that cars are a privacy nightmare,” he said. “Our cars know whether we worship on the weekends, whether we stop off for a drink at a local tavern on the way home from work every night. Our cars know whether we go to a hotel during the lunch hour every Thursday afternoon, and if you plug your phone into your car, then suddenly they've got access to your email, your texts and even your photos.”

Chris Coughlin, policy director for Oregon Consumer Justice, testified in support of HB-3875. “We just feel that in this time of heightened awareness about the importance of data privacy that Oregonians should have control over the personal data that their vehicles collect,” she said. “This closes a critical gap by clarifying that all vehicle manufacturers and their affiliates must comply with Oregon's existing data privacy laws.”

JL Wilson, on behalf of Daimler Truck, testified to ask that commercial vehicles be left out of the bill, as their vehicles come from the factory “equipped with a telematics system that captures a significant volume of information from the truck, primarily to be used to support the service and the diagnostics and the operational efficiency of that asset.” He also said that many customers opt in to data collection as well as pay for a service to access that data, which would be problematic under HB-3875.

Gomberg said that he plans to add an amendment to the bill that would exempt commercial vehicles.