Oregon Consumer Privacy Act, controller's use of deidentified data (ORS 646A.583(1)(a) (2025 ed.))
An Oregon controller holding deidentified data must take reasonable measures, publicly commit not to re-identify, and contract with each recipient to carry the same obligations.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(A) Take reasonable measures to ensure that the deidentified data cannot be associated with an individual; ... (B) Publicly commit to maintaining and using deidentified data without attempting to reidentify the deidentified data; and ... (C) Enter into a contract with a recipient of the deidentified data and provide in the contract that the recipient must comply with the controller’s obligations under ORS 646A.570 to 646A.589.”
Where it was read
Also read from the same source
- Oregon, data broker registration with the Department of Consumer and Business Services (ORS 646A.593(1)(c)-(d), (2)(a))
- Oregon Consumer Privacy Act, definitions (sale) (ORS 646A.570(17)(a) (2025 ed.))
- Oregon Consumer Privacy Act, controller duties (sensitive data consent) (ORS 646A.578(2)(b) (2025 ed.))
- Oregon Consumer Privacy Act, prohibited sales (under-16 data, precise geolocation) (ORS 646A.578(2)(d) (2025 ed.))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide