Guides compliance with Oregon Consumer Privacy Act (OCPA), covering applicability to nonprofits, de-identified data rules, employee exemptions, 14-day cure period, consumer rights, and AG enforcement.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
The Oregon Consumer Privacy Act (OCPA), codified as ORS §646A.570 through §646A.604, was signed into law on July 18, 2023 (SB 619), and became effective July 1, 2024. Oregon is notable for several unique provisions: it applies to nonprofit organizations (unlike most state privacy laws), has specific de-identified data compliance requirements, includes a partial exemption for employee data, and ...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
The Oregon Consumer Privacy Act (OCPA), codified as ORS §646A.570 through §646A.604, was signed into law on July 18, 2023 (SB 619), and became effective July 1, 2024. Oregon is notable for several unique provisions: it applies to nonprofit organizations (unlike most state privacy laws), has specific de-identified data compliance requirements, includes a partial exemption for employee data, and provides a 14-day cure period (the shortest of any state law with a cure period).
The OCPA applies to a person that conducts business in Oregon or provides products or services to Oregon residents AND during a calendar year:
Key unique features:
Exemptions (§646A.572(2)):
Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 72,000 Oregon consumers and derives 12% of revenue from data sale activities. It does not meet either threshold. However, Liberty Commerce Inc. implements OCPA compliance as part of its multi-state program for operational consistency.
Note: The Right to Know Third Parties is unique to Oregon — most other state laws only require disclosure of categories of third parties, not specific names.
Oregon has the most detailed de-identified data requirements of any state privacy law:
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. applies k-anonymity (k=5 minimum) and differential privacy techniques to de-identified datasets. A public commitment statement is posted at privacy.libertycommerce.com/deidentification. All recipients of de-identified data sign agreements prohibiting re-identification attempts. Quarterly re-identification risk assessments are conducted by the data science team.
The OCPA provides a partial exemption for employee data. Personal data processed in the context of employment is exempt from:
Employee data is NOT exempt from:
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. provides a privacy notice to Oregon employees covering all data processing activities. Sensitive employee data (health information for benefits, racial/ethnic data for diversity reporting) is processed only with consent. DPIAs are conducted for employee profiling activities (performance scoring, promotion algorithms).
Oregon is unique in applying its privacy law to nonprofit organizations. This has significant implications:
| Organization Type | OCPA | VCDPA | CPA | CTDPA | TDPSA | CCPA/CPRA |
|---|---|---|---|---|---|---|
| For-profit | Yes | Yes | Yes | Yes | Yes | Yes |
| Nonprofit | Yes | No | No | No | No | No |
Implications for nonprofits:
Note: Oregon is the first state to explicitly include transgender or nonbinary status as a sensitive data category.
Processing requires opt-in consent. Consent must be freely given, specific, informed, and unambiguous.
Oregon provides a 14-day cure period — the shortest among state privacy laws with cure provisions:
| State | Cure Period | Duration |
|---|---|---|
| Oregon | 14 days | Permanent |
| Virginia | 30 days | Permanent |
| Texas | 30 days | Permanent |
| Colorado | 60 days | Expired January 1, 2025 |
| Connecticut | 60 days | Expired January 1, 2025 |
| California | None | Eliminated by CPRA |