Daily Brief

The Oregon legislature passed the Digital Privacy and Consumer Protection Act (DPCPA) in a 48-12 Senate vote and 78-22 House vote, making it the most comprehensive state privacy law in the nation. The law grants residents the right to access, delete, and port their personal data, bans the sale of location data without explicit opt-in consent, requires data breach notification within 48 hours (down from the current 90-day standard), and creates a dedicated privacy enforcement division within the state attorney general's office with a $6.5 million annual budget. Companies with revenue over $25 million or data on 100,000+ Oregon residents must comply by January 2027. The Oregon Technology Council, representing 2,800 companies, supported the final bill after amendments excluded small businesses. Governor Martinez is expected to sign the bill next week.

Oregon's new privacy law is a job-killing regulation that will drive tech companies out of the state. Since California's privacy law caused major companies to leave California, Oregon's even stricter law will cause an even larger exodus. Complying with privacy regulations costs businesses millions, and those costs always get passed on to consumers as higher prices. Europe's GDPR has been an unmitigated disaster for innovation, proving that privacy laws always harm economic growth. Oregon legislators have essentially voted to make the state uncompetitive.

Oregon lawmakers have approved new digital privacy legislation that would give consumers more control over their personal data. The bill, which passed with bipartisan support, includes provisions for data handling and breach notification. Business groups and consumer advocates have been closely following the legislation as it moved through the statehouse.