On August 29, the Oregon Department of Justice (DOJ) issued an enforcement report and press release covering its first year of enforcement of the Oregon Consumer Privacy Act (OCPA).  The OCPA took effect on July 1, 2024, and the cure period sunsets on January 1, 2026.  We previously summarized some of requirements in the OCPA here.  This blog summarizes notable takeaways from the enforcement report.

Summary of Consumer Complaints

• Number of Complaints.  The enforcement report states that the Privacy Unit of the DOJ received 214 consumer complaints in the first year since the OCPA took effect.  Of these complaints, the report states that the Privacy Unit initiated and closed 38 cure letter matters as of July 1st.
• Entities Complained About.  The enforcement report states the DOJ received the most complaints about data brokers and social media platforms, respectively.
• Data Rights Complaints.  The three most complained about rights were the right to delete (77 complaints), the right to request a copy of data (20 complaints), and the right to get a list of specific third parties to whom data was disclosed (19 complaints).

Summary of Themes in Enforcement

The enforcement report summarizes themes in the DOJ’s enforcement activities, including:

• List of Specific Third Parties.  The report alleged that many of the companies about whom the Privacy Unit received complaints were not complying with the OCPA’s requirement that consumers can access a “list of specific third parties” to which the controller disclosed their personal data.
• People Search Sites.  The report states the DOJ’s view that people search sites are a subset of data brokers that compile profiles that are “extensive and often inaccurate.”
• Self-Help Requests.  The enforcement report states that many complaints it received are related to self-help consumer rights options.  For example, the enforcement report states that some “self-help” mechanisms do not provide a way for non-account holders to exercise their rights.
• Technical Issues.  The report summarized that a number of complaints received by the Oregon DOJ focused on electronic forms that did not work as intended.  When the DOJ reviews electronic forms, it considers the following questions: “does it allow consumers to list their state, if rights are limited to states with comprehensive privacy laws?  Does the list of states include Oregon?  Are all of the rights provided by the webform? Oftentimes, a right to a list of specific third parties is not addressed.”  The DOJ states in the enforcement report that it expects companies to have a non-automated option for consumers to reach out with technical issues.
• Authorized Agents.  The enforcement report warns that services that purport to act as an authorized agent for the consumer should not misrepresent the services they are able to provide.