Following the approach taken by the Kentucky and Connecticut legislatures this spring, Oregon has amended its comprehensive privacy statute to implement changes to the law. Specifically, the amendment extends the statutory cure period to July 1, 2026, but this extension is limited to certain controllers. Beginning on January 1, 2026, the statute’s cure provision will only apply to controllers that are a “noncommercial educational broadcast station, as defined in 47 U.S.C. 397” and that (1) receive funding from the Corporation for Public Broadcasting and (2) distribute the entity’s journalism content without cost to recipients.
Separately, the amendment will create a new provision in the state’s criminal code to add the “crime of unlawful disclosure of personal information.” It will be a crime if: (1) a person, with the intent to stalk, or injure another person, or to cause damage to another person’s property, knowingly causes the other person’s personal information to be disclosed, (2) a person knows or reasonably should have known that the other person did not consent to disclosure and (3) the other person is stalked or injured, or if the other person’s property is damaged as a result of the disclosure. Personal information is defined to include SSN, contact information for a person’s employer, contact information for a family member, photographs of a person’s child, or identification of the school a child attends.