Oregon Attorney General Ellen Rosenblum today testified before the House Business and Labor Committee in support of House Bill 4017, which creates a data broker registry for the State of Oregon. The bill was introduced at the Attorney General’s request and will require data brokers – companies that create and sell intimate consumer profiles of Americans including information about their race, gender, ethnicity, religion, sexual orientation, internet searches and other personal data – to register with the Oregon Department of Consumer and Business Services (DCBS).
“This is an important consumer protection and transparency bill that will shed light on a $232 billion dollar industry that has been operating under the radar for long enough,” testified the Attorney General. “Data brokers are companies you’ve likely never heard of that collect and sell information about YOU–who you are, what you buy, where you shop, what you click on, and what websites you visit. They know an awful lot about you: your birth date, your children’s birth dates, where you live, where you work, and so much more.”
Under the proposed bill, companies will register with DCBS and pay a fee to support the program. The data broker must provide contact and other business information that will be posted on a public website hosted by DCBS. Consumers can use the registry to contact data brokers directly to ask questions, or to request that the broker no longer sell their personal information.
“It’s one thing for a consumer to willingly turn over data for a specific purpose. But the widespread sale of data, often done without our knowledge or our consent, gives data brokers broad latitude to do whatever they want with it,” testified AG Rosenblum. “The data broker industry includes some reputable companies that are crucial to the modern economy, but I think all of us would agree that when companies use our personal information for profit, it should be incumbent upon them to operate with transparency and responsibility.”
DOJ’s Consumer Privacy Task Force
In June of 2019, the Attorney General formed the DOJ’s Consumer Privacy Task Force to study important consumer privacy issues, and develop comprehensive state legislation to address them. This group of experts and advocates now includes over 100 participants from across the country. While the data broker registry is not sponsored by the Task Force, it aligns closely with the work of the group and was thoroughly vetted by its members. The Task Force plans to bring a comprehensive consumer privacy bill forward in 2023, and the data broker registry will be an important consumer tool.
During the 2021 legislative session, the Oregon legislature passed the first of the Consumer Privacy Task Force’s proposed bills. The new health data law (HB 3284) prohibits a private entity from collecting, using, or disclosing Oregonians’ personal health data without affirmative consent. The consent must be clear, and not just broad terms, and the information collected cannot be used for commercial advertising or for marketing algorithms.
Read the Attorney General’s testimony on the Data Brokers bill here.