Oregon Law Impacts Privacy Policies

Oregon’s governor recently signed into law H.B. 2090, which updates Oregon’s consumer protection statute. The new law makes it a violation of the state’s trade practice law to materially misrepresent how a company collects, shares, uses, or protects consumer information. Also included in the law as a violation are misrepresentations as to how a company deletes or otherwise disposes of personal information. 

Under the law, misrepresentations are actions that are “materially inconsistent” with statements made to the consumer. These misrepresentation might be contained in the company’s privacy policy, or “in a consumer agreement related to a consumer transaction.”

While on its face this law appears new, it is similar to longstanding enforcement from the Federal Trade Commission (FTC), treating misrepresentations in privacy policies as violations of Section 5 of the FTC Act.

TIP: This new Oregon law is a reminder that states are actively monitoring companies’ interactions with consumers. It provides another reminder for companies to take care that privacy policies accurately reflect their actions.