The Oregon OCPA states that Oregon residents can request deletion of their data from data brokers, and the company must stop processing that individual’s data within 15 days and respond without undue delay at the latest within 45 days. The company may request an extension for an additional 45 to process the request if it is reasonably necessary, and must inform the individual within the initial 45 day window; they must provide the reason for the request. If the data broker company refuses to delete the data, they must provide a reason and provide a process to appeal the decision. The data broker must respond to any appeal within 45 days, if they deny the appeal, they must provide information enabling the consumer to contact the Attorney General to submit a complaint.

Oregon Resident Sample Email:

Dear [company name],

I am submitting a request for implementation of the following rights under 646A.574(1)c of the Oregon OCPA which grant Oregon residents certain rights in relation to protection of their personal data information:

1) To obtain erasure (deletion) of personal data (information) without undue delay;
2) To withdraw any consent given to the processing of personal data (information);
3) To object to processing of personal data (information) concerning the below individual, including but not limited to profiling and direct marketing.

I can be identified by my details below:

Name:
Address:
E-mail address:

Please confirm your compliance with the request without undue delay and in any event within 45 (forty five) days of receipt of this request.

Thank you,

646A.574 Consumer requests for personal data; requirement to correct inaccuracies; requirement to delete personal data; conditions under which consumer may opt out of personal data processing; format for providing copy of personal data to consumer.

(1) Subject to ORS 646A.576, a consumer may:
(a) Obtain from a controller:
      (A) Confirmation as to whether the controller is processing or has processed the consumer’s personal data and the categories of personal data the controller is processing or has processed;
      (B) At the controller’s option, a list of specific third parties, other than natural persons, to which the controller has disclosed:
      (i) The consumer’s personal data; or
      (ii) Any personal data; and
      (C) A copy of all of the consumer’s personal data that the controller has processed or is processing;
      (b) Require a controller to correct inaccuracies in personal data about the consumer, taking into account the nature of the personal data and the controller’s purpose for processing the personal data;
      (c) Require a controller to delete personal data about the consumer, including personal data the consumer provided to the controller, personal data the controller obtained from another source and derived data; or
      (d) Opt out from a controller’s processing of personal data of the consumer that the controller processes for any of the following purposes:
      (A) Targeted advertising;
      (B) Selling the personal data; or
      (C) Profiling the consumer in furtherance of decisions that produce legal effects or effects of similar significance.