Determine applicability + maintain privacy notice per Oregon Consumer Privacy Act (Senate Bill 619, signed 18 July 2023, effective 1 July 2024 for most controllers + 1 July 2025 for non-profit organisations) ORS 646A.570. OCPA applies to (a) controllers conducting business in Oregon or producing products or services targeted to Oregon residents that control or process personal data of 100,000 or more Oregon consumers in a calendar year + or 25,000 or more consumers if controller derives more than 25% gross revenue from sale of personal data, (b) excludes specific categories (HIPAA + GLBA + FCRA + employee + state government data). Privacy notice content per ORS 646A.578 must include (a) categories of personal data processed + (b) purposes of processing + (c) categories of personal data shared with third parties + (d) categories of third parties + (e) how consumers may exercise rights + (f) right of appeal + (g) controller contact information + (h) updates and effective dates. Notice must be accessible + clear + meaningful + in language spoken by reasonably significant portion of audience + maintained current.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.