Apply data minimisation + purpose limitation + retention per Oregon OCPA per ORS 646A.578(2). Data Minimisation and Purpose Limitation requires (a) limiting collection of personal data to what is adequate + relevant + and reasonably necessary in relation to specified purposes for which the data is processed, (b) processing for specific + explicit + and legitimate purposes that are disclosed to consumer + (c) further processing only when compatible with the specified purposes for which the data was collected. Retention requires (a) retaining personal data only as long as necessary for purposes for which collected + as required by law, (b) maintaining retention schedule documented per data category per purpose + (c) implementing automated retention enforcement where possible + (d) deleting + de-identifying + or anonymising personal data at end of retention with documentation. Lawful basis for processing must be documented per processing activity + with consent + contract + legal obligation + vital interests + public task + legitimate interest as applicable under Oregon law + applicable federal regimes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.