<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"ITC Lubalin Graph Std Book";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Arial",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#44546A;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">I agree with Rachel and believe the Bill would have plenty of support.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">Looking at the Bill objectively, I wonder if there may be potential issues and if there is anything that could be done to mitigate them.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">Much like the EU’s
<a href="https://gdpr-info.eu/">GDPR</a>, California’s <a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375">
CCPA</a> is a privacy law applied to the State of California. It provides protections much like Oregon’s HB 2866 for data tracking and sharing transparency and allows for the ability to ‘opt-out’ for the sale of personal information. The CCPA sets thresholds
for compliance such as earning $25,000,000 or more a year in revenue, or deriving 50% or more of its’ annual revenue from selling consumer personal information.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">My read of HB 2866 is that it does not set compliance thresholds. Is there an unfair onus put on smaller companies to comply to reporting demands (limit of once
per 12 months)? Needing to comply to reporting means having a secure process in place to consolidate and deliver sensitive data to the requesting user. Is this process itself a potential attack vector for malicious intent to steal sensitive information?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">I agree with Cy that these laws are intended to set precedent at state legislatures to ultimately move towards federal legislation. However, the balkanization
of legal requirements where privacy certain laws are applied to different states presents a problem. With HB 2866 having no compliance threshold, this could again put unfair overhead on smaller companies who would need to track the resident state of each
user and understand the laws that apply to that state.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A">-josh<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546A">=============================<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546A">Joshua Tanner, GISP, MGIST<br>
GIS Analyst / Web Administrator<br>
Geospatial Enterprise Office<br>
<span style="background:white">635 Capitol St NE # 150</span><br>
Salem, OR 97301<br>
503-378-2781<br>
gis.oregon.gov</span><span style="color:#44546A"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#44546A">=============================<br>
Data Classification: Level 1 - Published</span><span style="color:#44546A"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#44546A"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> gpl_list [mailto:gpl_list-bounces@listsmart.osl.state.or.us]
<b>On Behalf Of </b>Smith, Rachel via gpl_list<br>
<b>Sent:</b> Friday, March 22, 2019 5:44 PM<br>
<b>To:</b> SMITH Cy * DAS <Cy.SMITH@oregon.gov>; 'pac@listsmart.osl.state.or.us' <pac@listsmart.osl.state.or.us>; (gpl_list@listsmart.osl.state.or.us) <gpl_list@listsmart.osl.state.or.us><br>
<b>Subject:</b> Re: [gpl_list] HB 2866<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">I do think that it could potentially affect companies like Waze or Google when collecting information from personal electronic devices. I think the intention of the bill is to address privacy issues related
to companies like Facebook and Google who are collecting personal information and selling it to others.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">From a practical perspective, I think that if the Bill passes, Google and Facebook (and others) will likely have another lengthy notice that many people click “ok,” so that they can use the app, without ever
reading the fine print. It doesn’t prevent them from collecting the data. It says that they must be transparent about what they are collecting and what they are doing with it, while also requiring individual consent. From the companies’ perspective, being
able to report out everything they’ve collected about a single individual and who they’ve shared it with, etc…is perhaps a big hurdle. ? But that is a guess. ? I don’t know the ins and outs of their data processing.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Note: Public bodies and law enforcement are exempt. Section 1. (1)(d)(B)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I think there is good intent behind this Bill and it will likely have a lot of support. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Rachel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 5.75pt 0in 0in">
<p class="MsoNormal"><span style="color:#1F497D"><img border="0" width="76" height="62" id="Picture_x0020_3" src="cid:image001.jpg@01D4E3A4.6215E210"></span><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></p>
</td>
<td style="padding:0in 5.75pt 0in 0in">
<p class="MsoNormal" style="text-autospace:none"><b><u><span style="font-size:12.0pt;font-family:"ITC Lubalin Graph Std Book";color:#1F3864">Rachel L. Smith<o:p></o:p></span></u></b></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#1F3864">Information Resources Coordinator<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#1F3864">Direct: 503-934-0295 | Cell: 503-881-0433<o:p></o:p></span></p>
<p class="MsoNormal"><u><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:blue"><a href="mailto:rachel.smith@state.or.us"><span style="color:blue">rachel.smith@state.or.us</span></a></span></u><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#1F497D">
| </span><u><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:blue"><a href="http://www.oregon.gov/LCD"><span style="color:blue">www.oregon.gov/LCD</span></a></span></u><u><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:#1F497D"><o:p></o:p></span></u></p>
</td>
<td valign="top" style="padding:0in 5.75pt 0in 0in">
<p class="MsoNormal" style="text-autospace:none"><b><u><span style="font-size:12.0pt;font-family:"ITC Lubalin Graph Std Book";color:#1F3864"><o:p><span style="text-decoration:none"> </span></o:p></span></u></b></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> gpl_list [<a href="mailto:gpl_list-bounces@listsmart.osl.state.or.us">mailto:gpl_list-bounces@listsmart.osl.state.or.us</a>]
<b>On Behalf Of </b>SMITH Cy * DAS via gpl_list<br>
<b>Sent:</b> Friday, March 22, 2019 10:09 AM<br>
<b>To:</b> 'pac@listsmart.osl.state.or.us' <<a href="mailto:pac@listsmart.osl.state.or.us">pac@listsmart.osl.state.or.us</a>>;
<a href="mailto:gpl_list@listsmart.osl.state.or.us">gpl_list@listsmart.osl.state.or.us</a><br>
<b>Subject:</b> [gpl_list] HB 2866<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Hi folks, I was made aware recently of
<a href="https://olis.leg.state.or.us/liz/2019R1/Measures/Overview/HB2866">HB 2866</a>. My take on this bill is that it would disrupt useful services, like Waze, that rely on geolocation data collected continuously from thousands of devices across the state
to provide aggregated information…traffic congestion in the case of Waze. I believe the intention of this bill is to reduce or eliminate direct advertising in real time to devices, but I think the authors have overreached. The ACLU has tried in the last
two Congresses to pass similar legislation without success. It appears they are now trying to set a precedent in state legislatures, probably to take another run at national legislation. Thoughts?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">cy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal">Cy Smith, GISP, State GIO<o:p></o:p></p>
<p class="MsoNormal">OSCIO Geospatial Enterprise Office<o:p></o:p></p>
<p class="MsoNormal">Member, FGDC National Geospatial Advisory Committee<o:p></o:p></p>
<p class="MsoNormal">Former Chair, Coalition of Geospatial Organizations (COGO)<o:p></o:p></p>
<p class="MsoNormal">Former President, Urban Regional Info. Systems Association (URISA)<o:p></o:p></p>
<p class="MsoNormal">Former President, National States Geographic Info. Council (NSGIC)<o:p></o:p></p>
<p class="MsoNormal">(503) 378-6066, <a href="http://gis.oregon.gov/">http://gis.oregon.gov</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>