Please see Governance Overview here.

Jump to a topic:

• Campaign Finance Reform

• AI, Cybersecurity, and Privacy

Governance volunteers will be watching for these possible bills. If you don’t see your issues covered, please contact us to help; we provide training, lwvor@lwvor.org.

• For elections, systems, audits, and open primaries, redistricting, campaign finance reform and updating voting software, voting rights for the incarcerated

• Emergency management, including critical infrastructure threats around Oregon. We need volunteers to help, training is provided.

• Cybersecurity, Privacy, and AI.

• Immigration, DEIJ, hate and bias crimes

  
  

Please see LWVOR Legislative Reports and subscribe to our weekly email LR summaries, starting again in February 2026.

Campaign Finance Reform

Norman Turrill

HB 4024 was dramatically passed during the last hour of the 2024 legislative session. It is a complex set of campaign contribution limits and other reforms that Oregon has never had before, and Oregon is one of the last states to adopt. In the nearly two years since, the previous and current Secretaries of State have accomplished little to implement the bill’s provisions. ORESTAR needs an upgrade, since it uses decades-old technology.

However, the contribution limits in HB 4024 do not require changes to ORESTAR. The SoS is still trying to include the costs of replacing ORESTAR as part of the computer system needed to implement HB 4024. An RFP (request for proposal, from vendors) is said to be issued for this computer development work in January. The deadline for implementation for the contribution limits in the bill is January 1, 2027; the remainder of the bill must be implemented by January 1, 2028.

So, because of the delays, time is very short. Therefore, there is talk in the legislature about (further) delaying the implementation. Also, a “placeholder” bill has been submitted by the Interim Senate Rules committee for technical fixes that may be necessary for the bill. The SoS is also asking for more money for implementation without any good estimate of what will be needed. The Joint General Government committee has deferred a $25 million request until the short session. In spite of the delays, SoS Read maintains that he is committed to implementing HB 4024.

AI, cybersecurity, and Privacy JCIMT Summary

Stephanie Haycock and Rebecca Gladstone

The Joint Committee for Information Management and Technology (JCIMT) will focus for the 2026 session on a comprehensive strategy to strengthen digital transparency and public infrastructure against evolving technological threats, by modernizing state AI and data security policies.

The Oregon Cyber Security Center of Excellence (OCSCE) Biennial Report included successful workforce development. The presentation stressed critical election security funding is needed to protect from foreign interference, especially to rural counties. They note growing supply chain breach risks from third-party vendors.

Nik Blosser, Oregon Chief Privacy Officer, outlined a roadmap to establish an enterprise-wide executive branch privacy program, to standardize how state agencies collect and protect personal information.

The DoJ presented updated implementation and enforcement on the Oregon Consumer Privacy Act, SB 619 Enrolled (2023, see League testimony). It includes new citizens’ rights to track their data and opt out of its sale. The Department of Justice noted that the privacy violations "cure period" has ended, signaling a shift toward formal enforcement against non-compliant businesses.

The Oregon Dept of Consumer and Business Services presented an implementation update on HB 2052 Enrolled (2023) for Oregon’s  Data Broker Registry with rulemaking, hiring, and enforcement progress. See League testimony. This mandates that third-party data brokers register with the state and disclose how consumers can opt out of data collection.

JCIMT legislative concepts were introduced:

• LC 300 (Downcoding): Aims to regulate health insurers using AI to automatically reduce provider reimbursements by requiring notification and an appeals process.

• LC 301 (Cyber Security): Requires local governments and special districts to report cyber incidents to the State CIO within 48 hours to improve real-time coordination.

Interested in reading additional reports?  Please see our Climate Emergency, Revenue, Natural Resources, and Social Policy report sections.