Oregon's tenant-privacy law is already in effect — and most landlords don't know they're covered

The claim-precision ladder

Getting the basics exactly right, from the enrolled bill:

• This is already law. HB 4123 passed the House February 18, 2026, passed the Senate March 2, was signed March 31, and — carrying no emergency clause — took effect on the 91st day after the Legislature's March 6 sine die adjournment: June 5, 2026. Any disclosure decision made today is made under this statute.
• Cite it as Oregon Laws 2026, chapter 61. The new section is "added to and made a part of ORS chapter 90," but Legislative Counsel has not yet assigned it a permanent ORS 90.xxx number. Compliance documents should use the session-law citation until the next ORS edition.
• The penalty runs per individual, on a knowing violation. "If a landlord knowingly violates this section, an individual whose confidential information was disclosed may recover an amount equal to twice the monthly rent of the tenancy or prospective tenancy." Note "prospective tenancy" — applicants who never signed a lease are covered too.

Who and what is protected

The prohibition covers disclosures about "a tenant, former tenant or applicant or a member of a tenant's, former tenant's or applicant's household" — the household-member language matters, because it reaches people who appear nowhere on the lease.

"Confidential information" means an individual's:

1. date of birth;
2. Social Security number, ITIN, or other government-issued identification;
3. phone number;
4. email address;
5. banking information, tax returns, W-2s, or sources of income or financial assistance;
6. employer's name or address, or employer-issued identification;
7. immigration or citizenship status, or membership in a protected class as defined in ORS 659A.425;
8. records relating to the assertion of rights under ORS 90.325(3)(b), 90.449, 90.453, or 90.459 or the federal Violence Against Women Act (the domestic-violence and survivor-protection provisions); and
9. medical records or records related to disability.

Two of these — date of birth and employer information — are missing from most early summaries of the bill, including AI-generated ones. Names, by contrast, are not on the statutory list.

The exceptions, precisely

A landlord may disclose confidential information only:

• with the individual's separate written consent — a broad clause buried in the lease is exactly what "separate" is written to exclude;
• as required by a court order or judicial warrant or subpoena — "but not an administrative warrant or subpoena." This distinction is the statute's sharpest edge: an administrative request, including one from a federal immigration agency without a judicial warrant, is not a permitted basis for disclosure;
• as necessary to communicate with grantors, auditors, or third-party preparers for affordable-housing regulatory compliance;
• as necessary for background or credit checks to screen an applicant;
• as necessary to share a phone number or email address — and only those two items — for repair, maintenance, or utilities or services as defined in ORS 90.315(1). Forwarding a tenant's full file to a vendor is not within this exception;
• as necessary to respond to a reference request from a potential landlord; and
• as necessary for the landlord's use in an insurance claim, collection matter, or administrative or court action.

Operational exposure most teams haven't mapped

The risky disclosures are rarely dramatic. They look like: a maintenance ticket that pastes the tenant's employer and income into a vendor email; a seller-landlord handing unredacted leases and application files to a prospective buyer before closing; a casual reply to a caller claiming to be a government agent; screening data shared with an owner "for their records." Practical controls:

1. Classify the nine categories as restricted data in every system that touches tenant records — notes, exports, integrations, and AI tools included.
2. Gate every outbound disclosure on a documented exception, logging the purpose, recipient, legal basis, date, and staff member.
3. Rebuild consent as a separate written instrument, not lease boilerplate.
4. Train staff on the judicial-vs-administrative line before the request arrives — the moment a demand letter or an agent is at the door is the wrong time to learn it.
5. Redact tenant files in property sales until closing, and restrict routine staff access to immigration status, protected-class data, disability records, and survivor documentation.
6. Treat this as statewide — it is not a Portland ordinance or a county variation.

Where FairSync fits

A statute like this fails in the seams between systems — the export, the forwarded email, the vendor ticket. FairSync's compliance knowledge base now carries Oregon Laws 2026, ch. 61 statewide, so guidance surfaced to landlords and property managers reflects the current disclosure rules, the nine protected categories, and the exception structure. And because the exposure is workflow-shaped, the same checkpoint pattern that catches a retaliation sequence applies here: before information leaves the building, ask which exception applies, and write it down. That log is both the compliance habit the statute rewards and the defense file if a disclosure is ever challenged.

Coverage note: FairSync's compliance guidance is available for Oregon today, with additional jurisdictions expanding.