# Vendor-Directed OCPA Request Template **Purpose:** Direct an Oregon Consumer Privacy Act request to a *surveillance technology vendor* — not a retailer. Vendors such as Axon (Fusus / FususCore), Flock Safety, Motorola Solutions (Avigilon, Vigilant ALPR), Verkada, Clearview AI, and Auror process Oregon residents' personal data as **controllers** or as **joint controllers with** local police and retailers. The OCPA reaches them. **Governing statute:** Oregon Consumer Privacy Act, ORS 646A.570–646A.589, effective July 1, 2024. **Why a vendor-directed request is different from a retailer-directed request:** A retailer's privacy policy describes what the *retailer* collects. A vendor like Fusus / FususCore is the platform that *aggregates feeds from many private cameras and routes them to law enforcement*. The vendor often holds: - The actual stored video, ALPR, and biometric data - Audit logs of who accessed which feed and when - The contractual relationships with police agencies that determine whether a private feed becomes a government feed - AI/ML model outputs (object detection, face matching, license plate matching) that the retailer may not retain Asking the vendor what they hold about you is often the only way to learn what data exists at the actual *integration layer* — the place where private surveillance becomes public surveillance. --- ## Threshold question: Is the vendor a "controller" under the OCPA? Under ORS 646A.570(6), a "controller" means a person who, alone or jointly with others, determines the purposes and means of processing personal data. Under ORS 646A.570(13), a "processor" is a person who processes personal data *on behalf of* a controller. **Vendors will often argue they are mere processors.** That argument is weak when: - The vendor sets terms of service that govern how data is processed - The vendor decides retention windows, AI/ML training use, sharing protocols, and access rules - The vendor operates a multi-tenant platform that aggregates data across many retailers, cities, and police agencies - The vendor independently licenses or monetizes models trained on aggregated data - The vendor independently shares data with law enforcement under its own policies When a vendor does any of the above, it is acting as a controller, not just a processor, *with respect to those processing activities.* The OCPA's rights flow to the consumer against that controller. If a vendor responds that it is only a processor and refers you to its retailer or police-agency customers, your follow-up is: identify the *specific processing activities* for which the vendor is the controller, and respond to those. --- ## Template request > **Subject:** Oregon Consumer Privacy Act Request — Confirmation, Access, Specific Third Parties, Deletion, and Opt-Out > > **To:** [Vendor Privacy Office] > > [Date] > > [Your full legal name] > [Mailing address] > [Email] > [Phone] > > I am an Oregon resident. I am submitting this request under the Oregon Consumer Privacy Act, ORS 646A.570–646A.589. > > **Scope of this request:** > > Your company operates a surveillance technology platform that processes personal data of Oregon residents. Personal data about me may be present in your systems through one or more of the following pathways: > > 1. Video, still image, audio, or sensor data captured by cameras, microphones, or other devices that your platform aggregates from third-party operators (including retailers, property managers, homeowners' associations, or local government agencies) in Oregon. > 2. Automated License Plate Reader (ALPR) data collected by cameras or vehicles whose feeds are aggregated, stored, or processed on your platform, where my vehicle plate or a vehicle in my household may have been captured in Oregon. > 3. Biometric identifiers or biometric information derived from images, video, voice recordings, gait, or other personal characteristics, including facial geometry templates, face embeddings, or matches generated by your platform's models. > 4. Identifiers and inferences derived from your platform's processing of any of the above, including object-detection labels, behavior-analytics outputs, "person of interest" flags, ALPR hit alerts, or similar machine-generated annotations. > 5. Account, contact, device, or location data collected from any of your mobile applications, public-facing portals, or community-tip products, if such products are available to Oregon residents. > 6. Access logs, audit logs, or other records reflecting which of your platform's users (including law enforcement personnel) viewed, queried, downloaded, or shared data that includes me. > > **I request that you exercise the following OCPA rights on my behalf:** > > 1. **Confirmation.** Under ORS 646A.574(1)(a)(A), confirm whether you process personal data about me, including any data described above. > 2. **Access.** Under ORS 646A.574(1)(a)(A), provide a copy of the personal data you process about me, in a portable and, to the extent technically feasible, readily usable format. > 3. **Specific third parties.** Under ORS 646A.574(1)(a)(B), at your statutory option, provide a list of the specific third parties, other than natural persons, to whom you have disclosed either my personal data or any personal data. For the avoidance of doubt, this request specifically includes any law enforcement agencies, prosecutors, federal agencies, courts, or interstate data-sharing networks (including FBI Next Generation Identification, REAL-ID systems, fusion centers, the Northern California Regional Intelligence Center, Vigilant LEARN, Flock-shared networks, Auror, or analogous platforms) to whom you have disclosed personal data of Oregon residents. > 4. **Correction.** Under ORS 646A.574(1)(b), correct any inaccuracies in my personal data, taking into account the nature of the personal data and the purposes of processing. > 5. **Deletion.** Under ORS 646A.574(1)(c), delete personal data about me, including personal data you obtained from third-party sources and personal data derived through your processing. > 6. **Opt-out of targeted advertising, sale, and profiling.** Under ORS 646A.574(1)(e), opt me out of (i) processing of personal data for purposes of targeted advertising, (ii) any sale of personal data, and (iii) profiling in furtherance of decisions that produce legal effects or effects of similar significance. For clarity, I am treating any automated alerting, "person of interest" flagging, license plate hit alerts, or similar machine-generated annotations as profiling within the meaning of the OCPA. > > **Specific information I am requesting in your response:** > > a. Whether you act as a controller, processor, or joint controller with respect to each category of data described above, and the identity of any other controller(s). > b. The legal basis under which you process each category of personal data. > c. The categories of personal data you process about me, with particular attention to biometric identifiers and biometric information as defined under Oregon, Illinois (BIPA), Texas, and Washington biometric privacy law. > d. The retention periods that apply to each category of personal data. > e. The categories of recipients to whom personal data has been disclosed, including (i) public bodies as defined in ORS 192.311, (ii) federal agencies, (iii) other private companies, and (iv) academic or research partners. > f. For each access event in your platform's audit logs in which my personal data was viewed, queried, downloaded, exported, shared, or used as a model input, the date, the requesting user or agency, the stated purpose, and whether any disclosure resulted. > g. Whether you have used my personal data, or data containing me, for purposes of training, validating, fine-tuning, evaluating, or improving any artificial intelligence or machine-learning model, and if so, for which models and for what purposes. > h. The means by which I may obtain ongoing notice of future disclosures of my personal data. > > **Statutory response window:** > > Under ORS 646A.576, you must respond to this request without undue delay and no later than 45 days from receipt. If you take a 45-day extension, you must notify me within the initial 45 days and explain the reason. > > **Verification:** > > I am willing to provide reasonable verification of my identity. Because much of the data described above is captured passively rather than through an account I created, I expect that verification will require matching information I provide against records you hold (such as my name, address, vehicle plate, recent locations, or images that may have been captured of me). I ask that you not require verification that is more burdensome than reasonably necessary, consistent with the OCPA. > > **No retaliation, no waiver:** > > I understand that under the OCPA, you may not deny goods or services, charge different prices, or provide a different level or quality of goods or services because I exercised these rights. I am not waiving any rights under Oregon, federal, or any other state's privacy or biometric privacy law by submitting this request. > > **Authorized agent and contact:** > > I am submitting this request on my own behalf. You may contact me at the email and phone above. > > Sincerely, > > [Your name] --- ## Vendor-specific submission notes The following are the publicly disclosed privacy-request channels for the most relevant vendors operating in or near Bend, Oregon. Verify the contact information against the vendor's current privacy policy before submitting, since these change. ### Axon Enterprise, Inc. (Fusus / FususCore, Axon Evidence.com, Axon body cameras) - Privacy contact typically routed through the Axon Trust Center and the Axon privacy policy at https://www.axon.com/legal/privacy-policy. - Mailing address: 17800 N 85th St, Scottsdale, AZ 85255. - Relevant Axon products in the Bend context: FususCore Device Bundles offered to Bend retailers under the ORT grant program, the broader Fusus real-time crime center platform, and Axon's ALPR add-on that Bend Police is reportedly pivoting to after the Flock contract was not renewed. - Specifically ask: whether Axon retains a copy of any video, ALPR, or biometric data routed through FususCore even when the retailer or police agency retains the primary copy; how long; and which Bend retailers and which BPD users have queried data containing the requester. ### Flock Safety - Privacy requests: privacy@flocksafety.com - Privacy policy: https://www.flocksafety.com/privacy - Mailing address: 1170 Howell Mill Rd NW, Suite 210, Atlanta, GA 30318. - Relevant in the Bend context: Bend Police operated Flock cameras under a $19,900 May 2025 contract with a $4,100 July 2025 amendment; the system was suspended January 7, 2026 and not renewed in May 2026. - Specifically ask: even after Bend's contract ended, what plate-read data remains in Flock's systems; whether that data has been shared with any other Flock customer (including federal agencies) under Flock's hot-list, transparency-portal, or LEARN-style interoperability features; and whether the requester's plate has ever appeared in a Bend-originated query or a query from any agency querying the Bend area. ### Motorola Solutions (Avigilon, Vigilant Solutions ALPR / LEARN) - Privacy requests: https://www.motorolasolutions.com/en_us/about/privacy-policy.html - Mailing address: 500 W Monroe St, Chicago, IL 60661. - Relevant in the Bend context: Vigilant LEARN is one of the largest commercial ALPR databases in the country. Even if no Bend agency directly subscribes, LEARN aggregates plate reads from many sources nationally, and Oregon plates traveling outside Oregon may be captured. ### Verkada Inc. - Privacy requests: privacy@verkada.com - Privacy policy: https://www.verkada.com/privacy/ - Mailing address: 405 E 4th Ave, San Mateo, CA 94401. - Relevant context: Verkada cameras are common in commercial deployments, including some retail and property-management settings. The platform offers facial-recognition and people-analytics features that may be enabled by the customer. ### Auror Limited - Privacy contact: privacy@auror.co - Privacy policy: https://www.auror.co/privacy-policy - Mailing address (US): 1 Sansome St, Suite 3500, San Francisco, CA 94104. - Relevant context: Auror is the retail-crime-intelligence platform several major U.S. retailers use to share images, incident reports, and "person of interest" information across stores. The Albertsons California ALPR Policy's reference to inter-retailer sharing for "organized retail crime groups" is the kind of activity that platforms like Auror enable. ### Clearview AI, Inc. - Privacy requests: privacy-requests@clearview.ai - Privacy policy: https://www.clearview.ai/privacy/privacy-policy - Mailing address: 214 W 29th St, 13th Floor, New York, NY 10001. - Relevant context: Clearview AI scrapes facial images from publicly accessible web sources and offers face-matching services primarily to law enforcement. Oregon residents whose images are anywhere on the public web are likely in the database. Clearview has settled major BIPA litigation and operates under a federal injunction restricting some commercial sales, but continues to sell to government and law enforcement customers. --- ## What to do with the response 1. **File the response.** Save the entire response, including any attachments and the email metadata. Vendor responses tend to be more useful than retailer responses because they contain audit-log information that connects private surveillance to specific police access events. 2. **Watch for "processor" deflections.** If the vendor refers you to its customers and claims it cannot honor an OCPA request as a processor, this is itself useful. Quote that response back in any subsequent OCPA request to the retailer or in a public records request to the Bend Police Department. The retailer or the police agency is then the controller, and the data is held by the vendor on the retailer's or police agency's behalf, which means the retailer or police agency must produce it. 3. **Cross-reference against the retailer response.** If the retailer's OCPA response says "we do not share with law enforcement except under legal process" but the vendor's audit log shows law enforcement access without legal process, that gap is the story. 4. **Cross-reference against the BPD public records response.** If BPD says it has no relationship with a vendor but the vendor's response shows BPD users querying the platform, that is also the story. --- ## Confidence note All ORS citations in this template have been checked against the live statute as of the date this template was prepared. Vendor contact information is L2 (verified secondary) — vendor privacy policy text last fetched on the date this template was prepared. Before sending, re-fetch the relevant vendor privacy policy to confirm the current submission channel. This template is a starting point and does not constitute legal advice. The author is not a lawyer.