(2) A consumer may not be required to procure for the purpose of acquiring or purchasing a marijuana item a piece of identification other than:

(a) A piece of identification described in ORS 475B.216; and

(b) If the consumer is a registry identification cardholder, as defined in ORS 475B.791, a registry identification card, as defined in ORS 475B.791.

(3) A marijuana retailer may not record and retain any information that may be used to identify a consumer, except as necessary to make deliveries to consumers pursuant to ORS 475B.206 (3), as required by any rules adopted under ORS 475B.206 (3).

(4) A marijuana retailer may not transfer any information that may be used to identify a consumer to any other person.

(5)(a) Notwithstanding subsection (3) of this section, a marijuana retailer may record and retain the name and contact information of a consumer for the purpose of notifying the consumer of services that the marijuana retailer provides or of discounts, coupons and other marketing information if:

(A) The marijuana retailer asks the consumer whether the marijuana retailer may record and retain the information; and

(B) The consumer consents to the recording and retention of the information.

(b) This subsection does not authorize a marijuana retailer to transfer information that may be used to identify a consumer.

(6) This section does not apply to deidentified information the documentation and transfer of which is required by the Department of Revenue for purposes of ORS 475B.707. [2017 c.18 §2; 2017 c.476 §16]