(2) A consumer may not be required to procure for the purpose of acquiring or purchasing a marijuana item a piece of identification other than:
(a) A piece of identification described in ORS 475C.217; and
(b) If the consumer is a registry identification cardholder, as defined in ORS 475C.777, a registry identification card, as defined in ORS 475C.777.
(3) A marijuana retailer may not record and retain any information that may be used to identify a consumer, except as necessary to make deliveries to consumers pursuant to ORS 475C.117, as required by any rules adopted under ORS 475C.117.
(4) A marijuana retailer may not transfer any information that may be used to identify a consumer to any other person.
(5)(a) Notwithstanding subsection (3) of this section, a marijuana retailer may record and retain the name and contact information of a consumer for the purpose of notifying the consumer of services that the marijuana retailer provides or of discounts, coupons and other marketing information if:
(A) The marijuana retailer asks the consumer whether the marijuana retailer may record and retain the information; and
(B) The consumer consents to the recording and retention of the information.
(b) This subsection does not authorize a marijuana retailer to transfer information that may be used to identify a consumer.
(6) This section does not apply to deidentified information the documentation and transfer of which is required by the Department of Revenue for purposes of ORS 475C.678. [Formerly 475B.220]