Highlights

Covered Entities: An individual, private or public corporation, partnership, cooperative, association, estate, limited liability company, organization or other entity, whether or not organized to operate at a profit, or public body as defined in O.R.S. § 174.109 that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of the person’s business, vocation, occupation, or volunteer activity.

Consumer Notification: Notification must be provided to any Oregon resident whose computerized personal information was acquired without authorization.

Regulatory Notification: Notification must be provided to the Oregon Attorney General where the number of Oregon residents to be notified exceeds 250.

Notification Timeline: Notification must be provided in the most expeditious manner possible, without unreasonable delay, but not later than 45 days following discovery of a breach.

Data Format: Electronic.

Citations: O.R.S. §§ 646A.600–646A.628

More Details

Definitions:

• Breach: Unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information.
• Personal information (PI): An individual’s first name / first initial and last name in combination with one or more of the following data elements:
  • Social Security number;
  • Driver license or state identification card number issued by the Department of Transportation;
  • Passport number or other identification number issued by the United States;
  • Financial account or payment card number plus a security code, access code, or password that would permit access to a financial account, or any information or combination of information that a person reasonably knows or should know would permit access to a financial account;
  • Data from automatic measurements of a consumer’s physical characteristics, such as an image of a fingerprint, retina or iris, used to authenticate the individual’s identity in the course of a financial or other transaction;
  • Health Insurance Information, as defined below; 
  • Medical Information, as defined below;
  • A username or other means to identify the individual for the purpose of permitting account access in combination with any method necessary to authenticate the individual; or
  • Any of the listed data elements when not combined with a name if (i) the data element(s) is not rendered unusable by encryption, redaction or other methods; and (ii) the data element(s) would enable a person to commit identity theft.
• Medical Information: Any information regarding medical history, mental or physical condition, or a health care professional’s medical diagnosis or treatment.
• Health Insurance Information: A health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier used for identification by a health insurer.

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI is encrypted, if the encryption key has not been acquired, or if the PI is redacted or other methods have rendered the data elements unusable.
• Good Faith: A breach does not include an inadvertent acquisition of personal information by the covered entity, or by its employee or agent, if the information is not used in violation of applicable law or in a manner that harms or poses an actual threat to its security, confidentiality, or integrity.
• Risk of Harm: Notification is not required if, after an appropriate investigation or consultation with relevant federal, state or local law enforcement agencies, the covered entity reasonably determines that the individuals whose PI was subject to the “breach” are unlikely to suffer harm. This determination must be documented in writing and maintained for at least 5 years.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation and requests the delay in writing.
• Public Record: Personal information does not include information in a federal, state, or local government record, other than a Social Security number, that is lawfully made available to the public.

Direct Notice:

• Timing: Notification must be provided “in the most expeditious manner possible, without unreasonable delay, but not later than 45 days” following discovery of a “breach.” Before providing notice, the covered entity must undertake reasonable measures necessary to: (a) determine sufficient contact information for affected individuals; (b) determine the scope of the breach; and (c) restore the reasonable integrity, security, and confidentiality of the PI.
• Format: N/A
• Content: Notification letters must include, at a minimum, the following:
  • A general description of the breach;
  • The approximate date of the breach;
  • The type of PI that were subject to the breach;
  • Contact information for the covered entity;
  • Contact information for national consumer reporting agencies; and
  • Advice to the consumer to report suspected identity theft to law enforcement, including the Oregon Attorney General and the Federal Trade Commission.
• Method: Notice may be: (1) in writing; (2) electronically, if the covered entity customarily communicates with the Oregon resident electronically, or if the notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001; (3) by telephone, if the covered entity contacts the individual directly; or (4) by substitute notice.

Substitute Notice:

An entity may provide substitute notice if (1) the cost of direct notice would exceed $250,000; (2) the notification population exceeds 350,000; or (3) the entity does not have sufficient contact information. It must include (1) posting the notice or link to the notice conspicuously on the entity’s website; and (2) notifying major statewide television and newspaper media.

Remediation Services:

If a covered entity, agent, or affiliate offers to provide credit monitoring services or identity theft prevention and mitigation services without charge to an Oregon resident in connection with a notification made under this section, the provision of the services must not be conditioned on (1) the Oregon resident providing the entity, agent, or affiliate with a payment card number or (2) the Oregon resident’s acceptance of any other service offered by the entity for a fee. If a covered entity, agent, or affiliate offer additional remediation services for a fee under these circumstances, the covered entity, agent, or affiliate must separately, distinctly, clearly, and conspicuously disclose that the Oregon resident will be charged a fee in the offer.

Regulatory Notice:

Notification must be provided to the Oregon Attorney General where the number of Oregon residents to be notified “exceeds 250.”

Credit Reporting Agencies Notice:

Notification must be provided to all nationwide consumer reporting agencies where more than 1,000 Oregon residents are to be notified.

Third-Party Notice:

A vendor must notify the covered entity “as soon as practicable but not later than 10 days” after discovering a “breach” or having reason to believe that a “breach” occurred. Sub-vendors must notify vendors, who in turn must notify the covered entity, each in the same manner. A vendor must notify the Attorney General if the vendor was subject to a “breach” if the number of impacted Oregon residents exceeds 250 or is indeterminable.

HIPAA:

This section does not apply to a covered entity or vendor that complies with regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act of 2009, if PI that is subject to O.R.S. §§ 646A.600–646A.628 is also subject to those Acts. Notwithstanding the above, a covered entity or vendor must provide the Oregon Attorney General with at least one copy of any notice sent to the primary or functional regulator if the “breach” affects more than 250 Oregon residents within a reasonable time.

Private Action:

The Oregon Consumer Information Protection Act does not expressly create a standalone private cause of action. A violation constitutes an unlawful practice under ORS 646.607, and the statutory rights and remedies are cumulative and additional to other remedies available under law.

Associated Regulations:

• Information Security Standard (Or. Rev. Stat. §§ 646A.622, 646A.602, 646A.624)
• Oregon Consumer Privacy Act (OCPA)
• Or. Admin. Code § 441-646-0020

Oregon Consumer Privacy Act

Enrolled Senate Bill 619, as amended by 2025 Oregon Laws Chapter 163 (H.B. 3875) and 2025 Oregon Laws Chapter H.B. 2008

Highlights

Applicability:

Any person that conducts business in Oregon or that provides products or services to Oregon residents, and controls or processes the personal data of:

• At least 100,000 consumers other than personal data controlled or processed solely for the purpose of completing a payment transaction; or
• 25,000 or more consumers, while deriving at least 25% of its annual gross revenue from selling personal data.

The OCPA also applies to a motor vehicle manufacturer, and any affiliate of a motor vehicle manufacturer, that controls or processes any personal data obtained from a consumer’s use of a motor vehicle or any component of a motor vehicle, subject to the OCPA’s statutory exemptions.

Among other exemptions, the OCPA excludes:

• A public corporation, including Oregon Health and Science University and the Oregon State Bar, or a public body as defined under Oregon law;
• Activities related to evaluating a consumer’s creditworthiness or personal information conducted in accordance with the provisions of the Fair Credit Reporting Act (“FCRA”);
• Financial institutions or their affiliates or subsidiaries that are only and directly engaged in financial activities;
• Protected health information processed by a covered entity or business associate in accordance with HIPAA; documents created by a covered entity or business associate for purposes of complying with HIPAA; information used only for public-health activities and purposes described in 45 C.F.R. § 164.512; certain human-subjects research information; patient-identifying information processed in accordance with 42 C.F.R. Part 2; patient safety work product; Health Care Quality Improvement Act information; and certain information that originates from, or is intermingled with, exempt health-related information and is maintained in the required manner;
• Information processed or maintained solely in connection with, and for the purpose of enabling, an individual’s employment or application for employment; ownership of, or service as a director or officer of, a business entity; contractual relationship with a business entity; receipt of employer benefits, including benefits for dependents or beneficiaries; or emergency contact notice;
• Insurers, insurance producers, insurance consultants, and third-party administrators, subject to the statutory definitions and limitations. ;ofit organizations focused on detecting and preventing insurance fraud, and those that provide programing to radio or television networks;
• Nonprofit organizations established to detect and prevent fraudulent acts in connection with insurance;
• Noncommercial activities of individuals connected to newspapers, magazines, periodicals, newsletters, pamphlets, reports, or other publications in general circulation; and
• Noncommercial activities of entities that provide information services (such as radio or television stations) including press associations and wire services, and noncommercial activities of radio or television stations that hold FCC licenses or nonprofit organizations that provide programming to radio or television networks.
• Information collected, processed, sold, or disclosed in accordance with the GLBA, DPPA, or FERPA.

The OCPA now applies to nonprofit organizations, with certain exceptions. The delayed effective date for 501(c)(3) nonprofit organizations expired on July 1, 2025, as such covered nonprofit organizations are subject to the OCPA unless a statutory exemption applies.

Covered Entity Obligations:

Controllers¹.  OCPA controller duties include obligations to:

• Provide a reasonably accessible, clear and meaningful privacy notice, specifying the express purposes for which the controller is collecting and processing personal data;
• Limit the collection of personal data to only the personal data that is adequate, relevant and reasonably necessary to serve the purposes of the processing specified in the controller’s privacy notice;
• Establish a secure and reliable means for consumers to exercise their privacy rights under the law, taking into account the ways in which consumers normally interact with the controller, the need for security and reliability in request-related communications, and the controller’s ability to authenticate the consumer;
• Obtain a consumer’s consent to process sensitive data or, if the controller knows the consumer is a child, process the sensitive data in accordance with COPRA;
• Enter into contracts with its processors that govern the processing procedures for personal data processed on the controller’s behalf and satisfy the processor-contract requirements of the OCPA;
• Conduct and document data protection assessments before engaging in processing activities that present a heightened risk of harm to a consumer, including processing for targeted advertising, selling personal data, processing sensitive data, and using personal data for profiling where the profiling presents a reasonably foreseeable risk of specified harms;
• Establish, implement and maintain safeguards to protect personal data, such that the controller’s safeguards protect the confidentiality, integrity and accessibility of the personal data to the extent appropriate for the volume and nature of the personal data;
• Not discriminate against a consumer for exercising any rights granted by the OCPA; 
• Provide an effective means by which a consumer may revoke consent they previously provided.
• Process personal data for purposes that are not reasonably necessary for, and compatible with, the purposes specified in the privacy notice only with the consumer’s consent; 
• Not process a consumer’s personal data for targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects if the controller has actual knowledge that, or willfully disregards whether, the consumer is under sixteen (16) years of age;
• Not sell personal data that pertains to a consumer if the controller has actual knowledge that, or willfully disregards whether, the consumer is under sixteen (16) years of age;
• Not sell personal data that accurately identifies, within a radius of 1,750 feet, a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer, by means of technology including GPS latitude-and-longitude coordinates. This prohibition does not include the content of communications or data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility;
• Provide a clear and conspicuous link to a webpage where the consumer or authorized agent may opt out of processing for targeted advertising, sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects, or, if the controller lacks the capacity to link to a webpage, provide another opt-out method; and
• Allow a consumer or authorized agent to send an opt-out preference signal to opt out of the sale of personal data or targeted advertising, using a platform, technology, or mechanism that satisfies the OCPA’s statutory specifications.

Processors.  OCPA processor duties include obligations to:

• Adhere to the instructions of a controller and assist the controller in meeting the controller’s obligations under the OCPA.
• Assist the controller in meeting its OCPA obligations, including:
  • Enable the controller to respond to consumer requests by appropriate technical and organizational measures, insofar as it is reasonably practicable;
  • Adopt administrative, technical and physical safeguards that are reasonably designed to protect the security and confidentiality of the personal data the processor processes; and assist the controller in meeting the controller’s security obligations under the OCPA.
  • Provide information reasonably necessary for the controller to conduct and document data protection assessments.
• Enter into a written contract with the controller that governs the processor’s procedures for processing personal data on behalf of the controller and specifies the processing instructions to which the processor is bound, including the nature and purpose of the processing, the type of personal data subject to processing, the duration of the processing, and the rights and obligations of both parties. The contract must also require that each person processing personal data is subject to a duty of confidentiality, require deletion or return of personal data at the controller’s direction at the end of the provision of services unless retention is required by law, require the processor to make available information necessary to demonstrate compliance, and permit required assessments of the processor’s policies and technical and organizational measures.
• Enter into written agreements with any subcontractors engaged to assist with processing personal data on the controller’s behalf which meet the obligations of the processor under the contract with the controller that require the subcontractor to satisfy the processor’s obligations with respect to personal data under the processor’s contract with the controller.
• Recognize that determining whether a person is acting as a controller or processor is a fact-based determination that depends on the context in which personal data is processed. A processor that follows a controller’s instructions with respect to a specific processing activity remains a processor. A processor that determines the purposes and means for processing personal data, alone or jointly with another person, is a controller with respect to that processing.

Consumer Rights:

Controllers must respond without undue delay and within 45 days to verified consumer requests regarding the processing of personal data and sensitive data, including consumers’:

• Right to request deletion of personal data;
• Right to access personal data;
• Right to obtain personal data in a format that is generally portable, readily usable, and transmittable;
• Right to correct inaccurate personal data;
• Right to opt out of personal data processing for the purposes of sale, targeting advertising, or profiling for decisions producing legal or other significant effects;
• Right to obtain the following from a controller:
  
  • Confirmation that the controller is processing or has processed the consumer’s personal data and the categories of personal data that has been or is being processed;
  • At the controller's option, a list of the specific third parties, other than natural persons, to which the controller has disclosed the consumer’s personal data; and
  • A copy of the personal data that the controller has processed or is processing.
• A controller is not required to disclose trader secrets in responding to a consumer request.
• Consumers must exercise these rights by submitting a request using the method specified in the controller’s privacy notice. A controller may not require a consumer to create an account to exercise rights, but may require use of an account the consumer previously created.A parent or legal guardian may exercise these rights on behalf of the parent’s child or a child for whom the guardian has legal responsibility, and a guardian or conservator may exercise these rights on behalf of a consumer subject to a guardianship, conservatorship, or other protective arrangements.
• A controller may extend the 45-day response period by an additional 45 days if reasonably necessary, taking into account the complexity of the request and number of requests. The controller must inform the consumer of the extension within the initial 45-day period and explain the basis for the extension.
• A controller must provide requested information free of charge once during any 12-month period. A controller may charge a reasonable administrative fee for a second or subsequent request within that period unless the request is to verify that the controller corrected inaccuracies in, or deleted, the consumer’s personal data in compliance with a prior request.
• A controller must comply with opt-out requests without requiring authentication, but may request additional information necessary to comply with the request and may deny an opt-out request if the controller has a good-faith, reasonable, and documented belief that the request is fraudulent and notifies the consumer accordingly.
• If a controller declines to act on a consumer request, the controller must notify the consumer without undue delay and not later than 45 days after receiving the request, explain the justification for declining to act, and provide instructions for appealing the decision. The controller must establish an appeal process that is conspicuously available and substantially similar to the process for submitting consumer requests.

More Details

Definitions:

• Child: An individual under the age of 13.
• Consent: An affirmative act by which a consumer clearly and conspicuously communicates the consumer’s freely given, specific, informed and unambiguous assent to another person’s act or practice, provided that the user interface used to obtain consent does not have any mechanism that has the purpose or substantial effect of obscuring, subverting or impairing the consumer’s autonomy, decision-making or choice, and provided that a consumer’s inaction does not constitute consent.
• Consumer: A natural person who resides in Oregon and acts in any capacity other than in a commercial or employment context.
• Controller: A person that, alone or jointly with others, determines the purposes and means for processing personal data.
• Decisions that produce legal effects or effects of similar significance: Decisions that result in providing or denying financial or lending services, housing, insurance, enrollment in education or educational opportunity, criminal justice, employment opportunities, health care services, or access to essential goods and services.
• Deidentified Data: Data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable consumer, or to a device that identifies, is linked to or is reasonably linkable to a consumer; or certain patient-derived data deidentified in accordance with HIPAA.
• Personal Data: Data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household. Personal data excludes: de-identified data or data that (a) is lawfully available through federal, state, or local government records or through widely distributed media; or (b) a controller reasonably has understood to have been lawfully made available to the public by a consumer.
• Profiling: An automated processing of personal data for the purpose of evaluating, analyzing, or predicting an identified or identifiable consumer’s economic circumstances, health, personal preferences, interests, reliability, behavior, location, or movements.
• Processor: A person that processes personal data on behalf of a controller.
• Sale of Personal Data: The exchange of personal data for monetary or other valuable consideration by the Controller to a third party. The OCPA excludes the following disclosures from this definition:
  
  • A disclosure of personal data to a processor;
  • A disclosure of personal data to an affiliate of the controller or to a third party for the purpose of enabling the controller to provide a product or service to a consumer that requested the product or service;
  • A disclosure or transfer of personal data from a controller to a third-party as an asset in a proposed or completed merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets, including the personal data;
  • A disclosure occurring because a consumer: (i) directs the controller to conduct the disclosure; (ii) intentionally discloses personal data in the course of directing a controller to interact with a third party; or (iii) intentionally discloses the personal data to the public by means of mass media, if the disclosure is not restricted to a specific audience.
• Sensitive Data: Personal data that: (i) reveals a consumer’s racial or ethnic background, national origin, religious beliefs, mental/physical health condition or diagnosis, sexual orientation, status as transgender or non-binary, status as a victim of a crime, or citizenship/immigration status; (ii) is a child’s personal data; (iii) accurately identifies within a radius of 1,750 feet of a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, GPS providing latitude and longitude coordinates; or (iv) is genetic or biometric data. Sensitive data under clause (iii) does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
• Targeted Advertising: Advertising that is selected for display to a consumer on the basis of personal data obtained from the consumer’s activities over time and across one or more unaffiliated websites or online applications and used to predict the consumer’s preferences or interests. Targeted advertising does not include advertisements based on activities within a controller’s own websites or online applications; advertisements based on the context of a consumer’s current search query, visit to a specific website, or use of an online application; advertisements directed to a consumer in response to the consumer’s request for information or feedback; or processing personal data solely to measure or report an advertisement’s frequency, performance, or reach.
• Third Party: A person, public corporation, or public body other than a consumer, controller, processor, or affiliate of a controller or processor.

Penalties:

Violations of the OCPA may be enforced exclusively by the Oregon Attorney General. As of January 1, 2026, the statutory cure period has expired, and the Attorney General is no longer required to provide notice and an opportunity to cure before bringing an enforcement action. The Attorney General may seek an injunction, a $7,500 civil penalty per violation, reasonable attorney fees, costs, and other equitable relief.

Private Action:

None.

Enforcement Action: 

The DOJ had received 214 consumer privacy complaints, of which 130 passed initial screening as OCPA-related. From the remaining OCPA-relevant complaints, the DOJ initiated and closed 38 OCPA cure-letter matters as of July 1, 2025. The DOJ reported that many matters involved deficient privacy notices, missing or burdensome consumer-rights mechanisms, and issues with webforms, including forms that did not list Oregon or did not provide all OCPA rights. Data brokers were a particular focus, accounting for 62 consumer complaints, and deletion requests were the most common rights-request issue.

Associated Regulations & Rulemaking:

None.

Notes on AI Related Regulation:

The OCPA gives consumers rights that often involve AI systems including the right to opt out of profiling in furtherance of decisions that produce legal effects or effects of similar significance, and requires controllers to conduct data protection assessments for processing activities that present a heightened risk of harm to consumers, including targeted advertising, sale of personal data, sensitive data processing, and certain profiling activities.

Effective Date:

Amendments effective January 1, 2026.

¹ Amendments effective January 1, 2026.

Highlights

Covered Entities: A person that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information (“PI”) in the course of the person’s business, vocation, occupation or volunteer activities.

First Party Security Standard: A covered entity and a vendor shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of PI, including safeguards that protect the PI when the covered entity or vendor disposes of it.

Third Party Security Standard: A business that discloses PI about an Oregon resident pursuant to a contract with a nonaffiliated vendor must require by contract that the vendor implement and maintain reasonable security procedures and practices to protect the PI.

Disposal/Destruction Standard: A covered entity or vendor must take reasonable steps to dispose, or arrange for the disposal, of PI when they are no longer to be retained by the business by (a) burning, (b) pulverizing, (c) shredding or (d) modifying a physical record and by destroying or erasing electronic media so that the PI cannot be read or reconstructed.

Data Format: Electronic and physical.

Citations: Or. Rev. Stat. §§ 646A.622, 646A.602, 646A.624

More Details

Definitions:

• Person: An individual, private or public corporation, partnership, cooperative, association, estate, limited liability company, organization or other entity, whether or not organized to operate at a profit, or a public body as defined in ORS § 174.109.
• Personal Information (PI): A consumer’s first name / first initial and last name in combination with one or more of the following data elements, if encryption, redaction, or other methods have not rendered the data elements unusable:
  
  • Social Security number;
  • Driver license or state identification card number issued by the Department of Transportation;
  • Passport number or other identification number issued by the United States;
  • Financial account or payment card number plus a security code, access code, or password that would permit access to a financial account, or any information or combination of information that a person reasonably knows or should know would permit access to a financial account;
  • Data from automatic measurements of a consumer’s physical characteristics, such as an image of a fingerprint, retina or iris, used to authenticate the individual’s identity in the course of a financial or other transaction;
  • Health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the consumer;
  • Any information about a consumer's medical history or mental or physical condition or about a health care professional's medical diagnosis or treatment of the consumer;

A user name or other means of identifying a consumer for the purpose of permitting access to the consumer’s account, together with any other method necessary to authenticate the user name or means of identification; or

Any of the listed data elements when not combined with a name if (i) the data element(s) is not rendered unusable by encryption, redaction or other methods; and (ii) the data element(s) would enable a person to commit identity theft.

PI does not include information in a federal, state or local government record, other than a Social Security number, that is lawfully made available to the public.

• Small Business: A business having 100 or fewer employees.
• Vendor: A person with which a covered entity contracts to maintain, store, manage, process, or otherwise access PI for the purpose of, or in connection with, providing services to or on behalf of the covered entity.

Methods of Compliance:

The statute defines the following as reasonable security procedures and practices:

• Complies with a state or federal law that provides greater protection to PI than the protections granted here.
• Complies with Title V of the Gramm-Leach-Bliley Act of 1999 (“GLBA”), if PI is also subject to the GLBA.
• Complies with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), if PI is also subject to HIPAA and/or HITECH.
• Implements an information security program that includes:
  
  • Administrative safeguards such as:
    
    • Designating one or more employees to coordinate the security program;
    • Identifying reasonably foreseeable risks with reasonable regularity;
    • Assessing whether existing safeguards adequately control the identified risks;
    • Training employees in security program practices and procedures regularly;
    • Selecting service providers capable of maintaining appropriate safeguards and practices, and requiring the service providers by contract to maintain the safeguards and practices;
    • Adjusting the security program in light of business changes, potential threats or new circumstances; and
    • Reviewing user access privileges with reasonable regularity;
  • Technical safeguards such as:
    
    • Assessing and timely addressing risks and vulnerabilities in network and software design;
    • Applying security updates and a reasonable security patch management program to software that might reasonably be at risk of or vulnerable to a breach of security;
    • Monitoring, detecting, preventing and responding to attacks or system failures; and
    • Regularly testing, monitoring and taking action to address the effectiveness of key controls, systems and procedures; and
  • Physical safeguards such as:
    
    • Assessing risks of information collection, storage, usage, retention, access and disposal and implementing reasonable methods to remedy or mitigate identified risks;
    • Monitoring, detecting, preventing, isolating and responding to intrusions timely and with reasonable regularity;
    • Protecting against unauthorized access to or use of PI in the covered entity’s possession or that is its responsibility; and
    • Disposing of PI, whether the covered entity or vendor disposes of the PI on or off the covered entity’s or vendor’s premises or property, after the covered entity or vendor no longer needs the PI for business purposes or as required law by burning, pulverizing, shredding or modifying a physical record and by destroying or erasing electronic media so that the PI cannot be read or reconstructed.
• The covered entity or vendor contracts with another person engaged in the business of record destruction to dispose of PI in a manner that is consistent with these requirements.
• A person that is an owner of a small business (a business with 100 or fewer employees) is compliant if the PI security and disposal program contains administrative, technical and physical safeguards and disposal measures that are appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information the small business collects from or about consumers.

Exclusions:

N/A

Enforcement/Penalties:

Any covered entity or vendor who violates, or who procures, aids, or abets in the violation of this statute is subject to a penalty not to exceed $1,000 per violation. Every violation is a separate offense and, in the case of a continuing violation, each day’s continuance is a separate violation, but the maximum penalty for any occurrence must not exceed $500,000.

Associated Regulations:

Oregon Revised Statutes, ORS 646A.602, Definitions for ORS 646A.600 to 646A.628

Oregon Revised Statutes, ORS 285B.123, Purpose

Oregon Revised Statutes, ORS 646A.578(1)(c) (requiring covered controllers to establish, implement, and maintain safeguards for personal data).