U.S. Oregon ORS 646A — Consumer Information Protection Act

Why does it matter?

The act sets fixed clocks: a covered entity notifies consumers in the most expeditious manner possible and no later than 45 days after discovering or being told of a breach, and a vendor tells the covered entity within ten days (ORS 646A.604(2)(a), (3)(a)). Personal information is wide, taking in passport numbers, biometric authentication data, health insurance numbers, medical history and online credentials, and any of those elements without a name if they would enable identity theft (ORS 646A.602(12)). Enforcement is doubled: a violation is an unlawful practice under ORS 646.607 for the Attorney General, and the Department of Consumer and Business Services can fine up to $1,000 per violation, each day a separate violation, up to $500,000 per occurrence (ORS 646A.624(4)).

Key benefits include:

• A 45-day consumer notice

Notice goes to each affected consumer in the most expeditious manner possible, without unreasonable delay and not later than 45 days after discovery or notification, delayed only on a law enforcement agency's written request (ORS 646A.604(3)).

• Attorney General and credit bureau notices

The Attorney General is notified when more than 250 consumers must be told, and nationwide consumer reporting agencies when more than 1,000 are affected (ORS 646A.604(1)(b), (6)).

• Vendor duties in the statute

A vendor notifies the covered entity within ten days of discovering a breach and notifies the Attorney General itself when more than 250 consumers, or an undeterminable number, are involved (ORS 646A.604(2)).

• A safeguards program the statute describes

ORS 646A.622(2)(d) lists the administrative, technical and physical safeguards that satisfy the duty, from a designated coordinator and patch management to destruction of records at disposal.

• Credit for federal programs

Compliance with a primary federal regulator's breach rules, Gramm-Leach-Bliley Act Title V regulations or the HIPAA and HITECH rules satisfies the notice and safeguards duties, with a copy of any notice still sent to the Attorney General above 250 consumers (ORS 646A.604(9), (10); 646A.622(2)).

How does it work?

ORS 646A.602 defines the terms. A covered entity is a person that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of business, vocation, occupation or volunteer activities, except where it acts solely as a vendor; a vendor is a person a covered entity contracts with to maintain, store, manage, process or access personal information in providing services to it. A breach of security is an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information, excluding an inadvertent acquisition that is not misused. Personal information is a consumer's name with a Social Security, driver license, state ID, passport or other federal identification number, a financial account or card number with any required code, biometric authentication data, a health insurance number or medical information; online credentials; or those elements without the name if they would enable identity theft.

ORS 646A.604 sets the notice duty. A covered entity that suffers a breach or receives a vendor's notice notifies each affected consumer and, above 250 consumers, the Attorney General (subsection (1)); a vendor notifies the covered entity within ten days and the Attorney General above 250 consumers (subsection (2)). Notice is given in the most expeditious manner possible and not later than 45 days after discovery, after reasonable measures to identify recipients, determine the scope and restore integrity, delayed only on a law enforcement agency's written request (subsection (3)). It may be written, electronic, by telephone or, above $250,000 in cost or 350,000 consumers, by substitute notice (subsection (4)), and carries the six contents in subsection (5), from a general description of the breach to advice to report suspected identity theft to law enforcement, the Attorney General and the Federal Trade Commission. Nationwide consumer reporting agencies are notified above 1,000 consumers (subsection (6)); no consumer notice is needed where an investigation finds harm unlikely, documented and kept five years (subsection (8)).

ORS 646A.622(1) requires every covered entity and vendor to develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of personal information, including at disposal. Subsection (2) deems the duty met by complying with a stricter state or federal law, Gramm-Leach-Bliley Act Title V regulations or the HIPAA and HITECH rules, or by an information security program with administrative safeguards (a coordinator, regular risk identification, safeguard assessment, training, service providers bound by contract, program adjustment, review of user access privileges), technical safeguards (network and software risk assessment, security updates and patch management, monitoring and response to attacks, testing of key controls) and physical safeguards (collection-to-disposal risk assessment, intrusion response, life-cycle protection, and disposal by burning, pulverizing, shredding or modifying records and destroying or erasing media). A small business under ORS 285B.123(2) meets a scaled standard (subsection (5)). ORS 646A.624 gives the Director of the Department of Consumer and Business Services investigation, subpoena, cease-and-desist and compensation powers and the penalties.

Key Elements

• Covered entity and vendor (ORS 646A.602(5), (19))

Any person, including a public body, that possesses personal information in the course of business, vocation, occupation or volunteer activities; a vendor maintains, stores, manages, processes or accesses it under contract to a covered entity and carries its own notice and safeguards duties.

• Personal information (ORS 646A.602(12))

Name plus Social Security, driver license or state ID, passport or other federal ID, financial account or card number with code, biometric authentication data, health insurance number, or medical information; online credentials; or those elements without a name if they would enable identity theft; encrypted or redacted data is excluded unless the key was taken.

• Breach of security (ORS 646A.602(1))

An unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information; an inadvertent acquisition that is not used unlawfully or harmfully is not a breach.

• Notice duty (ORS 646A.604)

Consumers within 45 days; the Attorney General above 250 consumers; nationwide consumer reporting agencies above 1,000; vendor to covered entity within ten days; prescribed methods, substitute notice thresholds and contents; a documented no-harm determination kept five years.

• Reasonable safeguards (ORS 646A.622)

A duty on covered entities and vendors alike, satisfied by a stricter law, GLBA Title V regulations, the HIPAA and HITECH rules, or the listed administrative, technical and physical safeguards, with a scaled standard for small businesses.

• Enforcement (ORS 646A.604(11), 646A.624)

A violation is an unlawful practice under ORS 646.607 enforced by the Attorney General; the Department of Consumer and Business Services may investigate, order cease and desist or compensation, and impose up to $1,000 per violation and $500,000 per occurrence; remedies are cumulative.

What does it cover?

ORS 646A.600 to 646A.628 apply to any covered entity or vendor that possesses personal information about a consumer, defined as an individual resident of Oregon (ORS 646A.602(2)), in the course of business, vocation, occupation or volunteer activities; a person includes individuals, companies, nonprofits and public bodies as defined in ORS 174.109 (646A.602(11)). The breach provisions cover computerized data; the safeguards duty covers personal information through disposal. Persons that comply with their primary federal regulator's breach rules, Gramm-Leach-Bliley Act Title V regulations or the HIPAA and HITECH rules are exempt from the notice section but still send the Attorney General a copy of any notice above 250 consumers (ORS 646A.604(9), (10)). The same act contains the security freeze provisions (ORS 646A.606 to 646A.618) and the limits on displaying Social Security numbers (ORS 646A.620).

What are its objectives?

The act's objectives follow from its title, its definitions and the duties it imposes on covered entities and vendors.

Tell every affected Oregon consumer about a breach of their personal information within 45 days, with the information needed to protect against identity theft.

Keep the Attorney General and, for larger breaches, the nationwide consumer reporting agencies informed.

Make vendors that hold personal information for others notify promptly and keep their own safeguards.

Require reasonable administrative, technical and physical safeguards, through disposal, scaled to the business.

Give consumers the security freeze and Social Security number protections in ORS 646A.606 to 646A.620.

Framework in Context

The Consumer Information Protection Act is Oregon's data security and breach notification law; Oregon's separate Consumer Privacy Act governs how controllers process personal data and the rights consumers have over it, and a business that is both a controller and a covered entity meets both. The act defers to federal regimes where they apply: covered entities and vendors that comply with Gramm-Leach-Bliley Act Title V regulations or the HIPAA and HITECH rules are deemed to satisfy ORS 646A.622 and are exempt from the notice section, except for the copy owed to the Attorney General (ORS 646A.604(9), (10)). The Oregon Department of Justice publishes the breach reporting form and a searchable database of the notices it receives; the ORS 646A.622(2)(d) safeguards list shares its administrative, technical and physical structure with those federal programs.

Common Framework Mappings

Organizations map the ORS 646A.622 safeguards and the ORS 646A.604 notice duties to the frameworks below so that one control set and one incident process serve Oregon, their federal regulators and their auditors.

Mapped frameworks include:

CIS Controls v8.1

GDPR

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2