Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/heading

Consumer Data Privacy and Online Monitoring

core/paragraph

Available at: <a href="https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled">https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled</a>

Data Breach Requirements: Or. Rev. Stat. <a>§</a> 646A.600 et seq.

The numbering and internal citations herein are derived from the applicable state statute.

The term “personal information” means: (A) A consumer’s first name or first initial and last name in combination with any one or more of the following data elements, if encryption, redaction or other methods have not rendered the data elements unusable or if the data elements are encrypted and the encryption key has been acquired: (i) A consumer’s Social Security number; (ii) A consumer’s driver’s license number or state identification card number issued by the Department of Transportation; (iii) A consumer’s passport number or other identification number issued by the United States; (iv) A consumer’s financial account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to a consumer’s financial account, or any other information or combination of information that a person reasonably knows or should know would permit access to the consumer’s financial account; (v) Data from automatic measurements of a consumer’s physical characteristics, such as an image of a fingerprint, retina or iris, that are used to authenticate the consumer’s identity in the course of a financial transaction or other transaction; (vi) A consumer’s health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the consumer; or (vii) Any information about a consumer’s medical history or mental or physical condition or about a health care professional’s medical diagnosis or treatment of the consumer. (B) A username or other means of identifying a consumer for the purpose of permitting access to the consumer’s account, together with any other method necessary to authenticate the username or means of identification. (C) Any of the data elements or any combination of the data elements described in subparagraph (A) or (B) of this paragraph without the consumer’s username, or the consumer’s first name or first initial and last name, if: (i) Encryption, redaction or other methods have not rendered the data element or combination of data elements unusable; and (ii) The data element or combination of data elements would enable a person to commit identity theft against a consumer.

core/separator

The term “breach of security” means an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains or possesses.

A “breach of security” does not include an inadvertent acquisition of personal information by a person or the person’s employee or agent if the personal information is not used in violation of applicable law or in a manner that harms or poses an actual threat to the security, confidentiality or integrity of the personal information.

A covered entity does not need to notify consumers of a breach of security if, after an appropriate investigation or after consultation with relevant federal, state or local law enforcement agencies, the covered entity reasonably determines that the consumers whose personal information was subject to the breach of security are unlikely to suffer harm. The covered entity must document the determination in writing and maintain the documentation for at least five years.

A covered entity shall give notice of a breach of security in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security.

A covered entity may delay giving the breach notice only if a law enforcement agency determines that a notification will impede a criminal investigation and if the law enforcement agency requests in writing that the covered entity delay the notification.

A data breach notice must include, at a minimum: (a) A description of the breach of security in general terms; (b) The approximate date of the breach of security; (c) The type of personal information that was subject to the breach of security; (d) Contact information for the covered entity; (e) Contact information for national consumer reporting agencies; and (f) Advice to the consumer to report suspected identity theft to law enforcement, including the attorney general and the Federal Trade Commission.

A breach notice may be provided by one of the following methods: (a) In writing; (b) Electronically, if the covered entity customarily communicates with the consumer electronically or if the notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); (c) By telephone, if the covered entity contacts the affected consumer directly; or (d) With substitute notice, if the covered entity demonstrates that the cost of notification otherwise would exceed $250,000 or that the affected class of consumers exceeds 350,000, or if the covered entity does not have sufficient contact information to notify affected consumers.

(A) Posting the notice or a link to the notice conspicuously on the covered entity’s website if the covered entity maintains a website; and

(B) Notifying major statewide television and newspaper media.

A breach notification shall be provided to the attorney general, either in writing or electronically, if the number of consumers to whom the covered entity must send the notice exceeds 250. A covered entity shall give notice of a breach of security in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security.

If a covered entity discovers or receives notice of a breach of security that affects more than 1,000 consumers, the covered entity shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain reports on consumers on a nationwide basis of the timing, distribution and content of the notice the covered entity gave to affected consumers. It shall include any police report number assigned to the breach of security. A covered entity may not delay notifying affected consumers of a breach of security in order to notify consumer reporting agencies.

The law does not apply to: (a) Personal information that is subject to, and a person that complies with, notification requirements or procedures for a breach of security that the person’s primary or functional federal regulator adopts, promulgates or issues in rules, regulations, procedures, guidelines or guidance, if the personal information and the person would otherwise be subject to ORS 646A.600 to 646A.628. (b) Personal information that is subject to, and a person that complies with, a state or federal law that provides greater protection to personal information and disclosure requirements at least as thorough as the protections and disclosure requirements provided under this section. (c) A covered entity or vendor that complies with regulations promulgated under Title V of the Gramm-Leach-Bliley Act, as that Act existed on January 1, 2020, if personal information that is subject to ORS 646A.600 to 646A.628 is also subject to that Act. (d) A covered entity or vendor that complies with regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (HITECH), as those acts existed on January 1, 2020, if personal information that is subject to ORS 646A.600 to 646A.628 is also subject to those acts.

Notwithstanding these exemptions, a person, a covered entity or a vendor shall provide to the attorney general within a reasonable time at least one copy of any notice the person, the covered entity or the vendor sends to consumers or to the person’s, the covered entity’s or the vendor’s primary or functional regulator in compliance with this section or with other state or federal laws or regulations that apply to the person, the covered entity or the vendor as a consequence of a breach of security, if the breach of security affects more than 250 consumers.

(a) A vendor that discovers a breach of security or has reason to believe that a breach &nbsp;has occurred shall notify a covered entity with which the vendor has a contract as soon as is practicable but not later than ten days after discovering the breach or having a reason to believe that the breach occurred.

(b) If a vendor has a contract with another vendor that, in turn, has a contract with a covered entity, the vendor shall notify the other vendor of a breach of security as provided in paragraph (a) of this subsection. (c) A vendor shall notify the attorney general in writing or electronically if the vendor was subject to a breach of security that involved the personal information of more than 250 consumers or a number of consumers that the vendor could not determine. The stipulations in this paragraph do not apply to the vendor if the covered entity described in paragraph (a) or (b) of this subsection has notified the attorney general in accordance with the requirements of this section.

Before providing the breach notice, a covered entity shall undertake reasonable measures that are necessary to: (A) Determine sufficient contact information for the intended recipient of the notice; (B) Determine the scope of the breach of security; and (C) Restore the reasonable integrity, security and confidentiality of the personal information.

(a) If a covered entity must notify a consumer of a breach of security under this section, and in connection with the notification the covered entity or an agent or affiliate of the covered entity offers to provide credit monitoring services or identity theft prevention and mitigation services without charge to the consumer, the covered entity, the agent or the affiliate may not condition the provision of the services on the consumer’s providing the covered entity, the agent or the affiliate with a credit or debit card number or on the consumer’s acceptance of any other service the covered entity offers to provide for a fee. (b) If a covered entity or an agent or affiliate of the covered entity offers additional credit monitoring services or identity theft prevention and mitigation services for a fee to a consumer under the circumstances described in paragraph (a) of this subsection, the covered entity, the agent or the affiliate must separately, distinctly, clearly and conspicuously disclose in the offer for the additional credit monitoring services or identity theft prevention and mitigation services that the covered entity, the agent or the affiliate will charge the consumer a fee. (c) The terms and conditions of any contract under which one person offers or provides credit monitoring services or identity theft prevention and mitigation services on behalf of another person under the circumstances described in paragraph (a) of this subsection must require compliance with the requirements of paragraphs (a) and (b) of this subsection.

Data Disposal and Security: Or. Rev. Stat. §§ 646A.602, 646A.622 and 285B.123.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal information” means: (A) A consumer’s first name or first initial and last name in combination with any one or more of the following data elements, if encryption, redaction or other methods have not rendered the data elements unusable or if the data elements are encrypted and the encryption key has been acquired. A consumer’s: (i) Social Security number; (ii) Driver license number or state identification card number issued by the Department of Transportation; (iii) Passport number or other identification number issued by the United States; (iv) Financial account, credit, or debit card number, in combination with any required security code, access code or password that would permit access to a consumer’s financial account, or any other information or combination of information that a person reasonably knows or should know would permit access to the consumer’s financial account; (v) Data from automatic measurements of a consumer’s physical characteristics, such as an image of a fingerprint, retina or iris, that are used to authenticate the consumer’s identity in the course of a financial transaction or other transaction; (vi) Health insurance policy number or health insurance subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the consumer; or (vii) Any information about a consumer’s medical history or mental or physical condition or about a health care professional’s medical diagnosis or treatment of the consumer. (B) Username or other means of identifying a consumer for the purpose of permitting access to the consumer’s account, together with any other method necessary to authenticate the username or means of identification. (C) Any of the data elements or any combination of the data elements described in subparagraph (A) or (B) of this paragraph without the consumer’s username, or the consumer’s first name or first initial and last name, if: (i) Encryption, redaction or other methods have not rendered the data element or combination of data elements unusable; and (ii) The data element or combination of data elements would enable a person to commit identity theft against a consumer.

The term “small business” means a business having 100 or fewer employees.

The term “vendor” means a person with which a covered entity contracts to maintain, store, manage, process, or otherwise access personal information for the purpose of, or in connection with, providing services to or on behalf of the covered entity.

(1) A covered entity and a vendor shall develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of personal information, including safeguards that protect the personal information when the covered entity or vendor disposes of the personal information.

(2) A covered entity or vendor complies with subsection (1) of this section if the covered entity or vendor: (a) Complies with a state or federal law that provides greater protection to personal information than the protections that this section provides. (b) Complies with regulations promulgated under Title V of the Gramm-Leach-Bliley Act, if personal information that is subject to ORS 646A.600 to 646A.628 is also subject to the Act. (c) Complies with regulations that implement the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH), as those acts were in effect on January 1, 2020, if personal information that is subject to ORS 646A.600 to 646A.628 is also subject to those acts. (d) Implements an information security program that includes:

(A) Administrative safeguards such as: (i) Designating one or more employees to coordinate the security program; (ii) Identifying reasonably foreseeable internal and external risks with reasonable regularity; (iii) Assessing whether existing safeguards adequately control the identified risks; (iv) Training and managing employees in security program practices and procedures with reasonable regularity; (v) Selecting service providers that are capable of maintaining appropriate safeguards and practices, and requiring the service providers by contract to maintain the safeguards and practices; (vi) Adjusting the security program in light of business changes, potential threats or new circumstances; and (vii) Reviewing user access privileges with reasonable regularity;

(B) Technical safeguards such as: (i) Assessing risks and vulnerabilities in network and software design and taking reasonably timely action to address the risks and vulnerabilities; (ii) Applying security updates and a reasonable security patch management program to software that might reasonably be at risk of or vulnerable to a breach of security; (iii) Monitoring, detecting, preventing, and responding to attacks or system failures; and (iv) Regularly testing, monitoring, and taking action to address the effectiveness of key controls, systems, and procedures; and

(C) Physical safeguards such as: (i) Assessing, in light of current technology, risks of information collection, storage, usage, retention, access, and disposal and implementing reasonable methods to remedy or mitigate identified risks; (ii) Monitoring, detecting, preventing, isolating and responding to intrusions timely and with reasonable regularity; (iii) Protecting against unauthorized access to or use of personal information during or after collecting, using, storing, transporting, retaining, destroying or disposing of the personal information; and (iv) Disposing of personal information, whether the covered entity or vendor disposes of the personal information on or off the covered entity’s or vendor’s premises or property, after the covered entity or vendor no longer needs the personal information for business purposes or as required by local, state or federal law by burning, pulverizing, shredding, or modifying a physical record and by destroying or erasing electronic media so that the information cannot be read or reconstructed.

See Security Requirements. A covered entity or vendor complies with the data disposal requirements in subsection (2)(d)(C)(iv) if the covered entity or vendor contracts with another person engaged in the business of record destruction to dispose of personal information in a manner that is consistent with the same requirements.

A person that is an owner of a small business complies with the obligation to implement and maintain reasonable safeguards if the person’s information security and disposal program contains administrative, technical and physical safeguards and disposal measures that are appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information the small business collects from or about consumers.

Oregon