Privacy Map

Oregon. Breach notification. Act

OR breach lawOregon data breach notification law (Or. Rev. Stat. §§ 646A.600-646A.628 (Oregon Consumer Information Protection Act))

In force

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Oregon residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 days of discovery. Covered data: name plus SSN, driver's licence/passport, financial account with codes, biometric data, health insurance and medical data; online credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Vendors must notify the AG directly if >250 residents are affected and the owner has not; free credit monitoring offers must not require card details.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Oregon requires a vendor to notify the owner within 10 days of discovering the breach and, for >250 residents, to notify the AG if the owner has not. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 45 days of discovery; AG if >250 residents; CRAs if >1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $25,000 per violation under Unlawful Trade Practices Act

§3Dates

Key dates
  • Adopted
  • In force
  • SB 684 (2019, eff. 2020-01-01) added vendor 10-day rule

§4Text and authority

Text
Authority
Oregon Department of Justice (Attorney General)

§5Where it applies

Domestic law of
Oregon

§6Sources and verification

Sources consulted
Verification

High confidence.

Penalty figure from UTPA civil penalty provision.