Data Breach Notification Statutes – Oregon
Last Updated: 02/28/2024
- Applicable Statute: Or. Rev. Stat. §§ 646A.600–.604, 646A.624–.626
- Attorney General Notice Required: Yes – notify Attorney General if more than 250 residents are notified.
- Timing: Not specified
- Method: Form to be submitted online (https://justice.oregon.gov/consumer/DataBreach/Home/Submit) Must also include sample or copy of the notice going to the affected individuals.
- Content: See above
- Consumer Notice Requirements:
- Timing: Most expeditious time possible and without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security, consistent with any measures necessary to determine sufficient contact information for affected residents, to determine the scope of the breach and to restore the reasonable integrity of the personal information.
- Method: By written notice, by telephone, or electronic notice if consistent with the provisions regarding electronic records and signatures set forth in E-SIGN. Substitute notice may also be available under certain circumstances.
- Content: Must include, at a minimum, the following information:
- A description of the breach in general terms;
- The approximate date of the breach;
- The type of personal information that was subject to the breach;
- The contact information for the entity that owned or licensed the personal information or for the person that provided notice;
- The contact information for national consumer reporting agencies; and
- Advice to the consumer to report suspected identity theft to law enforcement, including the Attorney General and the Federal Trade Commission.
- Consumer Reporting Agency Obligations: If more than 1,000 Oregon residents are notified, must also notify all nationwide Consumer Reporting Agencies.