What does Oregon's data breach law ask a business to do?

Who does this law apply to?

The law applies to a covered entity: a person that owns, licenses, keeps, stores, collects, processes or otherwise has personal information in the course of its business, work or volunteer activities. A covered entity must give notice when it is subject to a breach of security or a vendor tells it of one.

If a covered entity is subject to a breach of security or receives notice of a breach of security from a vendor, the covered entity shall give notice of the breach of security to:

"Covered entity" means a person that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses personal information in the course of the person's business, vocation, occupation or volunteer activities.

What counts as personal information?

Personal information is a consumer's first name or first initial and last name together with another listed item, unless encryption, redaction or other methods have made the item unusable and the key was not acquired. The list in the text includes a social security number, a driver's licence, state ID or passport number, a financial account or card number with the code that opens it, biometric data used to authenticate a person, health insurance numbers, and medical information.

A user name or other means of identifying a consumer for account access, together with what is needed to authenticate it, also counts.

A consumer's first name or first initial and last name in combination with any one or more of the following data elements, if encryption, redaction or other methods have not rendered the data elements unusable or if the data elements are encrypted and the encryption key has been acquired:

A user name or other means of identifying a consumer for the purpose of permitting access to the consumer's account, together with any other method necessary to authenticate the user name or means of identification.

How fast must people be told?

Notice is due in the most expeditious manner possible, without unreasonable delay, and not later than 45 days after the covered entity discovers or is told of the breach.

A covered entity shall give notice of a breach of security in the most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notification of the breach of security.

Who else must be told?

The Attorney General must be told, in writing or electronically, when more than 250 consumers are to be notified.

When a breach affects more than 1,000 consumers, the covered entity must also tell the nationwide consumer reporting agencies, without unreasonable delay, about the timing, distribution and content of the notice, with any police report number.

The Attorney General, either in writing or electronically, if the number of consumers to whom the covered entity must send the notice described in paragraph (a) of this subsection exceeds 250.

If a covered entity discovers or receives notice of a breach of security that affects more than 1,000 consumers, the covered entity shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain reports on consumers on a nationwide basis of the timing, distribution and content of the notice the covered entity gave to affected consumers and shall include in the notice any police report number assigned to the breach of security.

Is encrypted information treated differently?

Yes. The text defines encryption as an algorithmic process that makes data unreadable or unusable without a confidential process or key. Encrypted data elements fall outside personal information unless the encryption key has also been acquired.

"Encryption" means an algorithmic process that renders data unreadable or unusable without the use of a confidential process or key.

What if a vendor holds the data?

A vendor that discovers a breach, or has reason to believe one happened, must tell the covered entity it works for as soon as practicable and not later than 10 days after.

A vendor that discovers a breach of security or has reason to believe that a breach of security has occurred shall notify a covered entity with which the vendor has a contract as soon as is practicable but not later than 10 days after discovering the breach of security or having a reason to believe that the breach of security occurred.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.