Trains models, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

Or. Rev. Stat. §§ 646A.570 to 646A.589 · Read the law's page

• Before processing sensitive data about an Oregon consumer, including a scraped fingerprint, voiceprint, retinal or iris scan, other biometric or genetic data point, or a consumer's precise location accurate within 1,750 feet, obtain the consumer's consent first.
• OCPA's own personal-data definition excludes data lawfully available through government records or widely distributed media, or that a controller reasonably understands the consumer to have made public themselves (ORS 646A.570(13)(b)); this exclusion reaches 'sensitive data' too, since sensitive data is itself defined as personal data. It does not exempt data merely observable online that was not made public by the consumer, a government record, or distributed media, so scraped data of unclear public provenance should still be treated as covered.
• Do not sell a consumer's precise location data, accurate within a radius of 1,750 feet, whether or not the consumer consents (ORS 646A.578(2)(d)(B), added by HB 2008).