Records calls, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 165.535, 165.540, 165.543, 165.545 · Read the law's page

• Do not obtain, or attempt to obtain, the whole or any part of a telecommunication or radio communication to which you are not a participant, unless at least one participant has consented.
• Do not obtain any part of an in-person conversation or a conversation occurring through a video conferencing program by means of a recording device unless every participant is specifically informed that the conversation is being obtained, whether or not you are yourself a participant.
• The specific-notice duty does not apply to a public or semipublic meeting, hearing, trial, press conference, rally or similar event recorded with an unconcealed device or held over a video conferencing program, to a regularly scheduled class, or to a private meeting or conference where all others involved knew or reasonably should have known the recording was being made.
• Do not obtain a conversation, telecommunication or radio communication from another person while knowing or having good reason to believe it was first obtained in a way the section prohibits, and do not use or divulge one obtained by prohibited means, unless you took no part in first obtaining it and it concerns a matter of public concern.