Sends automated texts, in Oregon

ORS 646A.620(1)(a) to (c) · Read the law's page

• Do not print a consumer's Social Security number on mail to the consumer that is material the consumer did not request, or on any documentation the consumer requested for a transaction or service, unless the number is redacted (ORS 646A.620(1)(a)).
• Do not print a consumer's Social Security number on any card the consumer needs to access products or services you provide (ORS 646A.620(1)(b)).
• Do not publicly post or publicly display a consumer's Social Security number, meaning communicate it or otherwise make it available to the public, unless it is redacted (ORS 646A.620(1)(c)).

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 646.561, 646.563 · Read the law's page

• Once a party you call or text as part of a telephone solicitation states a desire not to be called or texted again, do not make a subsequent telephone solicitation of that party at that number.
• Do not initiate a telephone solicitation outside the hours of 8 a.m. to 8 p.m., or more than three separate times to a party within a 24-hour period, unless you have an established business relationship with the party (a transaction with the party within the preceding 18 months).
• Do not misrepresent or falsify your own identity, the identity of a person you are calling on behalf of, or the purpose of the telephone solicitation.
• These duties reach only a telephone solicitation as defined: a call or text message encouraging a party to purchase real estate, goods or services or to make a donation. They do not reach a charitable organization, public agency or its volunteers contacting members or past or prospective donors, a call or text limited to polling or soliciting opinions or votes, a business-to-business contact, or a call or text that responds directly to a message the party sent.

ORS 646A.370-646A.376 · Read the law's page

• Before using an automatic dialing and announcing device to call a subscriber, design or operate it to disconnect within 10 seconds after the subscriber ends the call, and to offer the subscriber a one-touch or one-digit method within the first 10 seconds to opt out of future calls from you, unless you are a collection agency, debt buyer, debt collector, a public safety or law enforcement representative, or you have an established business relationship with the subscriber.
• Do not use such a device to dial a fire, law enforcement or other emergency agency, a hospital, health care facility, physician's office, poison control center, or suicide-prevention or domestic-violence counseling service; do not dial a subscriber who used the device's opt-out against you unless you are a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or have an established business relationship; and, when dialing randomly or sequentially, do not dial a subscriber on an official government do-not-call list unless you have an established business relationship, are a debt buyer or subject to the Fair Debt Collection Practices Act, are a public safety or law enforcement representative, or are a school district or school calling its employees, students or their families.
• Use such a device to call a subscriber only between 8 a.m. and 8 p.m., and no more than three times in 24 hours, unless one of the government-list exceptions applies or you are responding directly to the subscriber's own message; you may rely on a mobile number's area code to decide whether the subscriber is in Oregon.
• Do not misrepresent or falsify your identity, the identity of a person you represent, your telephone number, your location, or the purpose of the call when speaking with the subscriber or in the prerecorded, synthesized-voice or text message a device disseminates.
• Whether or not you use such a device, do not intentionally alter, misrepresent or falsify the information a caller identification service would ordinarily provide to the called subscriber.
• Do not knowingly, or while consciously avoiding knowledge, provide substantial assistance or support, including carrying or facilitating calls, for another person's violation of the misrepresentation or caller-ID duties, unless you are a common carrier or a network operator on whose network the call merely terminates.