Distributes a software product, in Oregon

ORS 646A.622 (2007 c.759 sec. 12; amended 2015 c.357 sec. 3; 2018 c.10 sec. 6; 2019 c.180 sec. 4) · Read the law's page

• Develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personal information, including its secure disposal.
• Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.
• A small business may scale its program's administrative, technical and physical safeguards to its own size, complexity and the sensitivity of the personal information it collects.
• This binds a covered entity, any person, including a public body, that owns, licenses, maintains, stores, manages, collects, processes, acquires or otherwise possesses an Oregon consumer's personal information in the course of business, vocation, occupation or volunteer activity, and a vendor the covered entity contracts with to hold that information on its behalf; a person who acts solely as a vendor is not itself a covered entity.
• The Director of the Department of Consumer and Business Services enforces this duty by investigation, subpoena and a cease-and-desist order, with a civil penalty of up to $1,000 per violation and up to $500,000 for any one occurrence; the sections name no private right of action of their own.

ORS 646A.813 (added by 2019 c.193 (H.B. 2395-A) sec. 1; amending ORS 646.607) · Read the law's page

• This binds a manufacturer, a person that makes a connected device and sells or offers to sell it in Oregon; a connected device is a physical object, used primarily for personal, family or household purposes, that connects directly or indirectly to the Internet or is assigned an address for making a short-range wireless connection. It does not by itself reach a developer who ships only software or an app with no connected device of its own, and it imposes no duty on the manufacturer for software, firmware or peripheral devices that another manufacturer makes and a consumer later installs on the device.
• Equip the connected device with reasonable security features appropriate to its nature, function and the information it may collect, store or transmit, satisfied by giving each device a unique preprogrammed authentication credential or by requiring the user to generate new credentials before first use, or by complying with an applicable federal security requirement for connected devices.
• The duty does not apply where a consumer installs unapproved software or devices that disable or modify the device's own security features, to a HIPAA-covered entity or business associate as to an activity HIPAA regulates, or to a device whose functions already comply with Food and Drug Administration medical-device requirements.
• A violation is an unlawful trade practice under ORS 646.607, enforceable by the Attorney General or a district attorney by injunction, carrying a civil penalty of up to $25,000 for a willful violation; Oregon's private right of action for unlawful trade practices reaches only a practice declared unlawful under the separate ORS 646.608, so this duty carries no private remedy of its own.