Law / United States / 
Oregon
Oregon Pen Register and Trap and Trace Device Statute
In force.
A device storage and tracking consent rule binding public and private bodies.
- Enforcement body
- Criminal prosecution by the State; the sections name no civil action.
- Obligation class
- Prohibition
What it requires
- Do not install or use a pen register or trap and trace device unless a court order or statute allows it; a device a provider or its customer uses for billing, or for cost accounting in the ordinary course of business, is not a pen register.
- A provider of wire or electronic communication service may use such a device to operate, maintain, test or protect its service, its rights or property or its users, to record that a communication was initiated or completed to protect against fraudulent, unlawful or abusive use, or with the consent of the service's user; these exceptions belong to the provider.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
ORS 165.657 to 165.673 state no penalty; ORS 161.555(3) provides that an offense defined by statute without a stated classification or penalty is a Class A misdemeanor, punishable under the general misdemeanor sentencing statutes by up to 364 days' imprisonment and a fine of up to $6,250.
What this law does
No person may install or use a pen register or trap and trace device except as the listed court-order and interception statutes and ORS 165.657 to 165.673 allow.
A pen register is a device that records or decodes impulses identifying the numbers dialed or otherwise transmitted on the telephone line it is attached to, but not a device a provider, or a customer of a provider, uses for billing or recording incident to billing, or for cost accounting or similar purposes in the ordinary course of its business. A trap and trace device is a device that captures the originating number of an incoming communication.
A provider of wire or electronic communication service may use such a device in operating, maintaining, testing or protecting its service, its rights or property or its users, to record that a communication was initiated or completed to protect against fraudulent, unlawful or abusive use, or where the consent of the user of that service has been obtained; all three are provider exceptions.
The sections state no penalty, and ORS 161.555(3) provides that an offense defined by statute without a stated classification or penalty is a Class A misdemeanor. The general misdemeanor sentencing statutes cap a Class A misdemeanor at 364 days' imprisonment. They separately cap its fine at $6,250. The sections name no private civil action, and ORS 165.669(4) bars an action against a provider that assists under a court order. No day on which these sections came into force has been located.
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .