Law / United States / 
Oregon
Notice of breach of security
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected Oregon consumer of a breach of security, including one you learn of through a vendor, in the most expeditious manner possible and not later than 45 days after discovering or receiving notification of the breach, and notify the Oregon Attorney General as well once more than 250 Oregon consumers are notified (ORS 646A.604(1), (3)).
- If you are a vendor that discovers a breach of security or has reason to believe one has occurred, notify each covered entity you have a contract with as soon as is practicable and not later than 10 days after discovering the breach or having reason to believe it occurred, and if you contract with another vendor that serves a covered entity, notify that vendor the same way (ORS 646A.604(2)).
These lines are LexLint's reading of the law's text. Also read by: Oregon Department of Justice, Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/data-breaches/
- Guidance body
- Oregon Department of Justice, Consumer Protection
- Open questions
- When may a covered entity reasonably determine under ORS 646A.604(8) that affected consumers are unlikely to suffer harm, so that it need not notify them of a breach of security?
What it makes you log
What the log must hold
Decision basis
Log retention
The covered entity keeps the written no-harm determination at least five years.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
A duty to notify consumers and the Attorney General of a breach is a notice and by itself no record. Subsection (8) lets a covered entity skip consumer notice when it reasonably determines, after investigation or consultation with law enforcement, that the affected consumers are unlikely to suffer harm, and then requires the entity to document that determination in writing and keep the documentation at least five years. The documentation is the record of the grounds for the decision, so its content is coded as the decision basis. The section names no reader of the documentation, so no audit or access is coded. The reach comes from the definition of consumer as an individual resident of this state in ORS 646A.602(2); neither section 646A.604 nor the definition of covered entity in ORS 646A.602(5) carries a conducts-business-in-the-state clause.
- Kind
- Explicit
- As of
- Provision
- ORS 646A.604(8)
- Trigger
- security_incident
What this law does
A covered entity subject to a breach of security, or that receives notice of one from a vendor, must give notice of the breach to each affected Oregon consumer, and must also notify the Attorney General once the number of Oregon consumers notified exceeds 250. The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .