Privacy Law Library

Oregon Consumer Information Protection Act: data security, disposal and SSN protection

OCIPA safeguards and SSN

Data security

Requires covered entities and vendors to keep reasonable administrative, technical and physical safeguards for personal information, including secure disposal, with safe harbors for GLBA or HIPAA compliance and a scaled standard for small businesses. It also restricts printing, posting and careless disposal of Social Security numbers.

Where
Oregon
Citation
ORS 646A.620, 646A.622, 646A.624
Status
In force
In force since
2007-10-01
Last amended
2020-01-01
Enforced by
Oregon Attorney General (ORS 646.607(9)) and Director of the Department of Consumer and Business Services (ORS 646A.624)
People can sue
No
Penalties
Unlawful trade practice (AG civil penalties up to $25,000 per willful violation, ORS 646.642(3)); DCBS penalties up to $1,000 per violation, capped at $500,000 per occurrence (ORS 646A.624(4)).
Applies to
  • Covered entities and vendors that possess Oregon consumers' personal information (ORS 646A.622(1))
  • Any person, for the Social Security number restrictions (ORS 646A.620)

Practices it requires

  • Do not print an SSN on unrequested mail or on cards needed to access products or services, publicly post or display an unredacted SSN, or discard materials showing an SSN without making it unreadable.ORS 646A.620(1)

Security duties

  • Develop, implement and maintain reasonable safeguards for the security, confidentiality and integrity of personal information, including at disposal.ORS 646A.622(1)
  • Safe harbor: an information security program with listed administrative (coordinator, risk assessment, training, vendor contracts, access reviews), technical (patching, monitoring, testing) and physical (secure disposal by shredding or erasure) safeguards, or compliance with GLBA, HIPAA/HITECH, or a more protective law.ORS 646A.622(2)-(3)
  • Small businesses comply with safeguards appropriate to their size, activities and data sensitivity.ORS 646A.622(5) · Only if: Small business as defined in ORS 285B.123(2)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: ORS 646A.622 (sec. 12 of 2007 c.759) became operative 2008-01-01 per sec. 16 of that act; the 2007-10-01 date is the act's effective date.

Research reference, not legal advice.