On March 16, 2018, Oregon's governor signed S.B. 1551, which amends Oregon's data breach notification law. The amendment alters the law's notification requirement, such that the entity must now give notification not later than 45 days after discovering or receiving notification of the breach of security. Additionally, if the entity offers to provide credit monitoring services in connection with the notification, it may not condition the provision of services on the consumer providing a credit or debit card number. The law also expands the definition of "personal information" to include any information or combination of information that the entity reasonably knows or should know would permit access to the consumer's financial account.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
