In March 2018, Oregon Governor Kate Brown signed into law new
measures to strengthen the state's existing data breach
notification statute, ORS § 646A.604. The legislation is set
to take effect in June 2018 and, among other things, will require
organizations that experience a data breach affecting Oregon
residents to notify affected individuals of the data breach within
45 days of its discovery, unless asked to delay notification by law
enforcement. Previously, Oregon law required notification to be
made in the most expeditious time possible, without unreasonable
delay.
The legislation also adds a category of personal information
that will trigger a duty to notify. The definition of personal
information will now include an individual's first name or
first initial and last name in combination with any
"information that a person reasonably knows or should know
would permit access to [a] consumer's financial account."
The definition of personal information was
