71st OREGON LEGISLATIVE ASSEMBLY--2001 Regular Session
 
NOTE:  Matter within  { +  braces and plus signs + } in an
amended section is new. Matter within  { -  braces and minus
signs - } is existing law to be omitted. New sections are within
 { +  braces and plus signs + } .
 
LC 2129
 
                         Senate Bill 647
 
Sponsored by Senator BROWN
 
 
                             SUMMARY
 
The following summary is not prepared by the sponsors of the
measure and is not a part of the body thereof subject to
consideration by the Legislative Assembly. It is an editor's
brief statement of the essential features of the measure as
introduced.
 
  Requires that public bodies that have records containing
personal information, and persons that in course of business,
vocation or occupation acquire records containing personal
information, not dispose of records unless public bodies or
persons shred records or take certain other actions to prevent
access to personal information.
  Creates cause of action against public bodies for damages
suffered by reason of failure to shred records or otherwise
prevent access to personal information in records after disposal.
Creates cause of action against person that uses personal
information in records after disposal.
 
                        A BILL FOR AN ACT
Relating to personal information in records.
Be It Enacted by the People of the State of Oregon:
  SECTION 1.  { + As used in sections 1 to 3 of this 2001 Act:
  (1) 'Personal information' means any of the following:
  (a) Personally identifiable data about an individual's medical
condition.
  (b) Personally identifiable data that contain an individual's
account or customer number, account balance, balance owing,
credit balance or credit limit, if the data relate to an
individual's account or transaction with a financial institution
as defined in ORS 706.008 or with a person that issues credit
cards as defined in ORS 646.893.
  (c) Personally identifiable data provided by an individual to a
financial institution as defined in ORS 706.008 or to a person
that issues credit cards as defined in ORS 646.893 upon opening
an account or applying for a loan or credit.
  (d) Personally identifiable data about an individual's federal,
state or local tax return.
  (2) 'Personally identifiable data' means information that is
capable of being associated with a particular individual through
one or more identifiers or through other information or
circumstances.
  (3) 'Public body' has the meaning given that term in ORS
192.410.
  (4) 'Record' means any material on which written, drawn,
printed, spoken, visual or electromagnetic information is
recorded or preserved, regardless of physical form or
characteristics. + }
  SECTION 2.  { + (1) A public body that has records containing
personal information, or any person that in the course of a
business, vocation or occupation acquires records containing
personal information, may not dispose of those records unless the
public body or person does one of the following:
  (a) Shreds the records before disposing of the records.
  (b) Erases the personal information contained in the records
before disposing of the records.
  (c) Modifies the records to make the personal information
unreadable before disposing of the records.
  (d) Takes actions that it reasonably believes will ensure that
no unauthorized person will have access to the personal
information contained in the records for the period between
disposal of the records and destruction of the records.
  (2) The provisions of this section do not apply to any sale of
a record or to the transfer of a record for value. + }
  SECTION 3.  { + (1) Violation of the prohibitions of section 2
of this 2001 Act by a person other than a public body is an
unlawful trade practice subject to ORS 646.605 to 646.652.
  (2) A public body that disposes of records in violation of
section 2 of this 2001 Act is liable to any individual whose
personal information is disposed of for all damages suffered by
the individual by reason of the violation. An action against a
public body under this subsection is subject to ORS 30.260 to
30.300.
  (3) Any person that uses personal information contained in a
record that was disposed of by a public body or person subject to
the prohibitions of section 2 of this 2001 Act is liable to the
individual who is the subject of the personal information, and is
liable to the public body or person that disposed of the record,
for any damages resulting from the use of the personal
information. This subsection does not apply to a person that uses
personal information with the consent of the individual who is
the subject of the personal information. + }
  SECTION 4.  { + (1) Except as provided in subsection (2) of
this section, sections 1 to 3 of this 2001 Act apply only to
records disposed of on or after the effective date of this 2001
Act.
  (2) Section 3 (3) of this 2001 Act applies to any use of
personal information that occurs on or after the effective date
of this 2001 Act, without regard to whether the records
containing personal information were disposed of before, on or
after the effective date of this 2001 Act. + }
                         ----------