73rd OREGON LEGISLATIVE ASSEMBLY--2005 Regular Session
 
NOTE:  Matter within  { +  braces and plus signs + } in an
amended section is new. Matter within  { -  braces and minus
signs - } is existing law to be omitted. New sections are within
 { +  braces and plus signs + } .
 
LC 2189
 
                         Senate Bill 630
 
Sponsored by Senator PROZANSKI (at the request of OSPIRG)
 
 
                             SUMMARY
 
The following summary is not prepared by the sponsors of the
measure and is not a part of the body thereof subject to
consideration by the Legislative Assembly. It is an editor's
brief statement of the essential features of the measure as
introduced.
 
  Requires person maintaining or possessing identifying
information to take measures to protect against unauthorized
access to or use of information prior to disposal or destruction
of information.
 
                        A BILL FOR AN ACT
Relating to protection of identifying information.
Be It Enacted by the People of the State of Oregon:
  SECTION 1.  { + As used in sections 1 and 2 of this 2005 Act:
  (1) 'Dispose' includes:
  (a) The discarding or abandonment of records containing
identifying information; and
  (b) The sale, donation, discarding or transfer of any medium
containing records of identifying information including computer
equipment, computer media, or other nonpaper media or equipment
upon which records of identifying information are stored.
  (2) 'Identifying information' means any of the following
information about an individual:
  (a) Name;
  (b) Address;
  (c) Date of birth;
  (d) Social Security number;
  (e) Driver license or identification card number;
  (f) Passport number;
  (g) Signature;
  (h) Fingerprint;
  (i) Telephone number;
  (j) Credit card or debit card, both as defined in ORS 646.886;
and
  (k) A number identifying the consumer to a financial
institution, as defined in ORS 706.008.
  (3) 'Records' means any material on which written, drawn,
spoken, visual or electromagnetic information is recorded or
preserved, regardless of physical form or characteristics.  '
Records' does not mean publicly available directories containing
information that an individual has voluntarily consented to have
publicly disseminated or listed such as name, address or
telephone number. + }
  SECTION 2.  { + A person that in the course of business
maintains or otherwise possesses identifying information,
including disposal companies explicitly hired to dispose of
records, may not dispose of or otherwise destroy a record
containing identifying information unless the person takes
reasonable measures to protect against unauthorized access to or
use of the information in connection with or after disposal of
the information. Reasonable measures include, but are not limited
to:
  (1) Burning, pulverizing, shredding or modifying the record
containing identifying information so that the information cannot
be read or reconstructed;
  (2) Destroying or erasing electronic media and other nonpaper
media containing identifying information so that the information
cannot be read or reconstructed;
  (3) Contracting with a person engaged in the business of record
destruction to dispose of identifying information in a manner
consistent with this statute; or
  (4) Protecting against unauthorized access to or use of
identifying information during or after the collection,
transportation and destruction of the information. + }
  SECTION 3.  { + An individual injured by a violation of section
2 of this 2005 Act may bring an action in an appropriate court to
enjoin further violations and to recover actual damages plus
court costs and attorney fees reasonably incurred in the
action. + }
                         ----------