Oregon Consumer Identity Theft Protection Act

The Oregon Consumer Identity Theft Act, enacted earlier this year, limits the use of social security numbers and imposes mandatory procedures for notifying consumers of any breach in the security of their personal information. These provisions went into effect on October 1, 2007. The types of information covered by the new law include social security numbers, drivers' license numbers, financial account, credit and debit card numbers, and passport numbers.

Additional provisions of the Act, which go into effect on January 1, 2008, require businesses to develop and implement programs to protect the security, confidentiality, and integrity of the personal information acquired and disposed of by the business. Businesses that already comply with more stringent requirements of state or federal law will be in compliance with the Act.

The Department of Consumer and Business Services provides education and guidance on the law and recommended practices here.