Senate Bill 1551

Requires person that owns, licenses <i>, has control over or has access to</i>]<b> or otherwise possesses</b> personal information <i>and</i>]<b> that</b> was subject to breach of security<b> or that received notice of breach of security from another person that maintains or otherwise possesses personal information on person's behalf,</b> to notify consumer to whom personal information pertains and, if number of consumers to whom person must send notice exceeds 250, to Attorney General. <b>Requires person that maintains or otherwise possesses personal information on behalf of another person to notify other person of breach of security.</b> Requires person to give notice in most expeditious manner possible, without unreasonable delay, but not later than 45 days after discovering or receiving notice of breach of security. Requires person, in providing notice, to<b> undertake reasonable measures necessary to</b> determine sufficient contact information for notice recipients, to determine scope of breach of security and to restore<b> reasonable</b> integrity, security and confidentiality of personal information. Provides that if person must notify consumer of breach of security and with notice person offers credit monitoring services or identity theft prevention and mitigation services without charge to consumer, person may not condition provision of services on consumer's providing person with credit card or debit card number or consumer's acceptance of any other service person offers for fee. Requires person to separately, distinctly, clearly and conspicuously disclose to consumer in any offer for additional credit monitoring services or identity theft prevention and mitigation services that person offers for fee that person will charge consumer fee. Prohibits consumer reporting agency from charging consumer fee or collecting from consumer money or item of value for placing, temporarily lifting or removing security freeze on consumer's consumer report, creating or deleting protective record, placing or removing security freeze on protective record or replacing lost personal identification number or password. Modifies standards for safeguarding personal information. Takes effect on 91st day following adjournment sine die.

In the Senate

• Floyd Prozanski

  Sponsor

In the House of Representatives

• Paul Holvey

  Sponsor

• Senate, third reading29–0

  Passed · Feb 21 · 1 present

• House of Representatives, third reading58–1

  Passed · Mar 1 · 1 present

• Senate, concurrence29–0

  Agreed to the other chamber's changes · Mar 2 · 1 present

• Senate committee amendmentAdopted

  Adopted Feb 19

• House of Representatives committee amendmentAdopted

  Adopted Feb 27

l9n doesn't hold this bill's text yet.

In the Senate Jan 22 – Feb 21

1. Jan 22Filed before the session
2. Feb 5Introduced
3. Sent to Judiciary
4. Feb 9Heard in Judiciary
5. Feb 15Heard in Judiciary
6. Heard in Judiciary
7. Feb 19Judiciary recommended it as amended
8. Feb 20Read a second time
9. Feb 21Passed the Senate, 29 to 0

In the House of Representatives Feb 21 – Mar 1

1. Feb 21Arrived in the House of Representatives
2. Feb 22Sent to Business and Labor
3. Feb 26Heard in Business and Labor
4. Feb 27Business and Labor recommended it as amended
5. Feb 28Read a second time
6. Mar 1Passed the House of Representatives, 58 to 1

Back in the Senate Mar 2 – Mar 3

1. Mar 2The Senate agreed to the House of Representatives's amendments and passed it again, 29 to 0
2. Mar 3Signed in the Senate

To the Governor Mar 6 – Apr 23

1. Mar 6Signed in the House of Representatives
2. Mar 16Signed by the Governor
3. Apr 23Became chapter 010 of Oregon Laws 2018
4. In force from June 2, 2018