Oregon lawmakers give data breach victims more protection

(Update: Senate joins in passage, bill goes to governor)

SALEM, Ore. (AP) – The Oregon Senate has approved updated rules for responding to data breaches.

Under the measure which passed unanimously Friday, consumers would have access to free placement, removal, and temporary lifts of credit freezes. Freezes are frequently recommended to consumers after data has been stolen.

The Consumer Theft Identity Protection Act, passed in 2007, set out protections for Oregonians, mandating notification after a breach, and that larger breaches be reported to the state attorney general.

Under the approved bill, breaches would have to be reported to consumers within 45 days, and limits would be placed on the practice of upselling, where companies use a breach of their customers’ data as a way to sell them additional data protection services.

The House passed the bill unanimously Thursday and it heads next to Gov. Kate Brown for consideration.

—

Thursday release from Oregon House Democrats:

Six months after the data breach of credit reporting agency Equifax exposed the private information of 145 million Americans, the Oregon House on Thursday overwhelmingly passed Senate Bill 1551, expanding consumer protections for Oregonians.

The legislation would institute a number of key provisions including requirements that breaches be reported more quickly and consumers have the opportunity to freeze their credit for free.

“It is unacceptable that a corporation has free reign with our most sensitive personal and financial information, and not only do we have very little control over it, but they are not taking the necessary steps to ensure it is as secure as possible,” said Rep. Paul Holvey (D-Eugene), who carried the bill on the floor. “When a data breach occurs, Oregonians deserve to know about it as soon as possible and have an easy and inexpensive means to secure their information.”

Senate Bill 1551 specifically requires credit reporting agencies to provide additional consumer benefits, including:

— Allowing consumers to place a credit freeze with each credit reporting agency for free at any time for any reason;

— Notifying consumers within 45 days after a breach is discovered; and

— Limiting the ability of companies that offer free credit monitoring after a breach to converting that free offer to a service for a fee in the same transaction.

The legislation also requires better safeguarding and practice to protect consumer’s personal information.

The Equifax breach, revealed by the company in September, nearly three months after it had occurred, compromised the personal information of nearly half of all Americans. According to the Oregon Department of Justice, the Equifax breach jeopardized 1.7 million Social Security numbers in Oregon.

“These incidents demonstrate just how vulnerable our information is,” said Rep. Janelle Bynum (D-Happy Valley). “It is time that Oregonians have the tools they need to protect their information online, and I believe this is an important first step in making sure that happens.”

Oregon House Democrats said in a news release they “are committed to protecting consumers at home and online. They are working to protect internet freedom, private information, and personal data, because Oregonians deserve to know that their information will be kept secure, that they have rights if they are the victim of a data breach, and that they can expect internet privacy.”

In addition to Rep. Holvey , House Democratic sponsors of the legislation include Rep. Janelle Bynum (D-Happy Valley), Rep. David Gomberg (D-Otis), Rep. Mitch Greenlick (D-Portland), Rep. Ken Helm (D-Beaverton), Rep. Pam Marsh (D-Ashland), Rep. Mark Meek (D-Clackamas County), and Rep. Rob Nosse (D-Portland).

The legislation, which passed 58-1, now goes to Gov. Kate Brown for her signature.