Oregon Senate Bill 583, the Oregon Consumer Identity Theft Protection Act (OITPA), is now law. The OITPA is a step in the right direction and appears to be one of the most comprehensive information security regulations for businesses of all sizes. While it does not provide specifics about what steps must be taken, it covers the main Information Security categories to prompt Oregon businesses into evaluating their security posture and making improvements. There are significant enough teeth to this legislation ($1,000 per incident with a $500,000 max) to compel Oregon business to become compliant.
An excellent resource is www.oregonidentitytheftprotectionact.com to learn more about this law and resources to help Oregon businesses. Certain categories went into effect on October 1, 2007 and the remainder goes into effect January 1, 2008.A summary of the OITPA as it relates to Oregon businesses:
Protecting Personally Identifiable Information (PII)
Effective October 1, 2007, the OITPA prohibits the disclosure of more than the last four digits of a social security number. The OITPA does not apply to the use of social security numbers for internal verification or administrative purposes. In addition, the OITPA does not apply to records that are required by law to be made publicly available.
Notification of Security Breaches
This provision of the OITPA, effective October 1, 2007, applies to any business, organization, or individual that maintains or possesses an Oregon resident's personal information that is used in the course of business. Personal information includes social security numbers, driver's license numbers, passport numbers, financial account numbers, and credit card numbers. Under the OITPA, if a business's computer files containing personal information have been subject to a security breach, the business must notify the affected individuals. The notification must be done in the most expeditious time possible, consistent with the needs and investigation of law enforcement.
The notice can be written, electronic (if that is the primary method of communication between the business and the individual), or telephonic if the individual is contacted directly. If the cost of providing notification would exceed $250,000 or if the number of individuals to be notified exceeds 350,000, a business can provide notice by both posting the notice on its website and notifying major Oregon television and newspaper media.
For the OITPA, a breach notice must contain the following information: (1) a general description of the incident, (2) the approximate date of the security breach, (3) the type of personal information at issue, (4) contact information of the business, (5) contact information for national consumer reporting agencies, and (6) advice to the individual on how to report suspected identity theft to law enforcement.
If a security breach affects more than 1,000 individuals, the business must notify, without unreasonable delay, all consumer reporting agencies regarding the timing, distribution, and content of the notification given by the business to the individuals. The business must include the police report number, if available.
If a business determines, after appropriate investigation or consultation with law enforcement, that the affected individuals are not likely to be harmed by the security breach, the business need not notify the individuals. Such a determination must be documented in writing, and the documentation must be maintained for five years.
Safeguarding Personally Identifiable Information (PII)
Effective January 1, 2008, businesses or organizations that maintain or possess an individual's personal information must develop, implement, and maintain reasonable safeguards to protect the security, confidentiality, and integrity of the personal information. The OITPA includes guidelines for compliance. For example, a business may implement an information security program that includes administrative, technical, and physical safeguards as follows:
Administrative Safeguards
- Designate an employee to coordinate the security program
- Identify reasonably foreseeable internal and external risks
- Assess the sufficiency of safeguards in place to control the identified risks
- Train and manage employees in the security program practices and procedures
- Select service providers capable of maintaining appropriate safeguards
- Adjust the security program in light of business changes or new circumstances.
Technical Safeguards
- Assess risks in network and software design
- Assess risks in information processing, transmission, and storage
- Detect, prevent, and respond to attacks or system failures
- Regularly test and monitor the effectiveness of key controls, systems, and procedures.
Physical Safeguards
- Assess risks of information storage and disposal
- Detect, prevent, and respond to intrusions
- Protect against unauthorized access to or use of personal information during or after the collection, transportation, and destruction or disposal of the information
- Dispose of personal information after it is no longer needed for business purposes or as required by law by burning, pulverizing, shredding, or modifying a physical record and by destroying or erasing electronic media so that the information cannot be read or reconstructed.
There is no single, established set of practices that businesses must follow to comply with the OITPA. Instead, the legislature has recognized that adequate safeguards will vary from business to business depending on the size and technical nature of the business. An excellent resource for small and medium businesses for documentation is www.iSecurityPolicy.com.
Several examples of methods used to safeguard confidential information include:
- Paper media containing confidential information should be stored in locked cabinets, and access to the locked cabinets should be limited to a few employees. Any employee with a key who leaves the company should return the key. In addition, businesses should adopt and maintain document-retention schedules so that confidential information is regularly destroyed when no longer needed.
- Businesses should restrict access to electronic confidential information to a small number of designated people, and the information should be password-protected.
- Businesses that contract with an IT company should ensure that the IT company spells out its sufficient safeguards in the contract with the business. Similarly, it would be a good idea to obtain information in writing from hardware and software suppliers regarding the safeguards used to protect confidential information.
- Many security breaches occur when laptops are stolen. A business might consider prohibiting employees from storing confidential information on business laptops and instead require that such information be stored on the server.
- Businesses should establish a written procedure for identifying and responding to security breaches.
Any business that is subject to and complies with the Gramm Leach Bliley Act (GLBA) or the Health Insurance Portability and Accountability Act (HIPAA) is considered to be in compliance with the OITPA.
An owner of a small business (defined as a manufacturing business having 200 or fewer employees and all other forms of business having 50 or fewer employees) must adopt measures appropriate to its size and activities and the sensitivity of the information collected.
The Oregon Department of Consumer and Business Services is responsible for enforcement of the Act.