Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I ignore my obligations as a service provider with access to personal information in Oregon? What are the requirements?

As a service provider with access to personal information in Oregon, you cannot ignore your obligations. The Oregon Consumer Identity Theft Protection Act (OCITPA) requires service providers to take reasonable steps to protect personal information from unauthorized access, acquisition, or disclosure [1.1].

Under ORS 646A.622, service providers must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information and the size, complexity, and scope of the service provider’s business [1.1].

Additionally, the Oregon Administrative Rules (OAR) require service providers to notify affected individuals and the Attorney General of any security breach involving personal information [1.1].

Regarding the requirements for abandonment of service, if you are a telecommunications provider intending to abandon any intrastate telecommunications service, you must comply with the Abandonment of Service rule (OAR 860-032-0020) [2.1]. The rule requires you to provide notifications to affected customers, Commission staff, and affected telecommunications providers, among others [2.1].

In addition, there are other Oregon Administrative Rules that may be relevant to your obligations as a service provider, such as the Allocation of Revenues by a Telecommunications Provider (OAR 860-032-0090), Authority Obligations (OAR 943-014-0430), and Customer Proprietary Network Information (CPNI) (OAR 860-032-0510) [2.2][3.1][2.3].

Therefore, it is important to review all relevant laws and regulations to ensure compliance with your obligations as a service provider with access to personal information in Oregon.

Source(s):
Jurisdiction

Oregon