Can I use third-party customer service tools that collect personal information in Oregon? What are the requirements?

Use of Third-Party Customer Service Tools in Oregon

Yes, you can use third-party customer service tools that collect personal information in Oregon, but you must comply with the state’s privacy laws. The requirements for handling personal information are outlined in various Oregon Administrative Rules (OARs), including ORAR 735-010-0120, ORAR 411-005-0010, and ORAR 860-086-0030.

Customer Record for Business Entities and Persons (ORAR 735-010-0120 and ORAR 735-010-0110)

ORAR 735-010-0120 requires the Department of Motor Vehicles (DMV) to maintain a customer record for business entities that includes information such as the business name, business address, and customer number. ORAR 735-010-0110 requires DMV to maintain a customer record for persons that includes information such as the name, residence address, and customer number. If a business entity or person conducts business with DMV using more than one name, DMV must establish a separate customer record and assign a customer number for each name.

Disclosure of Information to the Client or Third Party (ORAR 411-005-0010)

ORAR 411-005-0010 applies to programs covered by chapter 411 of the Oregon Administrative Rules. It requires the Department to make information in a client case record or record of service available to the client or anyone authorized by the client, except as provided in section (2) of this rule and OAR 410-014-0030. Case record information may be requested by the client and released to the client or third party by telephone. The client must satisfy the local office as to their identity. A verbal authorization from the client is permitted to allow verbal release of case record information specified by the client to third parties. Each authorization is valid for a period of 30 days from the date the authorization is given verbally, unless a shorter time period is given.

Electric Company Transfer of Data (ORAR 860-086-0030)

ORAR 860-086-0030 requires electric companies to transfer to the Administrator certain proprietary customer information for electric company customers, if available. The information that must be transferred includes customer name, service address, mailing address, in-service or activation date, building type, business type, historical usage data, meter number and other point-of-delivery identification numbers, rate schedule identifier for each customer account, and information about any energy efficiency program participation and type of space heat used by the customer. However, electric companies may not transfer certain types of information, such as social security numbers, billing and payment history, credit information, tax identification numbers, driver license numbers, life support information, any medical information, proprietary customer information protected by the password provision required under OAR 860-021-0009(6), or proprietary customer information for customers who have requested that their information not be shared with third parties.

Record Requirements for CDL Third Party Testers (ORAR 735-060-0057)

ORAR 735-060-0057 requires CDL third party testers to maintain records for no less than six years from the date of the test. The Tester must maintain a fully completed copy of the CDL test score sheet for each CDL applicant tested, regardless of whether the individual passed or failed the test. The CDL skills test score sheet must contain information such as the CDL applicant’s full name and driver license number, information on the CMV used for the test, CMV insurance information, the CDL skills test site and on-road drive route identifiers, the CDL Third Party Examiner’s name, and the time and date of the test and test results.

Conclusion

To use third-party customer service tools that collect personal information in Oregon, you must comply with the state’s privacy laws. The requirements for handling personal information are outlined in various Oregon Administrative Rules, including ORAR 735-010-0120, ORAR 735-010-0110, ORAR 411-005-0010, ORAR 860-086-0030, and ORAR 735-060-0057.

Jurisdiction

Oregon

• Privacy