Ask Reggi Your Question Now
Can I use third-party project management tools that collect personal information in Oregon? What are the requirements?
Use of Third-Party Project Management Tools that Collect Personal Information in Oregon
If you are planning to use third-party project management tools that collect personal information in Oregon, you must comply with the state’s laws and regulations regarding the disclosure of information to clients or third parties [2.1].
According to ORAR 411-005-0010, the Department must make information in a client case record or record of service available to the client or anyone authorized by the client. Information that was obtained from a third party becomes part of the case record of the client and is available to the client. Case record information may be requested by the client and released to the client or third party by telephone. The client must satisfy the local office as to their identity. A verbal authorization from the client is permitted to allow verbal release of case record information specified by the client to third parties. Each authorization is valid for a period of 30 days from the date the authorization is given verbally, unless a shorter time period is given.
Therefore, if the third-party project management tool collects personal information that is part of the client’s case record, the client must authorize the release of that information to the third party. The Department must disclose only the minimum amount of information necessary for the purpose [2.1].
Use of Social Security Numbers
If the third-party project management tool collects social security numbers, you must comply with the state’s laws and regulations regarding the use of social security numbers [3.1].
According to ORAR 111-060-0001, the Oregon Educators Benefit Board (OEBB) will comply with the requirements of Section 7 of the Privacy Act of 1974 and the Oregon Consumer Identity Theft Protection Act, ORS 646A.600 to 646A.628 when requesting or requiring complete or partial disclosure of an eligible employee’s or family member’s social security number.
If the social security number is requested voluntarily, the eligible employee or family member must grant consent for that use. If, after having provided notice and received consent to use an eligible employee’s or family member’s social security number for specified purposes, OEBB wishes to use the social security number for additional purposes not included in the original notice and consent, OEBB must provide the eligible employee or family member notice and receive the eligible employee’s or family member’s consent to use the number for those additional purposes.
Therefore, if the third-party project management tool collects social security numbers, you must provide notice and receive consent from the eligible employee or family member for the use of the social security number.
Conclusion
To summarize, if you plan to use third-party project management tools that collect personal information in Oregon, you must comply with the state’s laws and regulations regarding the disclosure of information to clients or third parties and the use of social security numbers. If the third-party project management tool collects personal information that is part of the client’s case record, the client must authorize the release of that information to the third party. If the third-party project management tool collects social security numbers, you must provide notice and receive consent from the eligible employee or family member for the use of the social security number.
Source(s):
Jurisdiction
Oregon