77th OREGON LEGISLATIVE ASSEMBLY--2013 Regular Session NOTE: Matter within { + braces and plus signs + } in an amended section is new. Matter within { - braces and minus signs - } is existing law to be omitted. New sections are within { + braces and plus signs + } . LC 3647 House Bill 2936 Sponsored by COMMITTEE ON CONSUMER PROTECTION AND GOVERNMENT EFFICIENCY SUMMARY The following summary is not prepared by the sponsors of the measure and is not a part of the body thereof subject to consideration by the Legislative Assembly. It is an editor's brief statement of the essential features of the measure as introduced. Prohibits financial institution from selling, sharing, transferring or otherwise disclosing consumer's personal financial information to unaffiliated party without first receiving consumer's explicit consent. Permits enforcement of violation as unlawful trade practice. Declares emergency, effective on passage. A BILL FOR AN ACT Relating to the privacy of consumer financial information; creating new provisions; amending ORS 646.608; and declaring an emergency. Be It Enacted by the People of the State of Oregon: SECTION 1. { + As used in this section and section 2 of this 2013 Act: (1) 'Account verification service' means a person that for a fee or other consideration, including a subscription or membership dues, or on a cooperative basis with another person without exchanging consideration, regularly engages in a practice of: (a) Assembling information about how frequently and where a consumer opens or attempts to open a depository account and instances when a depository institution closes a consumer's account; or (b) Authenticating or validating Social Security numbers and addresses and reporting the results of the person's attempt at authentication or validation to other persons for the purpose of preventing fraud. (2) 'Consumer' means an individual who is a resident of this state and who deposits or invests the individual's funds with or borrows from a financial institution or who serves as a surety or guarantor on a loan. (3) 'Credit reporting agency' means a person that for a fee or other consideration, including a subscription or membership dues, or on a cooperative basis with another person without exchanging consideration, regularly engages in a practice of: (a) Assembling or evaluating consumer credit information or other information concerning a consumer; and (b) Reporting the results of the person's assembly or evaluation to other persons for the purpose of rating or assessing the consumer's creditworthiness. (4) 'Financial institution' has the meaning given that term in ORS 706.008. (5) 'Mercantile agency' means a person that for a fee or other consideration, including a subscription or membership dues, or on a cooperative basis with another person without exchanging consideration, regularly engages in a practice of: (a) Assembling or evaluating business credit information or other information concerning a business; and (b) Reporting the results of the person's assembly or evaluation to another person for the purpose of assessing the business's creditworthiness. (6) 'Person' means an individual, trust, corporation, partnership, joint venture, association, limited liability company or other business entity. (7) 'Personal financial information' means information that concerns a consumer's finances, that is not widely available to the public and that is, is a copy of or is derived from: (a) A document that by means of the consumer's signature grants access to or authority over a demand, time, savings, passbook, share or share draft account or similar account that the consumer maintains with a financial institution; (b) A statement, ledger card or other record that shows transactions in or with reference to a demand, time, savings, passbook, share or share draft account or similar account that the consumer maintains with a financial institution; (c) A check, draft or money order drawn on or issued or payable by or through a financial institution; (d) A withdrawal from, deposit to or transfer or exchange between a consumer's account and another person's account, other than a periodic charge that a financial institution imposes on the consumer's account, that occurs as the result of an agreement between a financial institution and the other person; (e) Information related to a consumer's loan account or application for a loan; or (f) Evidence of a transaction conducted by electronic or telephonic means. (8) 'Unaffiliated party' means a person that, directly or indirectly, is not under the control of, is not under common control with or does not control a person that receives, possesses, uses or processes, distributes or transfers a consumer's personal financial information. + } SECTION 2. { + (1) Except as provided in subsection (3) of this section, a financial institution may not sell, share, transfer or otherwise disclose personal financial information with or to an unaffiliated party unless the financial institution first receives explicit consent from the consumer to whom the financial information relates. The Director of the Department of Consumer and Business Services by rule shall specify the form, means and contents of the consent that a financial institution must receive under the provisions of this section. (2) A person that receives personal financial information from a financial institution may not sell, share, transfer or otherwise disclose the personal financial information with or to another person unless the financial institution may lawfully sell, share, transfer or otherwise disclose the financial information with or to the other person directly. (3) Subsections (1) and (2) of this section do not apply to a disclosure: (a) To the consumer to whom personal financial information relates, after the financial institution or the person verifies the consumer's identity; (b) That a consumer explicitly authorizes and that is limited to the scope and purpose of the consumer's authorization; (c) To a state agency or agency of a political subdivision of the state that by law is authorized to receive the disclosure; (d) In response to a subpoena, court order or other lawful demand; (e) That occurs in the course of a financial institution's preparing, examining, handling or maintaining records related to a consumer's account; (f) To a certified public accountant who is examining the financial institution's records in the course of an independent audit; (g) To a collection agency or employee or agent of the collection agency or to another person the financial institution engages to assist in recovering an amount owed to the financial institution, if the financial institution or the person makes the disclosure to further the recovery; (h) To an officer, employee or agent of a regulatory agency who examines the financial institution's records in the course of performing the officer's, employee's or agent's official duties; (i) In publications that contain information that is derived from financial records and that does not identify a particular consumer, deposit, account or transaction; (j) In reports, returns or other documents required under state or federal law; (k) That is required or permitted under laws that govern a person's dishonoring a negotiable instrument; (L) That occurs between a financial institution and a credit reporting agency during an exchange of credit information in the regular course of business, if the exchange otherwise complies with the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; (m) That occurs between a financial institution and a mercantile agency or account verification service during an exchange of information in the regular course of business, if the exchange otherwise complies with the Fair Credit Reporting Act, 15 U.S.C. 1681 et seq.; (n) In an exchange of loan information that specifically affects a sale, foreclosure or loan closing if the purpose of the exchange is to accomplish the sale, foreclosure or loan closing; and (o) To civil or criminal law enforcement agencies or within an industry network if the disclosure concerns suspected criminal activities and the agencies use the information in the course of performing the agencies' official duties. (4) A financial institution's or other person's violation of the provisions of this section is an unlawful trade practice that is subject to enforcement under ORS 646.632 or 646.638 and an action under ORS 646.638. + } SECTION 3. ORS 646.608, as amended by section 6, chapter 52, Oregon Laws 2012, is amended to read: 646.608. (1) A person engages in an unlawful practice when in the course of the person's business, vocation or occupation the person does any of the following: (a) Passes off real estate, goods or services as { - those - } { + the real estate, goods or services + } of another. (b) Causes likelihood of confusion or of misunderstanding as to the source, sponsorship, approval, or certification of real estate, goods or services. (c) Causes likelihood of confusion or of misunderstanding as to affiliation, connection, or association with, or certification by, another. (d) Uses deceptive representations or designations of geographic origin in connection with real estate, goods or services. (e) Represents that real estate, goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, quantities or qualities that { - they - } { + the real estate, goods or services + } do not have or that a person has a sponsorship, approval, status, qualification, affiliation, or connection that the person does not have. (f) Represents that real estate or goods are original or new if { - they - } { + the real estate or goods + } are deteriorated, altered, reconditioned, reclaimed, used or secondhand. (g) Represents that real estate, goods or services are of a particular standard, quality, or grade, or that real estate or goods are of a particular style or model, if { - they - } { + the real estate, goods or services + } are of another. (h) Disparages the real estate, goods, services, property or business of a customer or another by false or misleading representations of fact. (i) Advertises real estate, goods or services with intent not to provide { - them - } { + the real estate, goods or services + } as advertised, or with intent not to supply reasonably expectable public demand, unless the advertisement discloses a limitation of quantity. (j) Makes false or misleading representations of fact concerning the reasons for, existence of, or amounts of price reductions. (k) Makes false or misleading representations concerning credit availability or the nature of the transaction or obligation incurred. (L) Makes false or misleading representations relating to commissions or other compensation to be paid in exchange for permitting real estate, goods or services to be used for model or demonstration purposes or in exchange for submitting names of potential customers. (m) Performs service on or dismantles any goods or real estate { - when not authorized by - } { + if + } the owner or apparent owner { - thereof - } { + of the goods or real estate does not authorize the service or dismantling + }. (n) Solicits potential customers by telephone or door to door as a seller unless the person provides the information required under ORS 646.611. (o) In a sale, rental or other disposition of real estate, goods or services, gives or offers to give a rebate or discount or otherwise pays or offers to pay value to the customer in consideration of the customer giving to the person the names of prospective purchasers, lessees, or borrowers, or otherwise aiding the person in making a sale, lease, or loan to another person, if earning the rebate, discount or other value is contingent upon { - occurrence of - } an event { - subsequent to - } { + occurring after + } the time the customer enters into the transaction. (p) Makes any false or misleading statement about a prize, contest or promotion used to publicize a product, business or service. (q) Promises to deliver real estate, goods or services within a certain period of time with intent not to deliver { - them - } { + the real estate, goods or services + } as promised. (r) Organizes or induces or attempts to induce membership in a pyramid club. (s) Makes false or misleading representations of fact concerning the offering price of, or the person's cost for real estate, goods or services. (t) Concurrent with tender or delivery of any real estate, goods or services fails to disclose any known material defect or material nonconformity. (u) Engages in any other unfair or deceptive conduct in trade or commerce. (v) Violates any of the provisions relating to auction sales, auctioneers or auction marts under ORS 698.640, whether in a commercial or noncommercial situation. (w) Manufactures mercury fever thermometers. (x) Sells or supplies mercury fever thermometers unless the thermometer is required by federal law, or is: (A) Prescribed by a person licensed under ORS chapter 677; and (B) Supplied with instructions on the careful handling of the thermometer to avoid breakage and on the proper cleanup of mercury should breakage occur. (y) Sells a thermostat that contains mercury unless the thermostat is labeled in a manner to inform the purchaser that mercury is present in the thermostat and that the thermostat may not be disposed of until the mercury is removed, reused, recycled or otherwise managed to ensure that the mercury does not become part of the solid waste stream or wastewater. For purposes of this paragraph, 'thermostat' means a device commonly used to sense and, through electrical communication with heating, cooling or ventilation equipment, control room temperature. (z) Sells or offers for sale a motor vehicle manufactured after January 1, 2006, that contains mercury light switches. (aa) Violates the provisions of ORS 803.375, 803.385 or 815.410 to 815.430. (bb) Violates ORS 646A.070 (1). (cc) Violates any requirement of ORS 646A.030 to 646A.040. (dd) Violates the provisions of ORS 128.801 to 128.898. (ee) Violates ORS 646.883 or 646.885. (ff) Violates ORS 646.569. (gg) Violates the provisions of ORS 646A.142. (hh) Violates ORS 646A.360. (ii) Violates ORS 646.553 or 646.557 or any rule adopted pursuant thereto. (jj) Violates ORS 646.563. (kk) Violates ORS 759.690 or any rule adopted pursuant thereto. (LL) Violates the provisions of ORS 759.705, 759.710 and 759.720 or any rule adopted pursuant thereto. (mm) Violates ORS 646A.210 or 646A.214. (nn) Violates any provision of ORS 646A.124 to 646A.134. (oo) Violates ORS 646A.095. (pp) Violates ORS 822.046. (qq) Violates ORS 128.001. (rr) Violates ORS 646.649 (2) to (4). (ss) Violates ORS 646A.090 (2) to (4). (tt) Violates ORS 87.686. (uu) Violates ORS 646.651. (vv) Violates ORS 646A.362. (ww) Violates ORS 646A.052 or any rule adopted under ORS 646A.052 or 646A.054. (xx) Violates ORS 180.440 (1) or 180.486 (1). (yy) Commits the offense of acting as a vehicle dealer without a certificate under ORS 822.005. (zz) Violates ORS 87.007 (2) or (3). (aaa) Violates ORS 92.405 (1), (2) or (3). (bbb) Engages in an unlawful practice under ORS 646.648. (ccc) Violates ORS 646A.365. (ddd) Violates ORS 98.854 or 98.858 or a rule adopted under ORS 98.864. (eee) Sells a gift card in violation of ORS 646A.276. (fff) Violates ORS 646A.102, 646A.106 or 646A.108. (ggg) Violates ORS 646A.430 to 646A.450. (hhh) Violates a provision of ORS 744.318 to 744.384, 744.991 and 744.992. (iii) Violates a provision of ORS 646A.702 to 646A.720. (jjj) Violates ORS 646A.530 30 or more days after a recall notice, warning or declaration described in ORS 646A.530 is issued for the children's product, as defined in ORS 646A.525, that is the subject of the violation. (kkk) Violates a provision of ORS 697.612, 697.642, 697.652, 697.662, 697.682, 697.692 or 697.707. (LLL) Violates the consumer protection provisions of the Servicemembers Civil Relief Act, 50 U.S.C. App. 501 et seq., as in effect on January 1, 2010. (mmm) Violates a provision of ORS 646A.480 to 646A.495. (nnn) Violates ORS 646A.082. (ooo) Violates ORS 646.647. (ppp) Violates ORS 646A.115. (qqq) Violates a provision of ORS 646A.405. (rrr) Violates ORS 646A.092. (sss) Violates a provision of ORS 646.644. (ttt) Violates a provision of ORS 646A.295. (uuu) Violates section 3, chapter 52, Oregon Laws 2012. { + (vvv) Violates a provision of section 2 of this 2013 Act. + } (2) A representation under subsection (1) of this section or ORS 646.607 may be any manifestation of any assertion by words or conduct, including, but not limited to, a failure to disclose a fact. (3) In order to prevail in an action or suit under ORS 646.605 to 646.652, a prosecuting attorney need not prove competition between the parties or actual confusion or misunderstanding. (4) An action or suit may not be brought under subsection (1)(u) of this section unless the Attorney General has first established a rule in accordance with the provisions of ORS chapter 183 declaring the conduct to be unfair or deceptive in trade or commerce. (5) Notwithstanding any other provision of ORS 646.605 to 646.652, if an action or suit is brought under subsection (1)(xx) of this section by a person other than a prosecuting attorney, relief is limited to an injunction and the prevailing party may be awarded reasonable attorney fees. SECTION 4. { + Sections 1 and 2 of this 2013 Act and the amendments to ORS 646.608 by section 3 of this 2013 Act apply to disclosures of personal financial information that occur on or after the operative date specified in section 5 of this 2013 Act. + } SECTION 5. { + (1) Sections 1 and 2 of this 2013 Act and the amendments to ORS 646.608 by section 3 of this 2013 Act become operative January 1, 2014. (2) The Director of the Department of Consumer and Business Services may take any action before the operative date specified in subsection (1) of this section that is necessary to enable the director to exercise, on and after the operative date specified in subsection (1) of this section, all of the duties, functions and powers conferred on the director by sections 1 and 2 of this 2013 Act and the amendments to ORS 646.608 by section 3 of this 2013 Act. + } SECTION 6. { + This 2013 Act being necessary for the immediate preservation of the public peace, health and safety, an emergency is declared to exist, and this 2013 Act takes effect on its passage. + } ----------