On May 25, 2017, Oregon Governor Kate Brown signed into law H.B. 2090. This new law will make materially inaccurate claims related to the collection, use, disclosure, maintenance, and disposal of consumer data an unlawful trade practice subject to enforcement by the Attorney General. The law applies not only to claims made on websites (privacy policies come to mind), but also in consumer agreements (ISP and cloud hosting agreements come to mind).
Businesses typically review their standard contract forms on a regular basis during negotiations with customers and vendors. Those reviews provide an opportunity to identify claims related to data security that may no longer be accurate. But website privacy policies—rarely the subject of negotiation—are much more likely to be neglected for long periods of time. A best practice is to routinely review your contract forms and privacy policy to ensure they still accurately reflect how you collect, store, and use data. This new Oregon law provides extra incentive to keep those contracts and policies up to date!
If you have any questions about how to craft a privacy policy, or how to describe your data security practices in contracts, please let us know. We’d love to help.
