Are mandatory arbitration provisions recognized in your state? If so, are there any limitations to its enforcement?

Yes, Oregon generally recognizes mandatory arbitration provisions. Mandatory arbitration provisions are enforceable, except upon a ground that exists at law or in equity for the revocation of a contract. An arbitrator shall decide whether a condition precedent to arbitrability has been fulfilled.[i]

What is your state’s law, if any, regarding gift cards, subscription services and loyalty programs?

Gift Cards

Unless sold at a discount, gift cards cannot have an expiration date. If the gift card was sold at a discount, the card may state an expiration date, but it must be at least 30 days after it was sold.[ii] If a merchant declares bankruptcy or closes a local store before a gift card is used, it may render the card useless regardless of the expiration date. Maintenance, service, or other fees may not be used to reduce the value of a gift card.

Subscription Services

Regarding subscription services, it is unlawful to (1) fail to present the continuous service offer terms in a clear and conspicuous manner before a subscription or purchasing agreement is fulfilled and in visual proximity; (2) charge the consumer’s credit or debit card or payment account with a third party for an automatic renewal or continuous service without first obtaining the consumer’s affirmative consent to the agreement containing the automatic renewal offer terms or continuous service offer terms; (3) fail to provide an acknowledgement that includes the automatic renewal offer/continuous service offer terms and information regarding how to cancel in a manner that is capable of being retained by the consumer. If the offer includes a free trial, the person shall also disclose in the acknowledgement how to cancel and allow the consumer to cancel before paying for the goods or services.[iii]

Loyalty Programs

There are no state laws regarding loyalty programs.

What is your state’s law, if any, regarding safeguarding consumer credit card or other private data (i.e., cyber security)?

On June 25, 2023, the Oregon House and Senate signed Senate Bill 619, titled the Oregon Consumer Privacy Act (the “Act”), which will take effect July 1, 2024. In short, the Act regulates the collection of private date from businesses and persons. Specifically, the Act requires controllers that sell personal data or use personal data for targeted advertising purposes to respond to universal opt-out signals. It also requires prior consent for the processing of children’s data (an individual under the age of 13) for the purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects.

The Act applies to any person that conducts business in Oregon or provides products or services to Oregon residents, and during a calendar year controls or process: (a) the personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) the personal data of 25,000 or more consumers while deriving 25% or more of its annual gross revenue from selling personal data.

The Act defines sensitive data broadly and includes information that reveals a consumer’s racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or non-binary, status as a victim of crime or citizenship or immigration status, as well as specified precise location data, children’s data, and biometric data.

The Oregon Attorney General may bring action to seek a civil penalty of up to $7,500 for each violation or to obtain injunctive or other equitable relief.

What is your state’s law, if any, regarding the collection and handling of financial information?

The Oregon Identity Theft Protection Act, effective October 1, 2007, provides consumers with tools to protect themselves against identity theft and gives clear direction and expectations to organizations to ensure the safety of customers and employees personal information. Financial account information is included in the statute’s definition of personal information

As stated in the cybersecurity section above, Senate Bill 619, also known as the Oregon Consumer Privacy Act takes effect July 1, 2024, and has numerous sections related to financial information including Section(2)(j), (k), and (l) related to financial institutions handling financial information.

[i] ORS § 36.620.

[ii] ORS §§ 646A.276 and 646.278.

[iii] ORS § 646A.295(1).