Want to Read More? To continue reading this article, please Log in or Register Now

Employee Privacy: Oregon

Employee Privacy requirements for other states

Federal law and guidance on this subject should be reviewed together with this section.

Author: Christina Thacker, Barran Liebman LLP


  • Oregon has both civil and criminal invasion of privacy claims that Oregon employers could potentially be liable for. See Common Law Invasion of Privacy Claims; Criminal Invasion of Privacy.
  • Oregon employers cannot obtain or use an applicant's or an employee's credit history information for employment purposes, except in limited circumstances. See Background Checks - Criminal Records and Credit Checks.
  • Applicants and employees have protections from employers seeking to subject them to any polygraph examination, psychological stress test, or brain-wave test. See Employee Testing.
  • Oregon law allows the medical use of marijuana, but currently, employers do not need to accommodate medical marijuana users under disability law. See Medical Marijuana.
  • Oregon employers must safeguard an employee's confidential information under the Oregon Consumer Identity Theft Protection Act, which includes limiting employers to the public display or disclosure of only the last four digits of a Social Security number, among other requirements. See Data Protection.
  • An employer can only record a conversation with an employee if the employer has informed the employee specifically that the conversation is being recorded. See Wiretapping and Eavesdropping.
  • Oregon employees have the right to review personnel records on request and to obtain copies. See Other Oregon Privacy-Related Laws; Personnel Records and Information.
  • Portland has requirements pertaining to employee privacy. See Local Requirements.

Common Law Invasion of Privacy Claims

Oregon recognizes a right of privacy and a cause of action for damages arising from a breach of that right. There are four separate and distinct legal theories called invasion of privacy each of which requires proof of a private fact and that the invasion or intrusion was unreasonable and without consent:

  1. Intrusion upon seclusion;
  2. Public disclosure of private facts;
  3. Placing a person in a false light; and
  4. Appropriation of name or likeness.

A claim of invasion of privacy generally must be brought within two years. +ORS 12.110(1).


For each of the above legal theories of an invasion of privacy claim, an absolute or qualified privilege may apply to dismiss the claim, depending on the specific context.

The privilege is lost if abused, that is, if there is evidence of actual malice.

An element of all theories of common law invasion of privacy claims is that the invasion of the plaintiff's interest occurred without consent; lack of consent is the plaintiff's burden to prove.

Consent to any publication of a matter that invades one's privacy creates an absolute privilege, as long as the publication does not exceed the scope of the consent.

Criminal Invasion of Privacy

There is a crime of invasion of privacy if a person invades a reasonable expectation of privacy and knowingly observes, or photocopies, or makes a visual recording of another person in a state of nudity without consent, where the other person has a reasonable expectation of privacy, and a related civil cause of action at +ORS 30.865, which provides for attorney fees. +ORS 163.700.

Background Checks - Criminal Records and Credit Checks

In general, employers may conduct background checks on their employees or applicants that include criminal history; however, as with federal antidiscrimination laws, employers in Oregon should also be concerned about potential discrimination claims by applicants under state antidiscrimination laws.

Additionally, Oregon employers cannot obtain or use an applicant's or an employee's credit history information for employment purposes. +ORS 659A.320. Oregon law prohibits an employer from using such information to:

  • Refuse to hire;
  • Discharge;
  • Demote;
  • Suspend;
  • Retaliate; or
  • Otherwise discriminate against an applicant or an employee with regard to promotion, compensation or the terms, conditions or privileges of employment.

Credit history includes any communication of any information by a consumer reporting agency that bears on a consumer's creditworthiness, credit standing or credit capacity.

The law does make a few exceptions, including for:

  • Federally insured banks and credit unions;
  • Employers that are required by state or federal law to use individual credit history for employment purposes;
  • Public safety officers who are (or will be) a member of a law enforcement unit or employed as a peace officer commissioned by certain entities (for example, a city, port, school district) and who are responsible for enforcing the criminal laws; or
  • If the information is substantially job-related and the employer's reasons for using such information are disclosed to the employee or prospective employee in writing.

Substantially job-related means that an employer can include credit history information in their background check process if:

  • An essential function of the job requires access to financial information not customarily required in a retail transaction other than a loan or extension of credit (i.e., beyond check information, credit card numbers or debit card numbers); or
  • The employer is required to obtain credit history information as a condition of bonding or insuring the employee.

Employers should use the substantially job-related exception with care. A credit history check is not substantially job-related for positions such as mechanics, cashiers, receptionists, housekeepers and wait-staff. However, the exception will likely apply if an essential job function requires an employee to obtain financial institution account numbers and amounts and sources of income.

Ban the Box

It is unlawful in Oregon to exclude an applicant from an initial job interview solely because of a past criminal conviction. This means an employer may not require an applicant to disclose a past conviction on an employment application. And if no interview is conducted, an employer may not require an applicant to disclose a criminal conviction before a conditional job offer has been made. +2015 Bill Text OR H.B. 3025.

Exemptions are provided in the following situations:

  • Federal, state or local law requires the consideration of an applicant's criminal history;
  • The employer is a law enforcement agency or in the criminal justice system; and
  • The employer is seeking a nonemployee volunteer.

The law does not directly specify which businesses are covered, so Oregon employers should assume it includes them unless one of the above exemptions applies. Employers that violate this criminal history law will be subject to fines of up to $1,000 per violation. However, the measure does not permit individuals to file lawsuits.

Portland has requirements pertaining to ban the box. See Local Requirements.

Employee Testing

Lie Detector/Polygraph Tests

It is an unlawful employment practice for any employer to subject any employee or prospective employee to any polygraph examination, psychological stress test, or brain-wave test. +ORS 659A.300. A polygraph examination is defined by Oregon law to include a test to detect deception or to verify the truth of statements through the use of instrumentation or mechanical devices. +ORS 659A.300(2)(c)].

However, a polygraph examination can be administered to an individual if the individual consents and it occurs during the course of criminal or civil judicial proceeding in which the individual is a party or witness. +ORS 659A.300(3).

Genetic Testing

It is an unlawful employment practice for any employer to subject any employee or prospective employee to any genetic test. +ORS 659A.300. A genetic test is any test for determining the presence or absence of genetic characteristics in an individual or the individual's blood relatives, including tests of nucleic acids such as DNA, RNA and mitochondrial DNA, chromosomes or proteins in order to diagnose or determine a genetic characteristic. +ORS 659A.300(2)(b); +ORS 192.531.

An employer can administer a genetic test if the employee grants informed consent, and the genetic test is administered solely to determine a bona fide occupational qualification. +ORS 659A.300(5); +ORS 192.535.

It is an unlawful employment practice for an employer:

  • To seek to obtain, to obtain, or to use genetic information of an employee or a prospective employee (or of a blood relative of the employee or prospective employee); and
  • To distinguish between, or discriminate against, or restrict any right or benefit otherwise due or available to an employee or a prospective employee.

+ORS 659A.303; +ORS 192.531.

Drug and Alcohol Testing

Medical testing of employees is highly regulated by provisions of the federal Americans with Disabilities Act and ORS Chapter 659A. Oregon statutes do not restrict an employer's right to conduct drug and alcohol testing except for blood alcohol. +ORS 659.840.

It is an unlawful employment practice for any employer to subject any employee or prospective employee to any breathalyzer test. +ORS 659A.300. An employer, however, can administer a breathalyzer to an employee if he or she consents. +ORS 659A.300(4). If the employer has reasonable grounds to believe that an employee is under the influence of intoxicating liquor, the employer may require, as a condition for employment or continuation of employment, the administration of a blood alcohol content test by a third party or a breathalyzer test. +ORS 659A.300(4). The employer must pay the cost of administering any such test.

Although Oregon statutes do not specifically address the legality of drug testing of employees, employers must be mindful of employees' constitutional privacy rights.

Accordingly, employers conducting drug testing in Oregon should:

  • Create a clear written policy on drug testing to fully explain to employees that they could be subject to testing;
  • Advise employees in advance of implementing the policy the circumstances in which they will be subjected to testing, e.g., randomly, where there is cause (that is, when the employer has reasonable suspicion of drug use), or when an employee is involved in a workplace incident or accident; and
  • Ensure that their policy and practices are consistently and fairly applied.

An employer can create different testing standards for different classifications of workers, as long as the standards are grounded in legitimate business reasons. For example, an employer can set higher standards for delivery drivers than for office staff.

An employer can discipline or terminate employees who screen positive for current use of illegal drugs if the notice and testing are done in a proper manner; in such cases, individuals will not be protected by the ADA or Oregon disability laws.

Once an employer decides to conduct drug testing, Oregon statutes and regulations require clinical laboratories to be licensed and employ qualified technical personnel for medical and non-medical substance abuse screening. +ORS 438.050; +ORS 438.130; +ORS 438.435; +OAR 333-024-0305 et seq.

Additionally, for employers that enter into public improvement contracts, Oregon law requires those contractors to have an employee drug testing program in place. +ORS 279C.505.

Medical Marijuana

Oregon law allows the medical use of marijuana. ORS § 475.300 to § 475.346. After several years and much confusion over what this means to Oregon employers, the state's medical marijuana program is limited to providing an exemption from state criminal laws regarding marijuana (and it does not either impose an additional requirement on employers or provide additional protection for employees).

In other words, employers do not need to accommodate medical marijuana users under disability law. Additionally, an employer does not have to engage in the interactive process in order to accommodate an employee's use of medical marijuana; however, an employer must still engage in the interactive process in order to accommodate any underlying disability.

Recreational Marijuana

On November 4, 2014, Oregon voters approved a referendum to legalize the use of small amounts of marijuana for recreational use. Effective July 1, 2015, adults 21 and over are able to possess up to eight ounces of marijuana at home, grow up to four marijuana plants per household and possess up to one ounce of marijuana in public.

This law does not impose any new limits on employers and does not prevent them from continuing to maintain a drug-free workplace policy. As with medical marijuana, employers are not required to make an exception for a job applicant or employee who claims they need to use recreational marijuana to accommodate a disability.

Computer Monitoring

Employers generally have a right to monitor employee computer usage either at the worksite or of employer systems. Whether computers or computer systems are private depends largely on employer policies. Some of the protocols for use of computer systems might provide a reasonable expectation of privacy to employees.

For example, allowing employees to select a password that is not known to the employer or permitting employees to set up security protocols for private documents could give rise to a reasonable expectation of privacy.

To reduce or eliminate employees' expectation of privacy, employers should create policies that inform employees that:

  • Use of employer computer equipment is for business purposes only; and
  • All use will be monitored by the employer.

Employers should then consistently apply their policy, as with any policy.

Social Media Privacy

Oregon law prohibits an employer from requiring or requesting that an employee or applicant disclose or provide access to the individual's personal social media account through a user name and password of other means of identification; compelling an employee or appellant to add the employer or its agent to the individual's contacts list; compelling an employee or applicant to access a personal social media account in the employer's presence so that the employer may view the account's contents, requiring or requesting that an employee or applicant establish a personal social media account or requiring an employee or applicant to authorize the employer to advertise on the individual's social media account. Further, an employer may not retaliate against employees or refuse to hire applicants who refuse to provide such information. However, the law contains some limited protections for employers. +ORS 659A.330 .

However, the law does contains some exceptions offering employers protection. An employer can conduct an investigation, without requiring an individual to provide information with respect to a personal social media account, to ensure compliance with laws, regulations or prohibitions agaisnt work-related employee misconduct based on the employer receiving specific information about the employee's personal online account or service activity or to share content that has been reported to the employer which is necessary for the employer to make a factual determination about the matter. Further, an employer also can require an employee to disclose a user name and password and other means of accessing an account provided by, or on behalf of the employer or to be used on the employer's behalf. If an employer inadvertently receives an employee's personal social media account user name and password or other means of accessing such an account through the use of an electronic device or program that monitors usage of the employer's network or employer- provided devices, the employer is not liable for having the information, but it cannot use the information to access the employee's personal social media account. An employer can access information available to the public about an employee or applicant that is accessible through an online account. The law does not prevent employers form complying with state and federal laws, rules and regulations and rules of self-regulatory organizations. An employer is not liable for failing to request or require that an individual disclose information regarding personal social media accounts.

Data Protection

Under the Oregon Consumer Identity Theft Protection Act, an employer must make provisions to protect data, as well as ensure the proper steps are taken should a security breach occur. The Act covers those entities that use, store, own, maintain or otherwise possess data that includes a consumer's personal information. It also covers anyone who otherwise possesses personal information or received a notice of a breach of security from another person that maintains or otherwise possesses personal information on the person's behalf. +ORS § 646A.602; +ORS § 646A.604.

Personal information is defined under the Act as a consumer's first name (or first initial) and last name, as well as any of the following:

  • Social Security Number;
  • Driver's license number or state identification card number:
  • Passport number or other US-issued identification number;
  • Financial account number or credit or debit card number, in combination with any required security code, access code or password that would permit access to the individual's financial account(s);
  • Health insurance policy number;
  • Medical information;
  • Biometric information, including fingerprint, retina or iris prints; or
  • Any other information or combination of information that a person reasonably knows or should know would permit access to the consumer's financial account.

According to the law, if unauthorized access of useable or unencrypted personal information occurs, an employer must perform specific acts to notify affected consumers and others of the event.

If a data breach of personal information occurs, an employer must provide written, electronic or telephone notice to the affected residents. Notification of a breach be made in the most expeditious manner, without unreasonable delay, but no later than 45 days after discovering or receiving notification of the breach. Also, notification must be provided to the state attorney general within a reasonable time frame, at least one copy of any notice the person sends to consumers.

In providing the notice, the entity must use reasonable measures that are necessary to:

  • Determine the sufficient contact information for the intended recipient of the notice;
  • Determine the scope of the breach of security; and
  • Restore the reasonable integrity, security and confidentiality of the personal information.

If the cost of providing notice is in excess of $250,000 or the number of affected residents exceeds 350,000, then the employer may provide substitute notice. Additionally, if there is not sufficient contact information to inform the affected residents, substitute notification is also required.

Substitute notices consist of the following:

  • Conspicuous posting of the notice on the employer's website; and
  • Notification to major statewide media.

The state also mandates what should be contained in the notice. At the minimum, notices should incude the following:

  • A description of the breach of security;
  • The approximate date of the breach;
  • The type of personal information that was subject to the breach;
  • Contact information for the person that gave the notice;
  • Contact information for national credit reporting agencies; and
  • Advice to the consumer to report suspected identity theft to law enforcement, including the Attorney General and the Federal Trade Commission.

Any breach affecting more than 250 residents must be reported to the state Attorney General either electronically or in writing.

If the security breach affects more than 1,000 consumers, the employer must notify (without unreasonable delay) all nationwide consumer reporting agencies. The notice must include any police report number assigned to the breach.

All pertinent notification requirements must be complied with, unless an investigation or consultation with law enforcement determines no reasonable harm to consumers has occurred. The law requires that this determination must be documented in writing and maintained for a period of five years following the event.

See Workplace Security: Oregon.

Wiretapping and Eavesdropping

In Oregon, the recording of a conversation may occur with the consent of one party, however, all participants in the conversation must be specifically informed that the conversation is being recorded. +ORS 165.535-549.

In the following circumstances, notification and consent is not required:

  • For employees of a telecommunication or radio communications company who are performing duties related to the construction or maintenance of their service, facilities or equipment;
  • For public officials in charge of jails, police premises, sheriffs' offices, Department of Corrections' institutions, and other correctional institutions; and
  • For any person who records a conversation during a felony that endangers human life.

+ORS 165.540.

Additionally, an individual can record oral communications that are part of public or semi-public meetings such as Hearings before a governmental or quasi-governmental body; trials; press conferences; public speeches and rallies; educational activities; and private meetings as long as the recording device is not concealed and all others involved knew or reasonably should have known that the recording was being made. +ORS 165.540(6).

In light of these statutory provisions, any employer that records telephone calls for training purposes or customer service monitoring, or that monitors employee use of internet and computer communications, should provide notice to employees and customers of this practice.

Workplace Surveillance

An Oregon corporation can be criminally liable for the offenses of its agents acting within the scope of their employment and on behalf of the corporation. +ORS 161.170 et seq. This liability applies beyond the context of surveillance, but fits appropriately here as a reminder to employers.


On or off premises surveillance of an employee may be permissible or may lead to criminal charges, depending on the circumstances. +ORS 163.700.

For example, surveillance of an employee who submits a workers' compensation claim is allowable because the employee implicitly agrees to surveillance consistent with a reasonable claim investigation. See McLain v. Boise Cascade Corp., +271 Or. 549 (1975).

In other words, as long as the surveillance is conducted in a reasonable and unobtrusive manner there will not be a viable claim for invasion of privacy.

Trespass alone cannot automatically change an otherwise reasonable surveillance into an unreasonable one. But "trespass to peer in windows and to annoy or harass the occupant may be unreasonable." See Kramer v. Consolidated Freightways, Inc., +255 F.3d 683 (9th Cir. 2001) (secret videotaping of employee restrooms through two-way mirrors as a result of concerns for drug use was per se outrageous).

Regular Mail

Oregon statutes prohibit opening mail addressed to another person. +ORS 165.520.

Romantic Relationships

An employer can impose restrictions on romantic relationships between employees, but employers must also be aware that Oregon law protects employees from discrimination on the basis of familial relationships. +ORS 659A.309.

An Oregon employer cannot:

  • Refuse to hire or employ an individual;
  • Bar or discharge from employment an individual; or
  • Discriminate against an individual in compensation or in terms, conditions or privileges of employment

solely because another member of an individual's family works or has worked for that employer. +ORS 659A.309(1).

The statute defines member of an individual's family to include the wife, husband, son, daughter, mother, father, brother, brother-in-law, sister, sister-in-law, son-in-law, daughter-in-law, mother-in-law, father-in-law, aunt, uncle, niece, nephew, stepparent or stepchild of the individual. +ORS 659A.309(3). Same-sex domestic partners and family members should also be included in this definition.

Workplace Searches of Employees - Physical

Physical Contact

Instances of unwanted touching may support an invasion of privacy claim, although the gravamen of such a claim may be battery. See Carr v. U.S. West Direct, +98 Or. App. 30 (1989).


Searches of employees' persons, belongings or clothing are not expressly forbidden, but the manner of the search can pose problems for an employer.

For example, if the search is unreasonable, offensive or humiliating, an employer could be liable. See Bodewig v. K-Mart, Inc., +54 Or. App. 480 (1981). In Bodewig a young store clerk was accused by a customer of having stolen money and was required to disrobe partially in the presence of the accusing customer to prove that she had not taken the money.

Searches of Public Employees

A public employer can search an employee's person, vehicle or possessions. See AFSCME Local 2623 v. Department of Corrections, +315 Or. 74 (1992). Because the administrative rule that was challenged required individualized suspicion, it satisfied the requirements of the search and seizure provision of the Oregon Constitution, Article I, Section 9. +Or. Admin. R. 291-041-0005(3).

Other Oregon Privacy-Related Laws

Personnel Records and Information

In Oregon, employees have the right to review personnel records on request and to obtain copies. +ORS 652.750. Upon termination of employment, an employer must keep the records for at least 60 days, however, employers should consider retaining such records for at least six years to defend against potential employment-related claims.

Nothing in the law regulates access to personnel records other than by the employee; protections for the information in personnel records may, however, be created by other statutes. For example, medical information contained in personnel records would be governed by the Americans with Disabilities Act and similar state law.

Employers may also obligate themselves to protect the privacy of employee records by issuing policies representing that such records will be maintained in confidence.

Employees may also complain about privacy interests if sensitive performance information is inappropriately disseminated, as long as the other requirements of the claim are satisfied. See Miller v. Clatsop Care Center Health District, +2004 U.S.Dist. LEXIS 16346 (D. Or. 2004).

Public employee personnel records are public records within the meaning of Oregon's Public Records Act. Personnel disciplinary actions, and related documents, are exempt from disclosure. +ORS 192.501(12). Also, information of a personal nature kept in a personnel, medical or similar file is exempt from disclosure absent clear and convincing evidence of the public interest if "disclosure would constitute an unreasonable invasion of privacy." +ORS 192.502(2).

Lawful Tobacco Use

It is an unlawful employment practice for an employer to require, as a condition of employment, any employee or prospective employee to refrain from using lawful tobacco products during non-working hours except when the restriction relates to a bona fide occupational requirement or when an applicable collective bargaining agreement prohibits off duty use of tobacco products. +ORS 659A.315.

Familial Relationships

Oregon also places limitations on an employer's right to make decisions based on family relationships. +ORS 659A.309. See Employee Management > EEO - Discrimination: Oregon.

Local Requirements

Portland Ban the Box

Portland has a "ban the box" law that provides that employers with six or more employees who perform a majority of their work in the city may not inquire about or access a job applicant's criminal history before making a conditional employment offer.

Limited exemptions are provided for jobs with law enforcement agencies; direct access to children, the elderly or the disabled; or those presenting public safety concerns.

Future Developments

There are no new developments to report at this time. Continue to check XpertHR regularly for the latest information on this and other topics.

Additional Resources

Employee Management > Employee Privacy