2011 ORS § 646A.204¹
Customer information

(1) In a credit or debit card transaction with a customer, a person may not create a customer receipt that shows more information about a customer than the customers name and five digits of the customers credit or debit card number.

(2) A person that creates or retains a copy of a receipt containing more information about a customer than the customers name and five digits of the customers credit or debit card number shall shred, incinerate or otherwise destroy the copy on or before the sooner of:

(a) The date the image of the copy is transferred onto microfilm or microfiche; or

(b) Thirty-six months after the date of the transaction that created the copy. [Formerly 646.888]