Processes personal data, in Hawaii

Haw. Rev. Stat. Sec. 481A-4 · Read the law's page

• Expect a person likely to be damaged by a deceptive trade practice, including a misleading claim about data handling, to be able to seek an injunction without proving monetary damage or intent to deceive.
• Do not treat the absence of a chapter 487N breach as the end of private exposure. This separate deceptive-trade-practices statute reaches any deceptive trade practice, not only a data breach.

Haw. Rev. Stat. Sec. 487N-3 · Read the law's page

• Expect a Hawaii resident injured by a business's violation of this Act to have a private right of action for actual damages plus attorneys' fees, on top of a state penalty of up to $2,500 per violation.
• Do not assume government-agency status shields a private violator from suit. The exemption from private and state enforcement action runs to government agencies only, not to a private business handling data on a government agency's behalf.

Haw. Rev. Stat. Secs. 487N-1, 487N-2 · Read the law's page

• Provide clear and conspicuous notice, without unreasonable delay, to a Hawaii resident affected by a security breach of a system containing their personal information, describing the incident, the type of information exposed, and remedial steps taken.
• If you are a business located in Hawaii or conducting business in Hawaii and maintain or possess records containing Hawaii residents' personal information that you do not own or license, or a government agency that maintains or possesses records containing Hawaii residents' personal information, notify the owner or licensee of the information of any security breach immediately following discovery.
• Delay the notice if a law enforcement agency informs you that notification may impede a criminal investigation or jeopardize national security and requests a delay, in writing or documented by you contemporaneously in writing with the officer's name and agency, and give the notice without unreasonable delay once the agency communicates that notice will no longer impede the investigation or jeopardize national security.
• If you are a business and provide notice to more than 1,000 persons at one time, notify in writing, without unreasonable delay, the State of Hawaii's Office of Consumer Protection and every nationwide consumer reporting agency of the timing, distribution, and content of the notice.
• If you are a financial institution subject to the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice or to 12 C.F.R. Part 748, or a health plan or healthcare provider subject to and in compliance with the HIPAA privacy and security standards, you are deemed to comply with the notice section.
• Do not contract out of the notice duty: any waiver of the section is contrary to public policy and void and unenforceable.
• Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Hawaii's personal information definition does not include any of those categories.

Haw. Rev. Stat. Secs. 487R-1 to 487R-3 · Read the law's page

• Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.
• Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.
• Describe the adequate destruction or proper disposal of personal records as official policy in the business's own writings.
• Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.
• This binds any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses personal information of a Hawaii resident.
• This chapter does not apply to a financial institution subject to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), a health plan or health care provider subject to and compliant with the HIPAA privacy and security standards, or a consumer reporting agency subject to and compliant with the Fair Credit Reporting Act.