Records text chat, in Hawaii

Haw. Rev. Stat. Secs. 487R-1 to 487R-3 · Read the law's page

• Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.
• Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.
• Describe the adequate destruction or proper disposal of personal records as official policy in the business's own writings.
• Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.
• This binds any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses personal information of a Hawaii resident.
• This chapter does not apply to a financial institution subject to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), a health plan or health care provider subject to and compliant with the HIPAA privacy and security standards, or a consumer reporting agency subject to and compliant with the Fair Credit Reporting Act.