Law / United States / 
Hawaii
Destruction of Personal Information Records
Haw. Rev. Stat. Secs. 487R-1 to 487R-3
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Retention
What it requires
- This binds any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses personal information of a Hawaii resident.
- Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.NIST CSF 2.0ID.AM-08
- Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.NIST CSF 2.0ID.AM-08
- Describe the adequate destruction or proper disposal of personal records as official policy in the business's own writings.NIST CSF 2.0ID.AM-08
- Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.NIST CSF 2.0GV.SC-06
- This chapter does not apply to a financial institution subject to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), a health plan or health care provider subject to and compliant with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security standards, or a consumer reporting agency subject to and compliant with the Fair Credit Reporting Act.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Ceiling stated as 'not more than $2,500 for each violation' with no aggregate cap named; brought by the attorney general or the executive director of the office of consumer protection, and never against a government agency.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
Hawaii Attorney General or the executive director of the Hawaii Office of Consumer Protection
Settledness
- As of
- Open questions
- Does "shall include" in Haw. Rev. Stat. Sec. 487R-2(b) make each listed practice mandatory for every business, or only a floor for the "reasonable measures" that section 487R-2(a) requires?
- What suffices as due diligence over a records-destruction vendor under Haw. Rev. Stat. Sec. 487R-2(c), where the statute says due diligence "should ordinarily include" one or more of three steps?
What this law does
Haw. Rev. Stat. ch. 487R, effective (Act 136, 2006 Regular Session, SB2292 SD2 HD1 CD1), requires any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses a Hawaii resident's personal information, to take reasonable measures to protect against unauthorized access to or use of that personal information in connection with or after its disposal.
The duty is satisfied by burning, pulverizing, recycling or shredding paper records and destroying or erasing electronic and other nonpaper media so the information cannot practicably be read or reconstructed, or by exercising due diligence over a contracted records-destruction vendor. A financial institution subject to the Gramm-Leach-Bliley Act, a Health Insurance Portability and Accountability Act (HIPAA)-compliant health plan or health care provider, and a Fair Credit Reporting Act-compliant consumer reporting agency are exempt.
A violating business is subject to a civil penalty of not more than $2,500 per violation, brought by the attorney general or the executive director of the office of consumer protection, and is separately liable to the injured party for actual damages and, at the court's discretion, reasonable attorneys' fees. No action under the chapter may be brought against a government agency, which instead must report a material breach of disposed records to the legislature under section 487R-4.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .