Law / United States / 
Hawaii
Hawaii Security Breach of Personal Information Act, penalties and civil action
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Expect a Hawaii resident injured by a business's violation of this Act to have a private right of action for actual damages plus attorneys' fees, on top of a state penalty of up to $2,500 per violation.
- Do not assume government-agency status shields a private violator from suit. The exemption from private and state enforcement action runs to government agencies only, not to a private business handling data on a government agency's behalf.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
This civil penalty, sought by the Attorney General or the executive director of the Office of Consumer Protection, is separate from the actual damages available to an injured party under Haw. Rev. Stat. Sec. 487N-3(b).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
Who enforces it
Enforcement body
Hawaii Attorney General or the executive director of the Office of Consumer Protection (Haw. Rev. Stat. Sec. 487N-3(a)).
Settledness
- As of
- Open questions
- Do the costs of credit monitoring, or the time a person spends responding to a breach notice, count as 'actual damages sustained by the injured party as a result of the violation' under HRS 487N-3(b), or must the person show that the exposed data was misused?
- Does 'each violation' in HRS 487N-3(a), for the penalty of not more than $2,500, count each affected person, each late notice or each missing element of a notice?
What it makes you log
Logging duty
Section 487N-3 sets a penalty of not more than $2,500 for each violation, civil liability to the injured party for actual damages, and enforcement by the attorney general or the executive director of the Office of Consumer Protection. It names no log or record duty. The section as cited has no scope clause of its own: the reach words ('residents of Hawaii', 'conducts business in Hawaii') are in section 487N-2(a), which this row does not cite, so no hook is taken here. Section 487N-7 (annual report of personal information systems by a government agency) sits outside the row.
- Kind
- None
- As of
What this law does
A business that violates any provision of the Security Breach of Personal Information Act is subject to a penalty of not more than $2,500 per violation, brought by the Attorney General or the executive director of the Office of Consumer Protection. Separately and additionally, a violating business is liable to the injured party for actual damages sustained as a result of the violation, and the court may award reasonable attorneys' fees to the prevailing party.
No action under either route may be brought against a government agency, so the private right of action and the state enforcement action both reach only private businesses despite the notice duty itself extending to government agencies.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .