Law / United States / 
Hawaii
Hawaii Security Breach of Personal Information Act, notice of security breach
Haw. Rev. Stat. Secs. 487N-1, 487N-2
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Provide clear and conspicuous notice, without unreasonable delay, to a Hawaii resident affected by a security breach of a system containing their personal information, describing the incident, the type of information exposed, and remedial steps taken.
- If you are a business and provide notice to more than 1,000 persons at one time, notify in writing, without unreasonable delay, the State of Hawaii's Office of Consumer Protection and every nationwide consumer reporting agency of the timing, distribution, and content of the notice.
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Hawaii's personal information definition does not include any of those categories.
These lines are LexLint's reading of the law's text. Also read by: Office of Consumer Protection, Hawaii Department of Commerce and Consumer Affairs (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Office's page states the threshold as one thousand or more Hawaii residents affected, where section 487N-2(f) reads more than one thousand persons at one time.
- As of
- Guidance link
- https://cca.hawaii.gov/ocp/notices/security-breach/
- Guidance body
- Office of Consumer Protection, Hawaii Department of Commerce and Consumer Affairs
- Open questions
- Is notice to the Office of Consumer Protection under HRS 487N-2(f) due when a business notifies exactly 1,000 persons, as the Office's page says of 'one-thousand (1000) or more Hawaii residents', or only when it notifies 'more than one thousand persons at one time'?
What it makes you log
Logging duty
Section 487N-2 requires notice of a breach to the affected person, to the owner or licensee, and in a breach reaching more than 1,000 persons to the Office of Consumer Protection and the consumer reporting agencies, but it names no log or record the business keeps of the breach. Subsection (c) lets a delay for law enforcement run when the request is in writing or the business documents it in writing with the officer's name and agency; that is a condition for delaying the notice, not a standing record. The record-adjacent duties sit outside the cited sections: section 487N-7 (annual report of each personal information system by a government agency to the information privacy and security council) and the council's reporting provisions in 487N-4. Section 487N-1 holds only definitions.
- Kind
- None
- As of
What this law does
A business that owns or licenses personal information of Hawaii residents, a business conducting business in Hawaii that owns or licenses such information, and a government agency that collects personal information for government purposes must each provide notice, without unreasonable delay, to a person affected by a security breach.
Notice must be clear and conspicuous, describe the incident and the type of personal information exposed, describe remedial steps taken, give a contact number, and advise the recipient to monitor credit reports; substitute notice is available above a $100,000 cost or 200,000-person threshold. Above a 1,000-person notice threshold, the business must also notify the State of Hawaii's Office of Consumer Protection and nationwide consumer reporting agencies.
Hawaii's personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code or password, excludes information lawfully made public through federal, state, or local government records, and has no biometric, genetic, or health category, so a breach of biometric data alone triggers no notice duty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .