Hawaii

An Act Relating to Protection from Security Breaches, S.B. No. 2290
CITATION Hawaii Rev. Stat. § 487N-2
ENACTED 2005
SUMMARY Summary: (a) Any business that owns or licenses personal information of residents of Hawaii or any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise) shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach. The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system.
DATA COVERED

Definition of Personal Information: An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

  1. Social security number;
  2. Driver's license number or Hawaii Identification Card number; or
  3. Account number, credit or debit card number, access code, or password that would permit access to an individual’s financial account.
INDUSTRY Any business that owns or licenses personal information of residents of Hawaii or any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise)
PENALTIES A violation is considered to be an unfair or deceptive act or practice in the conduct of trade or commerce. A plaintiff may obtain an injunction against the defendant and may recover damages, costs and attorneys’ fees.