Cybersecurity Policy Report, Data Privacy Bill Clears Committee in Hawaii, (Feb 22, 2023)
The Hawaii state Senate Committee on Commerce and Consumer Protection voted 4-1 to pass a bill to establish a framework to regulate controllers and processors with access to personal consumer data. The committee made several amendments to the bill, including amending the effective date of the measure to July 1, 2050, in order to “encourage further discussion.”
The provisions of SB 974, or the Consumer Data Protection Act, would apply to businesses operating in the state that control or process the personal data of at least 100,000 consumers or control or process the personal data of at least 25,000 consumers and derive 25% of gross revenue from the sale of personal data. It would not apply to government entities, nonprofits, or institutions of higher education.
The bill authorizes consumers to opt out of the processing of their personal data for purposes such as targeted advertising, the sale of personal data, or profiling that results in the provision or denial of financial and lending services, housing, insurance, employment, education enrollment, health care services, or access to basic necessities. Consumers would also be able to confirm whether a controller is processing their personal data and to access the personal data; to correct inaccuracies in the consumer’s personal data; to delete personal data obtained about the consumer; and obtain a copy of a consumer’s personal data in a format that is portable and readily usable.
Data controllers are also directed to limit the collection of personal data to data that is “adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer.” In addition, the bill requires controllers to provide consumers with a “reasonably accessible, clear, and meaningful privacy notice” that includes “one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter.”
The bill doesn’t create a private right of action and directs the state attorney general to enforce its provisions. Before initiating any action, however, the attorney general would be required to notify a controller or processor of any alleged violations. The controller or processor would then have 30 days to cure the violation or face civil penalties of up to $7,500 for each violation.
The bill further establishes in the state treasury the “consumer privacy special fund” into which would be deposited all civil penalties, expenses, and attorney fees that have been collected.
SB 974 is sponsored by Sen. Chris Lee (D.). The bill has been referred to the Senate Committee on Ways and Means.
News: StateLegislation DataPrivacy