Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Committee passes amended data-breach bill after wide-ranging testimony on identifiers and notification rules
Summary
The committee passed SB 1038 with amendments to fold the 'identifier' term into the personal-information definition, accept DCCA consumer-protection edits, and shorten implementation to nine months after extensive testimony from banks, industry groups and privacy experts.
The House Committee on Economic Development on March 14 passed SB 1038 with amendments that combine the bill’s separate “identifier” term into the personal-information definition, adopt several DCCA Office of Consumer Protection edits, and shorten the implementation period to nine months.
Cherry Legan and Gerry Bomp (DCCA Insurance Division) and Mana Moriarty (Office of Consumer Protection) provided agency comments. Industry groups including the Hawaii Bankers Association (Mihoko Ito), the Hawaii Financial Services Association (Marvin Dang), and the Consumer Data Industry Association (Ryan Toyemore) raised concerns about the bill’s breadth, particularly how it would treat Social Security number redaction and how it would interact with existing public-record statutes.
Privacy expert Kelly McCanlies, who said he participated in the state working group that originally drafted this legislation, defended the bill’s approach to enumerating identifiers and specified data elements and urged stronger notification obligations when exposed data could permit identity theft. McCanlies said the law’s intent is to require disclosure when the exposure allows someone to assume an identity, not to prescribe operational redaction practices.
The committee accepted several changes described in testimony: removing the separate "identifier" term in favor of a single personal-information definition that includes enumerated items, accepting DCCA Office of Consumer Protection housekeeping edits, striking a narrow "specified data" paragraph, and delaying the bill’s effective date to allow nine months for implementation. Committee notes also direct staff to consider location-data language and to review the proposal for how many digits of a Social Security number may trigger notification.
Chair Iligan said the amendments aim to reduce confusion in implementation and to give regulated entities time to comply. The committee recommended passage with amendments; the recommendation was adopted in committee action recorded in the transcript.
