Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Privacy Data Breach topic
No spam. Unsubscribe anytime.
Senate committee advances privacy-breach notice bill with amendments; effective date deferred to 2050
Summary
The Hawaii Senate Commerce and Consumer Protection Committee on Feb. 19 advanced SB1038, which updates definitions in the state's security-breach notice law and adds certain insurance licensees to a list of businesses deemed compliant; the committee adopted multiple stakeholder amendments and set a defective effective date of July 1, 2050.
The Senate Committee on Commerce and Consumer Protection on Feb. 19 recommended passage of SB1038 with amendments, adopting changes proposed by the Office of Consumer Protection, the Hawaii Bankers Association and the State Privacy and Security Coalition and deferring the bill's effective date to July 1, 2050.
SB1038 would add definitions for “identifier” and “specified data element” and amend the definition of “personal information” used to determine when businesses must notify people after data and security breaches. The measure also names licensees subject to Hawaii’s insurance data security law among businesses treated as compliant with security-breach notice requirements.
The Department of Commerce and Consumer Affairs Office of Consumer Protection (OCP) told the committee it “appreciates the intent of this bill” and supports modernizing the law to make consumers aware when nonpublic personal information is accessed without authorization. Marvin Dang, attorney for the Hawaii Financial Services Association, said his group “oppose[s] this bill as drafted” and cautioned that the bill would create an outlier standard for redacting Social Security numbers, noting existing Hawaii statutes and rules typically permit showing the last four digits. A representative of the Consumer Data Industry Association said harmonizing redaction and encryption practices with other states is a key concern and urged stakeholder collaboration.
Senator Gilbert S.C. Keith-Agaran (chair) acknowledged a range of amendment proposals and said the committee would adopt a package intended to address many stakeholders’ concerns. Senator Sharon Y. L. Lee pressed industry witnesses on the risks of exposing the last four digits of Social Security numbers in Hawaii’s small population, saying that in some cases the last four digits can make it easier to reconstruct a full number. OCP noted existing statutory safe harbors that exclude information lawfully available in government records from triggering breach-notice requirements.
The committee vote recorded the chair and vice chair voting aye and otherwise adopted the measure with amendments; the committee set the bill’s effective date to July 1, 2050 to allow further work on harmonizing definitions and technical amendments.
The changes adopted direct staff and stakeholders to reconcile competing redaction and encryption approaches and to incorporate the specific clarifying language submitted by OCP, the Hawaii Bankers Association and the State Privacy and Security Coalition.
SB1038 will proceed with the committee’s recommended amendments and the deferred effective date; the measure’s further passage will follow the normal Senate floor procedures.
