Here’s an interesting fact about the Hawaii bill of rights: The Hawaii constitution lists the word “privacy” several times. Compare that to the U.S. Bill of Rights, which does not mention the word at all. According to the National Conference of State Legislatures, only 10 states have “explicit provisions relating to a right to privacy” in their state constitutions.
The Hawaii Constitution reads as follows:
“The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches, seizures, and invasions of privacy shall not be violated.”
In Hawaii, the State Constitution expressly recognizes a right to privacy. Notably, under Hawaii state law, a person may be found guilty of an invasion of privacy violation. But the provisions outlined in state law define an infringement of traditional privacy definitions and do not include more modern privacy protections.
In light of this, Hawaii has taken steps to introduce up-to-date privacy legislation including several failed bills in the last few years. We will summarize them starting from 2020 in chronological order.
2020 Hawaii Privacy Bills
HB2572
Hawaiian legislators attempted to strengthen State privacy protections when they introduced Bill HB 2572 in January 2020, relating to privacy.
As summarized, the bill modernized the term “personal information” for “security breach of personal information law”.
The bill:
- prohibited the sale of contact tracing information without consent
- updated the definition of personal information to include identifiers and specified data elements, which may be driver’s license numbers, unique biometric data, or an individual’s financial account number
- established the right of access and deletion concerning the personal information held by the organization
- prohibited a business from discriminating against consumers in the exercise of their rights
- outlined a penalty of $7,500 for a violation of the bill
- mandated that data brokers register annually with the office of consumer protection and provide pertinent information regarding their policies on opt-out, consent, and security breaches
- prohibited the sale of geolocation information without consent.
The bill was deferred on July 7, 2020, and has not been enacted into law.
2021 Hawaii Privacy Bills
HB125 (Enacted into Law)
In 2021, the Governor of Hawai‘i signed into law (HB125) the Uniform Employee and Student Online Privacy Protection Act creating additional protections for student privacy, and this time imposing liability directly on educational institutions. The law prohibits schools from accessing students’ online accounts, such as social media or non-school email.
Unlike the SOPIPA (Student Online Personal Information Protection Act), the new law holds educational institutions accountable and clearly writes that schools may not access students’ accounts even when they’re using school-issued devices.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
2022 Hawaii Privacy Bills
In 2022, Hawaii lawmakers introduced four bills, none of which gained momentum.
HB2051
HB 2051 set out to establish the Hawaii privacy act. It specified various consumer rights concerning the collection of personal information by businesses. It outlines business obligations concerning the collection, disclosure, sharing, and selling of consumer personal information. The bill specified the requirements for administration and enforcement by the department.
HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022. Following testimony in opposition from several industry groups, the Committee recommended ‘deferral,’ which is a mild way of saying that the bill is heading to its demise. The 112-page bill appeared to closely follow the CPRA but without any private right of action.
Several VCDPA-style bills were proposed in 2022 as well. They are listed below.
HB2341, SB 2428, SB2797
These bills sought to establish a framework to regulate controllers and processors with access to personal consumer data and specify penalties for noncompliance.
SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.
They were not enacted into law.
2023 Hawaii Privacy Bills
SB21
Senate Bill SB21 proposed an amendment to the Constitution of the State of Hawaii establishing the “right to own one’s own data”. Introduced on January 18, 2023, it passed the first reading so far. The bill proposes to amend Article I of the Constitution of the State of Hawaii by establishing the right of each person to own and have an exclusive right over the data they automatically generate on the internet.
SB 21 states that the decision as to which data is subject to this provision will be determined in the future by state legislature, as well as how this provision will be implemented and enforced.
The bill was sponsored by Karl Rhoads (D) and Chris Lee (D).
SB974
In January 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate, SB974 and SB1110. The goal was to establish a framework to regulate controllers and processors with access to personal consumer data. In addition, they establish that a violation of the consumer data privacy act constitutes an unfair method of competition and is considered a deceptive practice in the area of trade of commerce. The bill would authorize a person affected by noncompliance with the personal consumer data act to bring a civil action against a controller or processor.
Stay Up-to-Date on Hawaii Data Privacy Laws
Although no comprehensive Hawaii privacy law has been passed, it would not be surprising if there will be progress on this important topic this year in Hawaii. In the meantime, Hawaii businesses with an internet presence should evaluate if they need to comply with other state laws. Many small and mid-sized companies wrongly assume that they do not meet the eligibility thresholds for laws outside of their state.
At Centraleyes, we aim to help our readers stay abreast of evolving state privacy laws. The vast majority of proposed bills do not progress to laws, but understanding the key issues being debated can clarify how privacy rights are developing in the United States and how they may apply to you.
Our innovative platform is constantly updated with newly enacted and amended privacy laws, in addition to tens of recognized risk and compliance frameworks. Schedule a consultation to learn more about how we can transform your risk and compliance workload.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
