What does Hawaii's data breach law ask a business to do?

Who does this law apply to?

The law says a business that owns or licenses personal information of Hawaii residents, and a state or county agency that collects it, must tell the affected person after it finds or is told of a security breach. It covers information in any form, including paper.

Any business that owns or licenses personal information of residents of Hawaii, any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise), or any government agency that collects personal information for specific government purposes shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach.

What counts as personal information?

Personal information is a first name or first initial and last name together with a Social Security number, a driver's licence or Hawaii identification card number, or a financial account number, access code or password. A breach under this law is unauthorized access to and acquisition of that information where illegal use has occurred or is reasonably likely and that creates a risk of harm to a person.

"Security breach" means an incident of unauthorized access to and acquisition of unencrypted or unredacted records or data containing personal information where illegal use of the personal information has occurred, or is reasonably likely to occur and that creates a risk of harm to a person.

"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: (1) Social security number; (2) Driver's license number or Hawaii identification card number;

How fast must people be told?

The text sets no number of days. Notice must be made without unreasonable delay, allowing for the needs of law enforcement and the time needed to find contact details, find the scope of the breach and restore the system.

The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system.

Who else must be told?

When a business notifies more than one thousand people at one time, it must also tell the State of Hawaii's office of consumer protection and the nationwide consumer reporting agencies, in writing and without unreasonable delay.

In the event a business provides notice to more than one thousand persons at one time pursuant to this section, the business shall notify in writing, without unreasonable delay, the State of Hawaii's office of consumer protection and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. section 1681a(p), of the timing, distribution, and content of the notice.

Is encrypted information treated differently?

The breach definition covers unencrypted or unredacted records. Encrypted records count as a breach when the confidential process or key was taken with them.

Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key constitutes a security breach.

What if a vendor holds the data?

A business or agency that keeps Hawaii residents' personal information it does not own or license must tell the owner or licensee of any security breach immediately after finding it.

Any business located in Hawaii or any business that conducts business in Hawaii that maintains or possesses records or data containing personal information of residents of Hawaii that the business does not own or license, or any government agency that maintains or possesses records or data containing personal information of residents of Hawaii shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in subsection (c).

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.