Bill Text: HI SB1186 | 2015 | Regular Session | Amended
Bill Title: Personal Information; Security Breach; Notification
Spectrum: Strong Partisan Bill (Democrat 14-1)
Status: (Introduced - Dead) 2015-02-18 - Report adopted; Passed Second Reading, as amended (SD 1) and referred to JDL/WAM. [SB1186 Detail]
Download: Hawaii-2015-SB1186-Amended.html
|
THE SENATE |
S.B. NO. |
1186 |
|
TWENTY-EIGHTH LEGISLATURE, 2015 |
S.D. 1 |
|
|
STATE OF HAWAII |
|
|
|
|
|
|
|
|
||
|
|
||
A BILL FOR AN ACT
RELATING TO PERSONAL INFORMATION.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
SECTION 1. Section 487N-1, Hawaii Revised Statutes, is amended by amending the definition of "personal information" to read as follows:
""Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(1) Social security number;
(2) Driver's license number or Hawaii identification
card number; [or]
(3) Account number, credit or debit card number,
access code, or password that would permit access to an individual's financial
account[.];
(4) Medical information, including but not limited to any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a qualified health care professional;
(5) Health insurance information, including but not limited to an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify an individual, or an individual's application and claims history, including any records of appeal; or
(6) An online user name, electronic mail address, or social media user name or other identifier of a social media account in combination with a password that would permit access to an online account.
"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records."
SECTION 2. Section 487N-2, Hawaii Revised Statutes, is amended by amending subsections (a) to (d) to read as follows:
"(a) Any business that owns or licenses
personal information of residents of Hawaii, any business that conducts
business in Hawaii that owns or licenses personal information in any form
(whether computerized, paper, or otherwise), or any government agency that
collects personal information for specific government purposes shall provide
notice to the affected person that there has been a security breach following
discovery or notification of the breach. The disclosure notification shall be
made without unreasonable delay, consistent with the legitimate needs of law
enforcement as provided in subsection (c) [of this section], and
consistent with any measures necessary to determine sufficient contact
information, determine the scope of the breach, and restore the reasonable
integrity, security, and confidentiality of the data system.
(b) Any business located in Hawaii or any
business that conducts business in Hawaii that maintains or possesses records
or data containing personal information of residents of Hawaii that the
business does not own or license, or any government agency that maintains or
possesses records or data containing personal information of residents of
Hawaii shall notify the owner or licensee of the information of any security
breach [immediately] no later than ten days following discovery
of the breach, consistent with the legitimate needs of law enforcement as
provided in subsection (c).
(c) The notice required by this section shall
be delayed if a law enforcement agency informs the business or government
agency that notification may impede a criminal investigation or jeopardize
national security and requests a delay; provided that such request is made in
writing, or the business or government agency documents the request
contemporaneously in writing, including the name of the law enforcement officer
making the request and the officer's law enforcement agency engaged in the
investigation. The notice required by this section shall be provided [without
unreasonable delay] pursuant to subsection (a) or (b) after the law
enforcement agency communicates to the business or government agency its
determination that notice will no longer impede the investigation or jeopardize
national security.
(d) The notice shall be clear and conspicuous. The notice shall include a description of the following:
(1) The incident in general terms;
(2) The type of personal information that was subject to the unauthorized access and acquisition;
(3) The general acts of the business or government agency to protect the personal information from further unauthorized access;
(4) A telephone number that the person may call for
further information and assistance, if one exists; [and]
(5) Advice that directs the person to remain vigilant
by reviewing account statements and monitoring free credit reports[.];
(6) If the information is possible to determine at the time the notice is provided, then any of the following:
(A) The date of the breach;
(B) The estimated or approximate date of the breach; or
(C) The range of possible dates within which the breach occurred;
(7) Whether law enforcement caused a delay in notification, if the information is possible to determine at the time the notice is provided; and
(8) If the breach exposed a civil identification card number or social security number, the contact information for major credit reporting agencies."
SECTION 3. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.
SECTION 4. This Act shall take effect on July 1, 2015.
Report Title:
Personal Information; Security Breach; Notification
Description:
Expands definition of "personal information" and establishes or amends the timeline by which a business or government agency must notify persons affected by a security breach of personal information. Specifies additional information required in notification following certain security breaches. (SD1)
The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.
