Bill > SB1037

This bill establishes a comprehensive Consumer Data Protection Act for Hawaii that provides extensive privacy rights and regulations for consumer personal data. The legislation applies to businesses that either process personal data of at least 100,000 consumers annually or process data of 25,000 consumers while deriving over 25% of their gross revenue from selling personal data. The bill defines "personal data" broadly and gives consumers several key rights, including the ability to confirm what data a company has, correct inaccuracies, delete their data, obtain a copy of their data, and opt out of targeted advertising, data sales, and certain profiling activities. Controllers (businesses handling data) must provide clear privacy notices, limit data collection, obtain consent for sensitive data processing, and implement reasonable data security practices. The Department of the Attorney General will have exclusive enforcement authority, with the ability to issue warnings, seek injunctions, and impose civil penalties of up to $7,500 per violation. A new Consumer Privacy Special Fund will be created to collect penalties and support the law's implementation, with the law set to take effect on July 1, 2025. Importantly, the bill does not allow private lawsuits, meaning only the state can take legal action against violators.

Business and Industry

https://www.capitol.hawaii.gov/session/measure_indiv.aspx?billtype=SB&billnumber=1037&year=2026