STAND. COM. REP. NO. 2624
Honolulu, Hawaii
RE: S.B. No. 2290
S.D. 2
Honorable Robert Bunda
President of the Senate
Twenty-Third State Legislature
Regular Session of 2006
State of Hawaii
Sir:
Your Committee on Judiciary and Hawaiian Affairs, to which was referred S.B. No. 2290, S.D. 1, entitled:
"A BILL FOR AN ACT RELATING TO PROTECTION FROM SECURITY BREACHES,"
begs leave to report as follows:
The purpose of this measure is to add a new chapter to title 26, Hawaii Revised Statutes, which will require businesses and government agencies that experience a security breach to notify the affected individuals of the breach.
Your Committee received testimony in support of this measure from the Department of Commerce and Consumer Affairs, the Honolulu Police Department, the Hawaii Bankers Association, Retail Merchants of Hawaii, and the Consumer Data Industry Association. Testimony in opposition of this measure was received from the American Council of Life Insurers and the Property Casualty Insurers Association of America. The Hawaii Medical Service Association submitted comments.
As one measure from the Department of Commerce and Consumer Affair's identity theft proposals, this measure is part of a larger Senate package of identity theft bills that has evolved from the work of the Hawaii Anti-Phishing Task Force. In 2005, the Hawaii Anti-Phishing Task Force was established in the Department of the Attorney General to develop state policy on how best to prevent further occurrences of phishing and other forms of electronic commerce-based crimes in the State.
Your Committee finds that this measure seeks to ameliorate the growing plague of identity theft by requiring businesses that maintain records containing an individual's personal information to notify that individual when an unauthorized disclosure occurs. This measure originally imposed requirements only on businesses, but the Department of Commerce and Consumer Affairs recognizes and your Committee finds that the obligations imposed by this measure should also be extended to government agencies in Hawaii. Your Committee further finds that this measure will provide guidance to businesses and government agencies as to the notification requirements and will provide valuable tools that Hawaii residents can use to protect themselves from financial harm if their financial or personal information is compromised.
Your Committee has amended this measure by:
(1) Deleting the exclusion of government agencies from the definition of "business";
(2) Adding definitions for "government agency" and "redacted" to the definitions section;
(3) Adding "government agency" throughout the measure to clarify that the provisions also include and apply to government agencies;
(4) Adding language from the Hawaii Bankers Association that will allow financial institutions abiding by federal law to be in compliance with the new chapter;
(5) Adding language from the Hawaii Medical Service Association that will allow health plans and healthcare providers that are subject to and in compliance with the standards of the Health Insurance Portability and Accountability Act of 1996 to be in compliance with the new chapter;
(6) Deleting "person" and adding "business" in the penalty section to clarify that the cause of action will be against a business and not a person;
(7) Adding a monetary damages penalty in addition to the provision that allows for a cause of action based upon unfair or deceptive acts or practices declared unlawful under section 480-2, Hawaii Revised Statutes;
(8) Adding language that exempts government agencies from both penalty provisions; and
(9) Making technical, nonsubstantive changes to correctly reflect the format of the Hawaii Revised Statutes.
As affirmed by the record of votes of the members of your Committee on Judiciary and Hawaiian Affairs that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 2290, S.D. 1, as amended herein, and recommends that it pass Third Reading in the form attached hereto as S.B. No. 2290, S.D. 2.
Respectfully submitted on behalf of the members of the Committee on Judiciary and Hawaiian Affairs,
|
____________________________ COLLEEN HANABUSA, Chair |
||