HB2311

SECTION 1. The information privacy and security council, administratively attached to the department of accounting and general services, was established by Act 10, Special Session Laws of Hawaii 2008, as codified into law under section 487N-5, Hawaii Revised Statutes, to develop guidelines to be considered by government agencies in deciding whether, how, and when a government agency shall inform affected individuals of the loss, disclosure, or security breach of personal information that can contribute to identity theft. Personal information is defined in section 487N-1, Hawaii Revised Statutes, as "an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(1) Social security number;

(2) Driver's license number or Hawaii identification card number; or

(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account."

Currently, some local and state government agencies, including county law enforcement, are required under sections 52D-14 and 261-17.7, Hawaii Revised Statutes, to provide unclaimed property to finders after forty-five days. Given that cell phones, computers, and other such electronic devices may contain personal information, the council recommends that Hawaii state law be amended to keep pace with technology so that personal information is protected.

The purpose of this Act is to protect the personal information of individuals by providing county police departments and the department of transportation the authority to sanitize unclaimed electronic devices, in accordance with recognized standards and guidelines, before providing the unclaimed property to finders or disposing of the property by public auction or other means.

SECTION 2. Section 52D-14, Hawaii Revised Statutes, is amended to read as follows:

"[[]§52D-14[]] Duty and right of finders. (a) Except as provided in section 261-17.7, all money or property found shall be reported or delivered by the finder to the chief of police of the county. When so delivered, it shall be held by the chief of police for forty-five days or until claimed by some person who establishes title or right of custody thereto to the satisfaction of the chief of police. If title or right of custody is established, the money or property shall be delivered to the claimant by the chief of police.

(b) If no claim is made or no such right is established within the forty-five days, the money or property shall be returned to the person who delivered it to the chief of police[;], except as provided in subsection (c); provided that if the person who delivered it to the chief of police fails to claim the money or property within thirty days after being notified by the chief of police that the person is entitled to possession, the chief of police shall dispose of the money or property in accordance with the procedures established in section 52D-10. For the purpose of this section, notice by regular mail to the person's last known address shall be sufficient.

(c) Prior to being returned to the finder or disposal by public auction or other means, an electronic device that allows for storage of personal information, as defined by section 487N-1, shall be sanitized in accordance with guidance provided by the information privacy and security council to ensure removal of personal information prior to returning the device to the finder. If removal of personal information is not possible or cannot be verified without unreasonable expense, the device shall be destroyed in a manner sufficient to eliminate the information, prior to disposal or recycling. The chief of police shall make reasonable efforts to notify the finder that the device was destroyed and disposed of or recycled because personal information could not be removed."

SECTION 3. Section 261-17.7, Hawaii Revised Statutes, is amended to read as follows:

"§261-17.7 Lost and found money or property at airports. (a) All money or property found at an airport owned or controlled by the department shall be reported or delivered by the finder to the airport lost and found, and when so delivered shall be held by the department for forty-five days or until claimed by some person who establishes title or right of custody thereto to the satisfaction of the department. In the event of the establishment of title or right of custody, the money or property shall be delivered to the claimant by the director or the director's agent. If within forty-five days no claimant establishes a right to the money or property, the money or property, except as provided in subsection (d) with regard to electronic devices, shall be returned to the person who delivered it to the airport lost and found; provided that if the person who delivered it to the airport lost and found fails to claim the money or property within thirty days after being notified by the director, the director shall deposit the money into the state treasury to the credit of the airport revenue fund or shall dispose of the property by public auction.

(b) At least once annually, the director shall give public notice giving details as to time and place of the auction and giving notice to all persons interested or claiming the property that unless claims are made by persons who can provide satisfactory proof of ownership before a specified date, the property will be sold at public auction to the highest bidder. On the day and at the place specified in the notice, all property for which no satisfactory proof of ownership is made shall be sold by auction by or under the direction of the director.

If any property which is of a perishable nature or unreasonably expensive to keep or safeguard remains unclaimed at the airport, the director may sell that property at public auction, at a time and after notice that is reasonable under the circumstances. The director shall immediately after the sale of any property pay to the airport revenue fund all moneys received by the director upon sale.

(c) For the purpose of this section, notice by regular mail to the last known address of the person who delivered the money or property to the airport lost and found shall be deemed sufficient.

(d) Prior to being returned to the finder or disposal by public auction or other means, an electronic device that allows for storage of personal information, as defined by section 487N-1, shall be sanitized by the director or the director's agent in accordance with guidance provided by the information privacy and security council to ensure removal of personal information prior to returning the device to the finder or disposal by public auction or other means. If removal of personal information is not possible or cannot be verified without unreasonable expense, the device shall be destroyed in a manner sufficient to eliminate the information, prior to disposal or recycling. The director or the director's agent shall make reasonable efforts to notify the finder that the device was destroyed and disposed of or recycled because personal information could not be removed."

SECTION 4. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.

SECTION 5. This Act shall take effect upon its approval.

INTRODUCED BY:

_____________________________

BY REQUEST

HOUSE OF REPRESENTATIVES	H.B. NO.	2311
TWENTY-NINTH LEGISLATURE, 2018
STATE OF HAWAII