STAND. COM. REP. NO. 61

Honolulu, Hawaii

, 2023

RE: H.B. No. 1497

H.D. 1

Honorable Scott K. Saiki

Speaker, House of Representatives

Thirty-Second State Legislature

Regular Session of 2023

State of Hawaii

Sir:

Your Committee on Higher Education & Technology, to which was referred H.B. No. 1497 entitled:

"A BILL FOR AN ACT RELATING TO CONSUMER DATA PROTECTION,"

begs leave to report as follows:

The purpose of this measure is to:

(1) Establish a framework, titled the Consumer Data Privacy Act, to regulate controllers and processors with access to personal consumer data;

(2) Provide that a violation of the Consumer Data Privacy Act constitutes an unfair method of competition and unfair and deceptive act or practice in the conduct of any trade or commerce; and

(3) Authorize a person injured by a violation of the Consumer Data Privacy Act to bring a civil action against a controller or processor.

Your Committee received testimony in opposition to this measure from the Retail Merchants of Hawaii, Hawaiian Electric, State Privacy & Security Coalition, State Farm Mutual Automobile Insurance Company, TechNet, National Association of Mutual Insurance Companies, and CTIA. Your Committee received comments on this measure from the Department of the Attorney General and Hawaii Insurers Council.

Your Committee finds that consumer privacy is of paramount importance. Your Committee further finds that this measure addresses the protection of a consumer's personal data while striking the balance of exempting many specific categories of information subject to existing protections.

In evaluating this measure, your Committee found merit in concerns raised about access to personal data and an opportunity to cure violations. Your Committee also considers the ability of the Attorney General or the Director of the Office of Consumer Protection to bring a civil action sufficient to enforce the Consumer Data Protection Act and, therefore, removed the option for a private right of action.

Your Committee has amended this measure by:

(1) Deleting language relating to an authenticated consumer's right to access personal data;

(2) Deleting the private right of action;

(3) Requiring notice and providing a thirty-day period to cure violations to allow an opportunity for good-faith actors to remedy their violations;

(4) Changing the effective date to June 30, 3000, to encourage further discussion; and

(5) Making technical, nonsubstantive amendments for the purposes of clarity, consistency, and style.

As affirmed by the record of votes of the members of your Committee on Higher Education & Technology that is attached to this report, your Committee is in accord with the intent and purpose of H.B. No. 1497, as amended herein, and recommends that it pass Second Reading in the form attached hereto as H.B. No. 1497, H.D. 1, and be referred to your Committee on Consumer Protection & Commerce.

Respectfully submitted on behalf of the members of the Committee on Higher Education & Technology,

____________________________

AMY A. PERRUSO, Chair