STAND. COM. REP. NO. 800

Honolulu, Hawaii

RE: S.B. No. 1038

S.D. 1

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Third State Legislature

Regular Session of 2025

State of Hawaii

Sir:

Your Committee on Commerce and Consumer Protection, to which was referred S.B. No. 1038 entitled:

"A BILL FOR AN ACT RELATING TO PRIVACY,"

begs leave to report as follows:

The purpose and intent of this measure is to:

(1) Add the definitions of "identifier" and "specified data element", and amend the definition of "personal information" under chapter 487N, Hawaii Revised Statutes; and

(2) Include licensees subject to the Insurance Data Security Law among the businesses deemed compliant with security breach notice requirements under existing state law.

Your Committee received testimony in opposition to this measure from TechNet, RELX, Hawaii Financial Services Association, State Privacy & Security Coalition, and Consumer Data Industry Association.

Your Committee received comments on this measure from the Office of Consumer Protection of the Department of Commerce and Consumer Affairs, Department of Human Services, Hawaii Bankers Association, and Hawaii Credit Union League.

Your Committee finds that the existing privacy laws under chapter 487N, Hawaii Revised Statutes, do not adequately protect the privacy interests of consumers in the State. The expansion of the Internet and related digital technologies has resulted in a greater need for more safeguards to protect personal and sensitive data from exploitation. In 2019, the Legislature adopted House Concurrent Resolution No. 225, H.D. 1, S.D. 1, Regular Session of 2019 (H.C.R. No. 225), to convene the Twenty-First Century Privacy Law Task Force to examine and recommend updates to keep pace with the expanding use of personal identifiers and specified data elements in technology. Your Committee further finds that the Twenty-First Century Privacy Law Task Force found that amendments to certain definitions were necessary to make privacy protection more robust and expansive. This measure makes various technical updates to conform with the recommendations made by the Twenty‑First Century Privacy Law Task Force.

Your Committee has amended this measure by:

(1) Expanding the definition of "identifier" to include:

(A) An individual's first name, initials, or nickname, combined with the individual's last name; and

(B) A mobile or home phone number;

(2) Clarifying the definition of "specified data element" to include financial account numbers, unless redacted, and military identification numbers;

(3) Amending the definition of "personal information";

(4) Inserting an effective date of July 1, 2050, to encourage further discussion; and

(5) Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

As affirmed by the record of votes of the members of your Committee on Commerce and Consumer Protection that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 1038, as amended herein, and recommends that it pass Second Reading in the form attached hereto as S.B. No. 1038, S.D. 1, and be placed on the calendar for Third Reading.

Respectfully submitted on behalf of the members of the Committee on Commerce and Consumer Protection,

________________________________

JARRETT KEOHOKALOLE, Chair