SB 3015: Personal Information; Government Entities; Publicly Accessible Information Systems; Publication Controls; Data Security; Notification; Cause of Action; Reports

A BILL FOR AN ACT

RELATING TO PERSONAL INFORMATION.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that personally identifiable information maintained by government entities is increasingly targeted for exfiltration and misuse for financial fraud, identity theft, and other cybersecurity harms.  The legislature further finds that definitions of personally identifiable information in State law are fragmented across chapters and, for certain government entities, do not reflect current technological realities, including the publication and indexing of government records through websites, searchable databases, bulk-download repositories, and application programming interfaces.

     The legislature also finds that modern artificial intelligence systems may treat government records and databases as trusted sources and may be trained on, summarize, or generate content derived from those records.  When personal information is publicly accessible through government systems, artificial intelligence tools may inadvertently reproduce that information, compounding privacy, safety, and cybersecurity risks.

     Accordingly, the purpose of this Act is to modernize and standardize protections for personal information maintained by government entities by:

     (1)  Prohibiting government entities from making personal information publicly accessible through a publicly accessible information system or publicly accessible source of information, except under certain conditions;

     (2)  Allowing individuals who reasonably believe their personal information is publicly accessible through a government entity's publicly accessible information system or publicly accessible source of information to submit a written notice to the entity to require corrective action; 

     (3)  Establishing a cause of action to compel compliance; 

     (4)  Establishing statutory penalties for intentional noncompliance; 

     (5)  Requiring government entities to adopt and implement policies and procedures to prevent personal information from being publicly accessible; 

     (6)  Requiring government entities that own, license, maintain, use, collect, or possess personal information to implement and maintain certain reasonable security procedures and practices to protect the personal information;

     (7)  Requiring government entities to provide notice to individuals in the case of a breach of a security system protecting personal information; and

     (8)  Requiring government entities to submit annual reports to the legislature.

     SECTION 2.  Chapter 84, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

"Part     .  PERSONAL INFORMATION; GOVERNMENT INFORMATION SECURITY

     §84-A  Definitions.  As used in this part:

     "Government entity" means any department, agency, board, commission, authority, or instrumentality of the State or a county, including the legislature and its agencies, the judiciary and its administrative agencies, the office of Hawaiian affairs, and any public corporation or other establishment owned, operated, or managed by or on behalf of the State or any county.

     "Genetic data" means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material.

     "Health insurance information" means an individual's insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual's application and claims history, including any appeals records.

     "Medical information" means any individually identifiable information, in electronic or physical form, regarding an individual's medical history or medical treatment or diagnosis by a health care professional.

     "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, where either the name or the data elements are not encrypted or redacted:

     (1)  Social security number;

     (2)  Driver's license number, state identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual;

     (3)  Account number, credit card number, or debit card number;

     (4)  Medical information;

     (5)  Health insurance information;

     (6)  Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual; provided that unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes;

     (7)  Genetic data; and

     (8)  A username or electronic mail address in combination with a password or security question and answer that would permit access to an online account.

     "Publicly accessible information system" means any website, portal, online searchable database, bulk-download repository, application programming interface, or substantially similar system that is made available to the public by a government entity without individualized authorization.

     "Publicly accessible source of information" includes any document, record, image, dataset, or other information that is posted, published, indexed, or otherwise made available to the public through a publicly accessible information system.

     "Redact" means to remove or obscure personal information so that it is not readable, not retrievable, and not usable by the public.

     "Reasonable security procedures and practices" means security procedures and practices appropriate to the nature of the personal information, consistent with section 84-I.

     §84-B  Public posting of personal information; prohibition; publicly accessible information systems.  (a)  A government entity shall not make personal information publicly accessible through a publicly accessible information system or publicly accessible source of information unless a federal or state statute, a rule adopted pursuant to statute, or a court order explicitly requires that the specific item of personal information be made publicly accessible.

     (b)  The obligation to disclose a government record under chapter 92F or any other law shall not, by itself, be construed to require a government entity to make personal information publicly accessible through a publicly accessible information system.

     (c)  Nothing in this part shall be construed to limit disclosure of government records as required by law; provided that a government entity shall employ redaction or sanitization to prevent public accessibility of personal information through publicly accessible information systems unless explicitly required under subsection (a).

     (d)  With respect to account numbers, credit card numbers, and debit card numbers, a government entity shall not make publicly accessible any portion of the number, whether in full or in part, unless explicitly required under subsection (a); provided that a government entity may make publicly accessible a truncated number consisting only of the last four digits when the truncated number is reasonably necessary to identify a transaction or account reflected in a government record and no other personal information is made publicly accessible in connection with the truncated number.

     (e)  Each government entity shall implement and maintain processes designed to reduce the inadvertent public accessibility of personal information, including controls over posting, indexing, bulk downloads, and application programming interfaces, and reasonable measures to detect and remediate inadvertent public accessibility in publicly accessible information systems.

     (f)  For the purposes of this section, "make publicly accessible" includes publishing, posting, displaying, indexing, enabling search, enabling bulk download, or otherwise providing public access through any publicly accessible information system or publicly accessible source of information, including in text, image, scanned document, portable document format file, or other file format.

     §84-C  Notice of publicly accessible personal information; acknowledgement; corrective action.  (a)  Any individual who reasonably believes that the individual's personal information is publicly accessible through a publicly accessible information system or publicly accessible source of information controlled by a government entity may submit a written notice to the government entity identifying, to the extent reasonably practicable, the location of the publicly accessible personal information.

     (b)  Within three business days after receipt of a written notice under subsection (a), the government entity shall provide a written acknowledgement to the individual and shall commence corrective action.

     (c)  A government entity shall complete corrective action within thirty days after receipt of a written notice under subsection (a) by removing, redacting, or otherwise sanitizing the personal information so that it is not publicly accessible; provided that this section shall not require removal or redaction of information that is explicitly required to be publicly accessible under section 84-B(a).

     (d)  Corrective action under this section shall be limited to the minimum necessary to remove public accessibility of the personal information and shall not require deletion of non-personal information.

     §84-D  Extension of time to complete corrective action.  A government entity that receives a valid written notice pursuant to section 84-C and requires additional time to complete corrective action may extend the time to complete corrective action by providing written notice to the individual within three business days after receipt of the written notice.  An extension under this section may be for up to an additional ten business days; provided that the extension shall not extend the thirty-day period under section 84-C.

     §84-E  Civil remedies.  (a)  After providing written notice under section 84-C and allowing the government entity thirty days to complete corrective action, an individual whose personal information remains publicly accessible in violation of this part may bring an action for injunctive relief in the circuit court of competent jurisdiction to compel compliance.

     (b)  If the court finds that the government entity intentionally refused to take corrective action after receipt of a valid written notice, the court may, in addition to injunctive relief, award:

     (1)  Statutory damages of not less than $1,000 and not more than $5,000 per instance of intentional refusal; and

     (2)  Reasonable attorneys' fees and costs.

     (c)  This section shall not be construed to create a cause of action for monetary damages for negligent failure to complete corrective action, except as provided in subsection (b).

     §84-F  Exceptions; construction.  (a)  This part shall not apply to personal information that an individual voluntarily publishes on the Internet after the effective date of this Act.

     (b)  This part shall not be construed to require removal or redaction of information that is explicitly required to be publicly accessible under section 84-B(a).

     (c)  This part shall be construed to reduce public exposure of personal information through publicly accessible information systems while preserving access to government records as provided by law.

     §84-G  Policies; internal controls.  Each government entity shall adopt and implement policies and procedures necessary to comply with this part, including policies governing public posting, redaction, sanitization, access controls for publicly accessible information systems, and incident response.

     §84-H  Government records.  (a)  Nothing in this part shall be construed to alter rights to access government records under chapter 92F or any other law.

     (b)  When a government entity discloses government records through a publicly accessible information system, the government entity shall not make personal information publicly accessible unless explicitly required under section 84-B(a).

     §84-I  Reasonable security procedures and practices; contractors; incident reporting.  (a)  A government entity that owns, licenses, maintains, uses, collects, or possesses personal information about an individual shall implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

     (b)  A government entity that discloses personal information to a contractor or other third party for the purpose of performing services on behalf of the government entity shall require, by contract, that the contractor or third party:

     (1)  Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information;

     (2)  Report any breach of the security of the system, or suspected breach involving personal information, to the government entity as soon as practicable, but in no event later than seventy-two hours after discovery;

     (3)  Cooperate with investigation, containment, and notification obligations;

     (4)  Require the same or substantially similar obligations to be imposed on subcontractors or subservice providers;

     (5)  Provide, upon request, reasonable assurances of compliance, including audit rights or independent attestations aligned with commonly accepted security frameworks, including Systems and Organizations Controls 2 (SOC 2) or National Institute of Standards and Technology (NIST)-based controls; and

     (6)  Minimize the personal information processed for the contract and, upon completion or termination of the contract, return or securely destroy personal information, subject to any legal retention requirements.

     §84-J  Breach of security of system; notice.  (a)  In the case of a breach of the security of the system involving personal information, a government entity that owns or licenses computerized data that includes personal information shall disclose the breach following discovery or notification of the breach to any resident of the State whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.

     (b)  Notification may be delayed if a law enforcement agency determines that notification will impede a criminal investigation.  Notification shall be made promptly after the law enforcement agency determines that notification will not compromise the investigation.

     (c)  The notification required by this section shall be written in plain language, titled "Notice of Data Breach", and present the information under the following headings:

     (1)  "What Happened?";

     (2)  "What Information Was Involved?";

     (3)  "What We Are Doing.";

     (4)  "What You Can Do."; and

     (5)  "For More Information.".

     (d)  The notification required by this section shall include, at a minimum:

     (1)  The name and contact information of the reporting government entity;

     (2)  A list of the types of personal information that were, or are reasonably believed to have been, the subject of a breach;

     (3)  If available at the time of notice, the date of the breach, the estimated date of the breach, or the date range within which the breach occurred;

     (4)  Whether notification was delayed as a result of a law enforcement investigation;

     (5)  A general description of the breach incident, described in a manner that does not compromise security controls;

     (6)  The toll-free telephone numbers and addresses of the major credit reporting agencies, if the breach exposed information that could be used for identity theft; and

     (7)  If the breach exposed a social security number or a driver's license or state identification card number, advice to the affected individual to remain vigilant by reviewing account statements and monitoring free credit reports.

     (e)  Notice under this section may be provided by written notice, electronic notice if consistent with applicable law, or substitute notice if the government entity demonstrates that the cost of providing notice would exceed an amount specified by rule or that the affected class of persons to be notified exceeds a number specified by rule; provided that substitute notice shall include, at a minimum, email notice when available, conspicuous posting on the government entity's website, and notification to major statewide media.

     (f)  A government entity shall maintain records of breaches and notices provided under this section for five years.

     (g)  For the purposes of this section, "breach of the security of the system" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the government entity; provided that good faith acquisition of personal information by an employee or agent of the government entity for the purposes of the government entity is not a breach of the security of the system; provided further that the personal information is not used or subject to further unauthorized disclosure.

     §84-K  Compliance with this part; annual reporting requirement.  Each government entity shall submit an annual report detailing compliance with this part to the legislature no later than twenty days prior to the convening of each regular session.

     §84-L  Office of Hawaiian affairs, public corporations, and other establishments; applicability of part.  For the office of Hawaiian affairs, public corporations, and other establishments, the requirements of this part shall apply only to publicly accessible information systems and publicly accessible sources of information."

     SECTION 3.  Chapter 92H, Hawaii Revised Statutes, is amended by adding a new section to be appropriately designated and to read as follows:

     "§92H-    Relationship to part     of chapter 84.  Nothing in this chapter shall be construed to limit or impair the requirements of part     of chapter 84."

     SECTION 4.  Chapter 84, Hawaii Revised Statutes, is amended by amending its title to read as follows:

"CHAPTER 84

STANDARDS OF CONDUCT; GOVERNMENT INFORMATION SECURITY"

     SECTION 5.  In codifying the new sections added by section 2 of this Act, the revisor of statutes shall substitute appropriate section numbers for the letters used in designating the new sections in this Act.

     SECTION 6.  New statutory material is underscored.

     SECTION 7.  This Act shall take effect on January 1, 2525.

Report Title:

Personal Information; Government Entities; Publicly Accessible Information Systems; Publication Controls; Data Security; Notification; Cause of Action; Reports

Description:

Prohibits government entities from making personal information publicly accessible through a publicly accessible information system or publicly accessible source of information, except under certain conditions.  Allows individuals who reasonably believe their personal information is publicly accessible through a government entity's publicly accessible information system or publicly accessible source of information to submit a written notice to the entity to require corrective action.  Establishes a cause of action to compel compliance.  Establishes statutory penalties for intentional noncompliance.  Requires government entities to adopt and implement policies and procedures to prevent personal information from being publicly accessible.  Requires government entities that own, license, maintain, use, collect, or possess personal information to implement and maintain certain reasonable security procedures and practices to protect the personal information.  Requires government entities to provide notice to individuals in the case of a breach of a security system protecting personal information.  Requires government entities to submit an annual report to the Legislature.  Effective 1/1/2525.  (SD1)

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

A BILL FOR AN ACT

relating to personal information.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

     SECTION 1.  The legislature finds that the safety of public servants and candidates for public office is essential to the functioning of a democratic society.  In recent years, threats, harassment, and acts of violence directed at public officials and their families have increased nationwide, often facilitated by the easy public availability of personal identifying information, such as home addresses.

     The legislature further finds that the targeted assassination of Melissa Hortman and her husband underscore the real and grave dangers posed when malicious actors are able to locate and target public servants at their homes.  Such acts of violence not only endanger the lives of those who serve, but also chill civic participation and deter qualified individuals from seeking or continuing public service.

     The legislature recognizes the need to balance transparency in government with the fundamental right to personal safety.  By establishing a process to obtain such information, it protects public officials, candidates, and their families from harm, while maintaining government transparency.

     Accordingly, the purpose of this Act is to limit public access to the home addresses of public servants and candidates by establishing procedures for redaction and disclosure, and providing a mechanism for objection when disclosure would place individuals or their families in imminent danger.

     SECTION 2.  Chapter 92H, Hawaii Revised Statutes, is amended by adding two new sections to be appropriately designated and to read as follows:

     "§92H-     Home address; removal.  (a)  Every government agency that maintains, uses, collects, or possesses the home address of a covered public servant or candidate shall ensure that the home address is not publicly accessible.

     (b)  Each government agency shall redact or otherwise remove home addresses from:

     (1)  The agency's website;

     (2)  Online searchable databases of the agency;

     (3)  Printed documents or publications that are made publicly available by the agency; and

     (4)  Any other publicly accessible source of information.

     §92H-     Requests for disclosure; home address; notification; objection to disclosure.  (a)  An individual may submit a request to an agency for the home address of a covered public servant or candidate; provided that the agency shall first:

     (1)  Notify the covered public servant or candidate of the request;

     (2)  Provide the name, mailing address, telephone number, and electronic mailing address of the individual requesting the information; and

     (3)  Provide a copy of the request.

     (b)  A covered public servant or candidate may object to the disclosure of their home address by submitting an objection to the government agency within      business days of receiving notice under subsection (a).  An objection shall include a statement that disclosure of the covered public servant or candidate's home address would place them, a household member, or their property in imminent danger.  If no objection is received within the time allotted under this section, the government agency may disclose the information.

     (c)  For purposes of this section, "candidate" has the same meaning as in section 11-302."

     SECTION 3.  Section 92H-1, Hawaii Revised Statutes, is amended by amending the definition of "covered public servant" to read as follows:

     ""Covered public servant" means:

    [(1)  The governor;

     (2)  The lieutenant governor;

     (3)  The administrative director appointed pursuant to section 26-3;

     (4)  Any head of a department established under section 26-4;

     (5)  Any member of the legislature;]

     (1)  An employee, appointed official, or elected official of the State or a county, including all permanent and temporary employees of the state executive, legislative, and judicial branches and their respective government agencies, and any volunteer of the office of elections;

    [(6)] (2)  Any active, formerly active, or retired:

          (A)  Justice of the Hawaii supreme court;

          (B)  Judge of the Hawaii intermediate appellate court;

          (C)  Judge of a Hawaii circuit court or circuit family court;

          (D)  Judge of a Hawaii district court or district family court; or

          (E)  Per diem judge of a Hawaii district court or district family court; and

    [(7)] (3)  Any active, formerly active, or retired:

          (A)  Justice of the United States Supreme Court;

          (B)  Judge of the United States Court of Appeals;

          (C)  Judge or magistrate judge of the United States District Court; or

          (D)  Judge of the United States Bankruptcy Court,

          who resides in the State, formerly resided in the State while serving as a federal judge, or owns real property in the State[;

     (8)  The administrative director of the courts;

     (9)  The deputy administrative director of the courts;

    (10)  Any employee or volunteer of the office of elections; or

    (11)  Any person designated for good cause by the governor, president of the senate, speaker of the house of representatives, chief justice, chief judge of the United States District Court for the District of Hawaii, or chairperson of the office of Hawaiian affairs in the designator's respective body]."

     SECTION 4.  Statutory material to be repealed is bracketed and stricken.  New statutory material is underscored.

     SECTION 5.  This Act shall take effect upon its approval.

Report Title:

Personal Information; Covered Public Servants; Candidates; Home Address; Removal

Description:

Requires every government agency that maintains, uses, collects or processes the home address of a covered public servant or candidate, to ensure that their home address is not publicly accessible.  Requires every government agency to redact or otherwise remove home addresses from certain websites, databases, and printed documents or publications.  Authorizes an individual to request disclosure of the home address, under certain circumstances.  Allows a covered public servant or candidate to object to the disclosure of their home address.

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

STAND. COM. REP. NO. 2676

Honolulu, Hawaii

RE:     S.B. No. 3015

        S.D. 1

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Third State Legislature

Regular Session of 2026

State of Hawaii

Sir:

     Your Committee on Government Operations, to which was referred S.B. No. 3015 entitled:

"A BILL FOR AN ACT RELATING TO PERSONAL INFORMATION,"

begs leave to report as follows:

     The purpose and intent of this measure is to:

     (1)  Require every government agency that maintains, uses, collects, or processes the home address of a covered public servant or candidate, to ensure that their home address is not publicly accessible;

     (2)  Require every government agency to redact or otherwise remove home addresses from certain websites, databases, and printed documents or publications;

     (3)  Authorize an individual to request disclosure of the home address, under certain circumstances; and

     (4)  Allow a covered public servant or candidate to object to the disclosure of their home address.

     Your Committee received testimony in opposition to this measure from the Public First Law Center.

     Your Committee received comments on this measure from the Department of the Attorney General, Department of Commerce and Consumer Affairs, Office of Information Practices, Campaign Spending Commission, League of Women Voters of Hawaii, and Hawaii Professional Chapter of the Society of Professional Journalists.

     Your Committee finds that acts of violence directed at public officials and their families have increased nationwide in recent years, often facilitated by the easy public availability of personal identifying information, such as home addresses.  This measure establishes additional protections for public servants and candidates information to protect them and their families while maintaining government transparency.

     Your Committee further finds that personally identifiable information held by government entities is increasingly targeted for misuse, including identity theft and financial fraud, and that public-facing government websites, searchable databases, and bulk‑download systems can unintentionally amplify risk when sensitive information is posted or indexed.  Your Committee notes that testimony on this measure raised significant concerns regarding the home-address-specific approach, requestor-identification requirements, and objection process that could conflict with the Uniform Information Practices Act and other statutes requiring disclosure of certain address information, while also creating operational challenges for agencies charged with compliance.

     Your Committee believes that this measure's policy objectives should be to protect residents as a class, rather than creating protections that apply only to public officials, and to modernize and standardize how government entities define, secure, and prevent the inadvertent publication of sensitive personal information in publicly accessible government systems.  Additionally, these objectives should be accomplished without materially altering disclosure requirements under public records law, except for clearly enumerated categories of personal information that should not be posted publicly absent an explicit legal requirement. 

     Your Committee notes that the amendments your Committee has made to this measure are intended to shift the approach to a government-wide cybersecurity and data-handling framework focused on preventing public exposure through online systems, searchable databases, and bulk downloads, while preserving transparency obligations and lawful access to government records.

     Your Committee has amended this measure by deleting its contents and:

     (1)  Inserting language that:

          (A)  Prohibits government entities from making personal information publicly accessible through a publicly accessible information system or publicly accessible source of information, except under certain conditions;

          (B)  Allows individuals who reasonably believe their personal information is publicly accessible through a government entities' publicly accessible information system or publicly accessible source of information to submit a written notice to the entity to require corrective action;

          (C)  Establishes a cause of action to compel compliance;

          (D)  Establishes statutory penalties for intentional noncompliance;

          (E)  Requires government entities to adopt and implement policies and procedures to prevent personal information from being publicly accessible; 

          (F)  Requires government entities that own, license, maintain, use, collect, or possess personal information to implement and maintain certain reasonable security procedures and practices to protect the personal information;

          (G)  Requires government entities to provide notice to individuals in the case of a breach of a security system protecting personal information; and

          (H)  Requires government entities to submit annual reports to the Legislature;

     (2)  Amending section 1 to reflect its amended purpose;

     (3)  Inserting an effective date of January 1, 2525, to encourage further discussion; and

     (4)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

     As affirmed by the record of votes of the members of your Committee on Government Operations that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 3015, as amended herein, and recommends that it pass Second Reading in the form attached hereto as S.B. No. 3015, S.D. 1, and be referred to your Committee on Judiciary.

Respectfully submitted on behalf of the members of the Committee on Government Operations,