STAND. COM. REP. NO. 3689

 

Honolulu, Hawaii

                  

 

RE:    H.B. No. 2572

       H.D. 2

       S.D. 1

 

 

 

Honorable Ronald D. Kouchi

President of the Senate

Thirtieth State Legislature

Regular Session of 2020

State of Hawaii

 

Sir:

 

     Your Committees on Commerce, Consumer Protection, and Health and Technology, to which was referred H.B. No. 2572, H.D. 2, entitled:

 

"A BILL FOR AN ACT RELATING TO PRIVACY,"

 

beg leave to report as follows:

 

     The purpose and intent of this measure is to:

 

     (1)  Modernize the definition of "personal information" for the purposes of security breach of personal information law;

 

     (2)  Prohibit the sale of geolocation information and internet browser information without consent;

 

     (3)  Amend provisions relating to electronic eavesdropping law; and

 

     (4)  Prohibit certain manipulated images of individuals.

 

     Prior to the hearing on this measure, your Committees posted and made available for public review a proposed S.D. 1, which amends this measure by:

 

     (1)  Clarifying that the definition of "emergency" shall not include the spread of a bacteria or virus;

 

     (2)  Deleting provisions that would have prohibited the sale of internet browser information without consent;

 

     (3)  Deleting the definition of "electronically stored data";

 

     (4)  Deleting language that would have required law enforcement to obtain a search warrant before accessing a person's electronic communications in non-exigent or non-consensual circumstances;

 

     (5)  Deleting language that would have authorized government entities to request, and authorize courts to approve, the delay of notifications of law enforcement access to electronic communications up to the deadline to provide discovery in criminal cases;

 

     (6)  Deleting language that would have prohibited the unauthorized use of deep fake technology;

 

     (7)  Amending section 1 to reflect its amended purpose;

 

     (8)  Inserting an effective date of upon its approval; and

 

     (9)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

 

     Your Committees received testimony in support of this measure or the proposed S.D. 1 from the Department of Commerce and Consumer Affairs, Department of the Prosecuting Attorney for the City and County of Honolulu, Office of Enterprise Technology Services, and four individuals.  Your Committees received testimony in opposition to this measure or the proposed S.D. 1 from the Retail Merchants of Hawaii; CTIA; Charter Communications, Inc.; State Privacy & Security Coalition; Association of National Advertisers; American Association of Advertising Agencies; Interactive Advertising Bureau; Network Advertising Initiative; and the American Advertising Federation.  Your Committees received comments on this measure or the proposed S.D. 1 from Hawaiian Electric, Hawaii Credit Union League, Hawaii Bankers Association, and RELX Group.

 

     Your Committees find that businesses that collect or store data digitally have a responsibility to protect information that is sensitive, confidential, or identifiable from access by hackers.  These businesses also have the responsibility to prevent data from being made available to criminals who engage in identity theft.  As of 2018, all fifty states have data breach notification laws that prescribe when consumers must be notified that their personal information has been breached.  Hawaii's data breach notification law, which among other things defines the term "personal information", was codified in 2006.  While Hawaii was one of the first states to enact such a law, advancements in technology have made identity theft easier than it was nearly fifteen years ago.  Businesses and government agencies now collect far more information, and bad actors are able to exploit vulnerabilities in computer databases for nefarious purposes and with increased frequency.  In light of the increased digital activity users must engage in due to the COVID-19 pandemic, increased protections are necessary to safeguard Hawaii residents.  This measure expands the definition of "personal information" to include various personal identifiers and data elements and enhances consumer protections involving privacy to align with legislation recently enacted in other jurisdictions.

 

     Your Committees have heard the concerns raised in testimony that the proposed S.D. 1 eliminates certain portions of the H.D. 2, which in application were intended to help support the overall purpose of this measure and provide additional privacy protections for Hawaii residents in criminal cases.  Furthermore, to the extent that the proposed S.D. 1 attempts to regulate COVID‑19 contact tracing activities, amendments are necessary to establish principles that safeguard individuals' privacy.

 

     Accordingly, your Committees have amended this measure by adopting the proposed S.D. 1 and further amending the measure by:

 

     (1)  Amending the definition for "identifier";

 

     (2)  Amending the definition for "specified data element";

 

     (3)  Clarifying that the definition for "personal information" means an identifier in combination with one or more specified data elements, when the specified data element or elements are not encrypted or otherwise rendered unreadable;

 

     (4)  Amending the title of the new section being added to chapter 481B, Hawaii Revised Statutes, to read "Sale of contact tracing information without consent is prohibited";

 

     (5)  Clarifying that no person or state agency, in any manner, or by any means, shall sell or offer for sale contact tracing information that is recorded or controlled without the consent of the individual who is the primary user of the device or application;

 

     (6)  Inserting language that clarifies the prohibition on the sale of contact tracing information without consent shall not apply to any activity involving the collection, maintenance, disclosure, sale, communication, or use of geolocation information to detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute those responsible for that activity;

 

     (7)  Amending the definitions for "consent", "sale", and "user";

 

     (8)  Inserting definitions for "contact tracing information" and "service provider";

 

     (9)  Deleting the definitions for "geolocation information", "location-based application", and "precise location";

 

    (10)  Removing references to "geolocation information" and replacing them with "contact tracing information";

 

    (11)  Restoring certain parts from H.B. No. 2572, H.D. 2, which:

 

          (A)  Inserts a definition for "electronically stored data";

 

          (B)  Requires law enforcement to obtain a search warrant before accessing a person's electronic communications in non-exigent or non-consensual circumstances;

 

          (C)  Authorizes government entities to request, and authorizes courts to approve, the delay of notifications of law enforcement access to electronic communications up to the deadline to provide discovery in criminal cases; and

 

          (D)  Prohibits the unauthorized use of deep fake technology;

 

    (12)  Amending section 1 to reflect its amended purpose;

 

    (13)  Inserting an effective date of September 1, 2020; provided that this measure shall repeal on September 1, 2025; and

 

    (14)  Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

 

     As affirmed by the records of votes of the members of your Committees on Commerce, Consumer Protection, and Health and Technology that are attached to this report, your Committees are in accord with the intent and purpose of H.B. No. 2572, H.D. 2, as amended herein, and recommend that it pass Second Reading in the form attached hereto as H.B. No. 2572, H.D. 2, S.D. 1, and be referred to your Committee on Judiciary.

 

Respectfully submitted on behalf of the members of the Committees on Commerce, Consumer Protection, and Health and Technology,

 

________________________________

JARRETT KEOHOKALOLE, Chair

 

________________________________

ROSALYN H. BAKER, Chair