SB1038 updates Hawaii’s data breach and privacy notification law in chapter 487N, Hawaii Revised Statutes. The bill adds a new defined term, “specified data element,” covering a broader set of sensitive identifiers such as Social Security numbers, driver’s license and passport numbers, taxpayer identification numbers, military IDs, financial account and card numbers, passwords and access codes, biometric data, private keys, and health insurance identifiers.
It also expands the definition of “personal information” to include more combinations of names, usernames, email addresses, phone numbers, and the newly defined specified data elements when the information is not encrypted, redacted, or otherwise rendered unreadable. The bill removes the narrower prior list of triggering data elements and clarifies that publicly available information is excluded. Section 2 is set to take effect on April 1, 2026, while the bill’s general effective date is July 1, 3000, a common placeholder date used in Hawaii bills.
The bill would broaden the scope of Hawaii’s breach-notification and privacy protections by requiring more categories of sensitive personal data to be treated as protected information under chapter 487N. As a result, more data incidents could trigger notice obligations for businesses, agencies, and other entities that maintain personal information, and more types of identifiers would be covered by the statute’s disclosure and security requirements. The amendment would affect entities that collect, store, or transmit personal and health-related data, especially those handling biometric, financial, authentication, and insurance information.
The available legislative history suggests generally favorable sentiment toward the bill. It passed the Senate Commerce and Consumer Protection Committee on February 19, 2025, with a 3-0 vote and amendments, indicating support for strengthening privacy protections and modernizing the law. The bill text itself reflects a policy consensus that existing definitions are outdated and should be updated to address current digital privacy risks.
The main policy issue is how far to expand the definition of protected personal information and what kinds of data should trigger breach-notification duties. Supporters appear to favor a broader, more modern definition that captures biometric data, private keys, and health insurance identifiers, while any concerns would likely center on compliance burdens for covered entities and the practical effects of expanding notice obligations. No committee transcript opposition is provided, and the recorded vote shows no dissent in committee.