Hawaii’s privacy laws start with a constitutional right to privacy and are filled in by statutes covering data breach notification, secure record disposal, access to government-held records, and consumer protection. There is no single comprehensive consumer data privacy act in Hawaii, but the rules already on the books create real obligations for businesses and real rights for residents.
The Constitutional Right to Privacy
Hawaii’s constitution puts privacy on a stronger footing than most states. Article I, Section 6 states: “The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right.”
That “compelling state interest” standard matters. The government needs a strong justification before overriding your privacy, not just a reasonable one. When courts weigh disputes over surveillance, government record access, or disclosure of sensitive information, this constitutional provision sits in the background of every statute discussed below.
Data Breach Notification Under Chapter 487N
The Security Breach of Personal Information Act, Hawaii Revised Statutes Chapter 487N, is the law most businesses encounter first. It applies to any business that owns or licenses personal information of Hawaii residents, any business operating in Hawaii that possesses such information, and any government agency that collects personal information. After a breach, the entity must notify affected individuals without unreasonable delay.1Justia. Hawaii Code 487N-2 – Notice of Security Breach
Hawaii does not set a fixed deadline in days. The standard is “without unreasonable delay,” with allowances for law enforcement needs and the time necessary to determine the breach’s scope and restore data system integrity.2Hawaii Office of Information Practices. Hawaii Revised Statutes Chapter 487N – Security Breach of Personal Information A business that only maintains records it doesn’t own must notify the actual owner or licensee immediately after discovering the breach. Law enforcement can request a written delay if notification would interfere with a criminal investigation or jeopardize national security; once that concern lifts, the clock starts again.
What Counts as Personal Information
Not every data leak triggers notification. Under Chapter 487N, “personal information” is an individual’s first name or first initial and last name combined with at least one of the following, where either the name or the data element is unencrypted:
- Social Security number
- Driver’s license or Hawaii state ID number
- Financial account number, credit card number, debit card number, access code, or password that would allow access to a financial account
Information already lawfully available in public government records does not count as personal information under this definition.1Justia. Hawaii Code 487N-2 – Notice of Security Breach
The Encryption Safe Harbor
If the compromised data was encrypted or redacted and the encryption key or process was not also stolen, the notification requirement does not apply. Proper encryption is a legal shield, not just good security practice. But if an intruder gets both the encrypted records and the key needed to read them, that still counts as a security breach requiring notice.2Hawaii Office of Information Practices. Hawaii Revised Statutes Chapter 487N – Security Breach of Personal Information
When Substitute Notice Is Allowed
Substitute notice is available when the cost of direct notification would exceed $100,000, more than 200,000 people are affected, or the business lacks sufficient contact information. Substitute notice requires all three of these steps together: emailing anyone whose email address the business has, posting a conspicuous notice on the business’s website, and notifying major statewide media outlets.2Hawaii Office of Information Practices. Hawaii Revised Statutes Chapter 487N – Security Breach of Personal Information
Secure Disposal of Records Under Chapter 487R
Chapter 487R sits alongside the breach law and works before anything goes wrong. Businesses and government agencies must take reasonable steps when disposing of records containing personal information so the records can’t be reconstructed.
Paper records must be burned, pulverized, recycled, or shredded to the point that the information can’t practically be read or pieced back together. Electronic and other non-paper media must be destroyed or erased to the same standard. Businesses must document these procedures as part of their official policies.3Hawaii Office of Information Practices. Chapter 487R – Destruction of Personal Information Records
You can hire a third-party service to do the destruction, but you can’t hand off the responsibility. The law requires a written contract with the destruction company and due diligence, meaning you review independent audits of the vendor’s operations, check references and certifications, or evaluate its security policies. Dropping boxes at a shredding service without vetting doesn’t meet the standard.3Hawaii Office of Information Practices. Chapter 487R – Destruction of Personal Information Records
Access to Your Government Records
Hawaii’s Uniform Information Practices Act, Chapter 92F, governs how state and county agencies handle personal records. It promotes public access to government records while protecting individuals from unwarranted invasions of privacy. When those interests collide, agencies must allow access unless disclosure would constitute a clearly unwarranted invasion of personal privacy.
As an individual, you have the right to access your own personal records held by any state or county agency and to have factual errors corrected. The Office of Information Practices oversees compliance and helps resolve disputes over record access and privacy.
Consumer Protection and Data Practices
Hawaii’s Consumer Protection Act, mainly Chapter 480, broadly prohibits unfair or deceptive acts or practices in trade or commerce. It isn’t a data privacy law on its face, but it gives the state a tool against businesses that mishandle personal data in deceptive or unfair ways.4Justia. Hawaii Code 480-2 – Unfair Competition, Practices
Enforcement can come from consumers, the Attorney General, or the director of the Office of Consumer Protection. A business that collects data under false pretenses, ignores its own privacy policy, or uses data in ways consumers never agreed to can face a consumer protection claim even where no specific data privacy statute covers the conduct.4Justia. Hawaii Code 480-2 – Unfair Competition, Practices
Health and Student Records
Federal law does most of the work in these two areas. Healthcare providers and their business associates comply with HIPAA. Student records at Hawaii’s public schools are covered by the federal Family Educational Rights and Privacy Act, which lets parents inspect, review, challenge, and copy their children’s records and control who else sees them; those rights transfer to the student at 18. Hawaii Administrative Rules Chapter 34 mirrors and implements these federal protections at the state level.5Hawaiʻi State Department of Education. Student Privacy
Penalties and Enforcement
Under both Chapter 487N and Chapter 487R, the maximum civil penalty is $2,500 per violation. The Attorney General or the executive director of the Office of Consumer Protection can bring enforcement actions. On top of the per-violation penalty, businesses are liable to injured individuals for actual damages, and courts can award reasonable attorney’s fees to the prevailing party.6Justia. Hawaii Code 487N-3 – Penalties, Civil Action
Two details matter. Government agencies are exempt from these penalty actions. And the penalties under both chapters are cumulative with other remedies under Hawaii law, so a business that fails to notify under 487N can also face a separate action under Chapter 480 for deceptive practices, or under 487R if disposal was also mishandled.3Hawaii Office of Information Practices. Chapter 487R – Destruction of Personal Information Records
The $2,500 per-violation cap looks modest compared to some states, but violations are counted individually. A breach touching thousands of people generates substantial exposure, and the real financial risk is the combination of statutory penalties, actual damages, and attorney’s fees.
Legal Defenses and Exceptions
The encryption safe harbor is the strongest built-in defense: if breached data was encrypted and the key wasn’t compromised, notification isn’t required and the breach falls outside the statute.
Disclosure required by law, such as a response to a court order or subpoena, generally does not create liability. Hawaii regulations and court opinions recognize that a release compelled by a court or agency of competent jurisdiction doesn’t violate privacy protections.7Legal Information Institute. Hawaii Code R. 11-160-56 – Confidential Information, Exceptions Medical records get extra protection, because even a valid subpoena may not override physician-patient privilege or specific confidentiality statutes covering mental health, HIV/AIDS, or substance abuse records.
Following industry-standard security practices before a breach can also reduce liability, though it isn’t a complete shield. A company with reasonable security measures, documented policies, and a fast response after discovery is in a far better position than one that ignored basic safeguards.
What Hawaii Does Not Yet Have
Hawaii has no comprehensive consumer data privacy law. Bills modeled after laws in other states, giving consumers the right to access, delete, and opt out of the sale of their personal data, have been introduced repeatedly and failed to pass. Most recently, SB 1037, a proposed Consumer Data Protection Act, died in the Hawaii Senate in March 2025 after missing the crossover deadline.
Hawaii also has no enacted biometric privacy law. SB 1085, introduced in 2023, would have required businesses to obtain consent before collecting fingerprints, facial recognition data, and other biometric identifiers, and would have imposed retention limits. It was rejected in May 2023. Until legislation passes, biometric data in Hawaii is not covered by a specific state statute, though misuse could still fall under Chapter 480’s consumer protection provisions.
This is the biggest gap in Hawaii’s framework. Breach notification and record destruction laws protect you after something goes wrong, but there is no broad right to know what a business has collected about you, request its deletion, or stop its sale.