HI HB1220

Requires businesses and government agencies maintaining personal information of Hawaii residents to implement a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to their size and complexity.

Expands security breach notification requirements to include duration of exposure, types of fraudulent activities that could result, legal rights and responsibilities, and contact information for major credit reporting agencies for fraud alerts and security freezes.

Establishes private cause of action for persons harmed by security breaches to sue for damages, with minimum awards of treble damages or a set amount (left blank in draft) plus attorney's fees if defendant lacks a security program, or actual damages if defendant has implemented compliant security program.

Adds definition of "identity theft" as unauthorized use of another person's identifying information to obtain credit, goods, services, money, or property, or to commit an unlawful act.

Effective January 1, 2050.