H.B. 678 Summary

• Requires government agencies maintaining personal information systems to implement mandatory training programs for personnel with access to that information.

• Mandates businesses maintaining personal information about Hawaii residents to implement a comprehensive written information security program with administrative, technical, and physical safeguards.

• Expands the definition of "security breach" to include inadvertent, unauthorized disclosure of unencrypted or unredacted personal information records.

• Requires security breach notices to include toll-free contact information and addresses for major credit reporting agencies and information on placing fraud alerts or security freezes.

• Requires government agencies to report security breaches to the legislature and information privacy and security council within twenty days of discovery and appropriates unspecified funds for council positions and security tools.