HI SB2389

Requires every business that maintains personal information to implement a comprehensive written policy and procedure to prevent identity theft by January 1, 2014, including administrative, technical, and physical safeguards.

Mandates the policy and procedure be designed to ensure security and confidentiality of personal information, protect against threats to security or integrity of records, and prevent security breaches.

Requires all employees to receive training on the identity theft prevention policy and procedure, and must sign acknowledgment forms that are filed in their personnel records.

Establishes a penalty of not more than $100 per violation for businesses that fail to comply with the new requirements.

Requires each business to designate an employee responsible for policy oversight and compliance with information protection laws, including coordination with law enforcement on identity theft investigations.