H.B. 2572 Summary

• Expands the definition of "personal information" under Hawaii's data breach notification law to include social security numbers, government IDs, financial account numbers, health insurance information, biometric data, and other identifiers combined with specified data elements.

• Prohibits the sale or offering for sale of contact tracing information collected from mobile devices without explicit consent, with exceptions for security incident detection and law enforcement prosecution activities.

• Requires law enforcement to obtain search warrants (rather than court orders or subpoenas) to access electronic communications and allows delays in notifying subscribers up to 90 days or until the criminal discovery deadline.

• Criminalizes the creation and distribution of deepfake images or videos depicting real persons in nude or sexual situations with intent to harm, establishing this as a Class C felony.

• Effective September 1, 2020, with sunset provision on September 1, 2025, unless sections 2-9 are reenacted.