S.B. No. 1009 - Privacy Bill Summary

• Expands the definition of "personal information" in Hawaii's data breach notification law to include nine categories of sensitive data elements such as passport numbers, financial account numbers, health insurance information, biometric data, and private encryption keys in combination with an identifier.

• Prohibits the sale of geolocation information collected from mobile devices or location-based applications without explicit prior consent from the device user, with exceptions for emergency situations.

• Prohibits the sale of internet browser history and application usage information without explicit prior consent from the internet service subscriber.

• Requires law enforcement to obtain a search warrant before accessing electronic communications in non-emergency situations and allows courts to delay notification to the affected person up to 90 days or until the discovery deadline in criminal cases.

• Criminalizes the creation and distribution of "deepfake" images that appear to depict real people in sexual or nude situations as a Class C felony, with exceptions for images made in public or through voluntary commercial transactions.