HB 1497 Summary

• Establishes Hawaii Consumer Data Protection Act creating rights for consumers to access, correct, delete, and port their personal data, with opt-out rights for targeted advertising and data sales.

• Applies to businesses conducting operations in Hawaii that control personal data of at least 100,000 consumers annually or 25,000 consumers where over 50% of revenue derives from data sales; exempts government entities, financial institutions, nonprofits, and higher education institutions.

• Requires controllers to limit data collection to necessary information, obtain consent for processing sensitive data (biometric, health, geolocation, children's data), maintain reasonable security practices, and provide clear privacy notices.

• Mandates controllers conduct data protection assessments for targeted advertising, data sales, profiling with significant risks, and sensitive data processing; assessments are confidential and exempt from public disclosure.

• Grants Hawaii Attorney General investigative authority including subpoena power; violations constitute unfair/deceptive trade practices subject to civil penalties, with 30-day cure period before enforcement action.