S.B. 974 - Consumer Data Protection Act

• Establishes comprehensive data privacy framework requiring controllers and processors handling personal data of at least 100,000 Hawaii residents (or 25,000 residents with 25%+ revenue from data sales) to comply with transparency and consumer rights requirements.

• Grants consumers rights to access, correct, delete, and port their personal data; opt-out of targeted advertising, data sales, and certain profiling; and revoke consent, with 45-day response deadline for controllers.

• Requires controllers to conduct data protection assessments for targeted advertising, data sales, sensitive data processing, and high-risk profiling; prohibits discrimination against consumers exercising privacy rights.

• Establishes Attorney General as exclusive enforcer with authority to issue 30-day cure notices before imposing civil penalties up to $7,500 per violation and seeking injunctions.

• Creates consumer privacy special fund to receive civil penalties and appropriations for administration; effective July 1, 2050.