H.B. 1497 - Consumer Data Protection Act Summary

• Establishes a comprehensive consumer data protection framework in Hawaii governing controllers and processors that collect personal data from state residents or target them with products/services, applying to entities handling at least 100,000 consumers' data annually or 25,000 consumers' data with over 50% revenue from data sales

• Grants consumers rights to confirm if personal data is being processed, correct inaccuracies, delete data, obtain portable copies, and opt out of targeted advertising, data sales, and certain profiling, with controllers required to respond within 45 days and establish appeal processes

• Requires controllers to limit data collection to necessary information, implement reasonable security measures, obtain consent for sensitive data processing, provide clear privacy notices, and establish secure methods for consumer rights requests, with prohibitions on discriminating against consumers for exercising these rights

• Exempts government entities, financial institutions, healthcare providers, nonprofits, higher education institutions, and data covered by HIPAA, FERPA, FCRA, and other federal regulations from chapter requirements

• Establishes enforcement authority through the Attorney General's office with civil investigative demand powers, defines violations as unfair or deceptive practices, and provides a 30-day cure period before penalties apply; effective June 30, 3000