HB 1668 Summary

• Establishes a new consumer privacy chapter in Hawaii Revised Statutes requiring data brokers to register annually with the office of consumer protection by January 31, with a registration fee deposited into a data brokers' registry special fund.

• Creates an accessible deletion mechanism allowing consumers to submit a single verifiable request to delete all personal information held by registered data brokers, with data brokers required to process requests within 45 days.

• Data brokers must re-delete consumer personal information at least every 45 days after initial deletion and are prohibited from selling or sharing new personal information for consumers who have submitted deletion requests.

• Establishes exemptions from deletion requirements for information necessary to complete transactions, ensure security, debug systems, comply with legal obligations, or support scientific research with consumer consent.

• Requires data brokers to undergo independent third-party audits beginning January 1, 2025 and every three years thereafter to verify compliance, with violations subject to administrative fines determined by the office and expenses.