S.B. 974 - Consumer Data Protection Act

• Establishes a comprehensive consumer data protection framework regulating controllers and processors that handle personal data of Hawaii residents, applying to entities processing data of at least 100,000 consumers or 25,000 consumers deriving over 25% of revenue from data sales.

• Grants consumers rights to access, correct, and delete their personal data; obtain portable copies of their data; and opt-out of targeted advertising, data sales, and certain profiling activities that affect financial services, housing, insurance, employment, and other critical decisions.

• Requires controllers to implement reasonable data security practices, provide clear privacy notices, limit data collection to necessary purposes, obtain explicit consent for sensitive data processing, and establish appeal processes for denied requests.

• Exempts government entities, nonprofits, institutions of higher education, and various regulated data types including health information under HIPAA, financial information under Gramm-Leach-Bliley Act, and data subject to other federal privacy laws.

• Authorizes the Department of the Attorney General as exclusive enforcer with authority to investigate violations, impose civil penalties up to $7,500 per violation, and recover investigation expenses, with a 30-day cure period before enforcement; establishes a consumer privacy special fund from collected penalties; effective July 1, 2050.