HI SB1038

Adds a new definition for "specified data element" to Hawaii's data breach notification law, covering social security numbers (full or last 4+ digits), driver's license/passport/military ID numbers, taxpayer identification numbers, financial account numbers, security codes/passwords, biometric data, private encryption keys, and health insurance identification numbers

Expands the definition of "personal information" to include usernames/email addresses with passwords, nicknames combined with last names, phone numbers, and individual email addresses when combined with specified data elements

Requires data breach notifications when personal information is not encrypted, redacted, or otherwise rendered unreadable or unusable

Broadens the exclusion for publicly available information by removing the limitation that it must come specifically from government records

Section 2 amendments take effect April 1, 2026; general effective date of July 1, 3000 (placeholder date)