HI SB3016

Expands Hawaii's data breach notification law (chapter 487N) by broadening the definition of "personal information" to include additional identifiers such as names, usernames, phone numbers, and email addresses.

Adds nine categories of "specified data elements" requiring breach notification, including social security numbers, driver's license numbers, military IDs, biometric data, private encryption keys, and health insurance identification numbers.

Originated from recommendations by the twenty-first century privacy law task force convened in 2019 to examine privacy protections in the digital era.

Exempts telecommunications carriers complying with federal customer proprietary network information rules (47 USC 222) from state breach notification requirements, alongside existing exemptions for financial institutions and HIPAA-covered entities.

Takes effect July 1, 2050.