SB2292 SD2 SSCR2602

 

STAND. COM. REP. NO. 2602

Honolulu, Hawaii

RE: S.B. No. 2292

S.D. 2

 

 

Honorable Robert Bunda

President of the Senate

Twenty-Third State Legislature

Regular Session of 2006

State of Hawaii

Sir:

Your Committee on Judiciary and Hawaiian Affairs, to which was referred S.B. No. 2292, S.D. 1, entitled:

"A BILL FOR AN ACT RELATING TO DESTRUCTION OF PERSONAL INFORMATION RECORDS,"

begs leave to report as follows:

The purpose of this measure is to require businesses that maintain or possess personal information of Hawaii residents to protect against unauthorized access to or use of the information after its disposal by properly destroying the personal information.

Your Committee received testimony in support of this measure from the Department of Commerce and Consumer Affairs, the Honolulu Police Department, Retail Merchants of Hawaii, and the Hawaii Bankers Association. Testimony in opposition of this measure was submitted from the Property Casualty Insurers Association of America. The American Council of Life Insurers submitted comments.

As one measure from the Department of Commerce and Consumer Affair's identity theft proposals, this measure is part of a larger Senate package of identity theft bills that has evolved from the work of the Hawaii Anti-Phishing Task Force. In 2005, the Hawaii Anti-Phishing Task Force was established in the Department of the Attorney General to develop state policy on how best to prevent further occurrences of phishing and other forms of electronic commerce-based crimes in the State.

Business records are a leading source of personal information for identity thieves. Any entity that maintains personal information as part of its business operations should establish security procedures to maintain the confidentiality and integrity of that information.

Your Committee finds that this measure requires businesses that collect personal identifying information to take reasonable measures to protect this information from unauthorized access by properly discarding and destroying the information. This measure originally imposed requirements only on businesses, but the Department of Commerce and Consumer Affairs recognizes and your Committee finds that the obligations imposed by this measure should also extend to government agencies in Hawaii.

Your Committee has amended this measure by:

(1) Deleting the exclusion of government agencies from the definition of "business";

(2) Adding a definition for "government agency" to the definitions section;

(3) Adding "government agency" throughout the measure to clarify that the provisions also include and apply to government agencies;

(4) Adopting the suggestion made by the Hawaii Bankers Association and deleting the unnecessary language referring to federal law for financial institutions;

(5) Deleting "person" and adding "business" in the penalty section to clarify that the cause of action will be against a business and not a person;

(6) Adding a monetary damages penalty in addition to the provision that allows for a cause of action based upon unfair or deceptive acts or practices declared unlawful under section 480-2, Hawaii Revised Statutes;

(7) Adding language that exempts government agencies from both penalty provisions; and

(8) Making technical, nonsubstantive changes to correctly reflect the format and style of the Hawaii Revised Statutes.

As affirmed by the record of votes of the members of your Committee on Judiciary and Hawaiian Affairs that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 2292, S.D. 1, as amended herein, and recommends that it pass Third Reading in the form attached hereto as S.B. No. 2292, S.D. 2.

Respectfully submitted on behalf of the members of the Committee on Judiciary and Hawaiian Affairs,

		____________________________ COLLEEN HANABUSA, Chair