SB2738 CD1

SECTION 1. The legislature finds that the information privacy and security council, administratively attached to the department of accounting and general services, was established by Act 10, Special Session Laws of Hawaii 2008, and codified into law under section 487N-5, Hawaii Revised Statutes, to develop guidelines to be considered by government agencies in deciding whether, how, and when a government agency shall inform affected individuals of the loss, disclosure, or security breach of personal information that can contribute to identity theft. Personal information is defined in section 487N-1, Hawaii Revised Statutes, as "an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(1) Social security number;

(2) Driver's license number or Hawaii identification card number; or

(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account."

Currently, some local and state government agencies, including county law enforcement, are required under sections 52D-14 and 261-17.7, Hawaii Revised Statutes, to provide unclaimed property to finders after forty-five days. Given that cell phones, computers, and other electronic devices may contain personal information, the legislature agrees with the council's recommendation that state law be amended to keep pace with technology so that personal information on these devices is protected.

The purpose of this Act is to protect the personal information of individuals by providing county police departments and the department of transportation the authority to sanitize unclaimed electronic devices, in accordance with recognized standards and guidelines, before providing the unclaimed property to finders or disposing of the property by public auction or other means.

SECTION 2. Section 52D-14, Hawaii Revised Statutes, is amended to read as follows:

"[[]§52D-14[]] Duty and right of finders. (a) Except as provided in section 261-17.7, all money or property found shall be reported or delivered by the finder to the chief of police of the county. When so delivered, it shall be held by the chief of police for forty-five days or until claimed by some person who establishes title or right of custody thereto to the satisfaction of the chief of police. If title or right of custody is established, the money or property shall be delivered to the claimant by the chief of police.

(b) If no claim is made or no such right is established within the forty-five days, the money or property shall be returned to the person who delivered it to the chief of police[;], except as provided in subsection (c); provided that if the person who delivered it to the chief of police fails to claim the money or property within thirty days after being notified by the chief of police that the person is entitled to possession, the chief of police shall dispose of the money or property in accordance with the procedures established in section 52D-10. For the purpose of this section, notice by regular mail to the person's last known address shall be sufficient.

(c) Before an electronic device that allows for storage of personal information is returned to the finder or disposed of by public auction or other means, the device shall be sanitized in accordance with guidance provided by the information privacy and security council to ensure removal of personal information. If removal of personal information is not possible or cannot be verified without unreasonable expense, the device shall be destroyed in a manner sufficient to eliminate the information, and then disposed of or recycled. The chief of police shall make reasonable efforts to notify the finder that the device was destroyed and disposed of or recycled because personal information could not be removed.

For purposes of this subsection, "personal information" shall have the same meaning as in section 487N-1."

SECTION 3. Section 261-17.7, Hawaii Revised Statutes, is amended to read as follows:

"§261-17.7 Lost and found money or property at airports. (a) All money or property found at an airport owned or controlled by the department shall be reported or delivered by the finder to the airport lost and found, and when so delivered shall be held by the department for forty-five days or until claimed by some person who establishes title or right of custody thereto to the satisfaction of the department. In the event of the establishment of title or right of custody, the money or property shall be delivered to the claimant by the director or the director's agent. If within forty-five days no claimant establishes a right to the money or property, the money or property, except as provided in subsection (d) with regard to electronic devices, shall be returned to the person who delivered it to the airport lost and found; provided that if the person who delivered it to the airport lost and found fails to claim the money or property within thirty days after being notified by the director, the director shall deposit the money into the state treasury to the credit of the airport revenue fund or shall dispose of the property by public auction.

(b) At least once annually, the director shall give public notice giving details as to time and place of the auction and giving notice to all persons interested or claiming the property that unless claims are made by persons who can provide satisfactory proof of ownership before a specified date, the property will be sold at public auction to the highest bidder. On the day and at the place specified in the notice, all property for which no satisfactory proof of ownership is made shall be sold by auction by or under the direction of the director.

If any property [~~which~~] that is of a perishable nature or unreasonably expensive to keep or safeguard remains unclaimed at the airport, the director may sell that property at public auction, at a time and after notice that is reasonable under the circumstances. The director shall immediately after the sale of any property pay to the airport revenue fund all moneys received by the director upon sale.

(c) For the purpose of this section, notice by regular mail to the last known address of the person who delivered the money or property to the airport lost and found shall be deemed sufficient.

(d) Before an electronic device that allows for storage of personal information is returned to the finder or disposed of by public auction or other means, the device shall be sanitized by the director or the director's agent in accordance with guidance provided by the information privacy and security council to ensure removal of personal information. If removal of personal information is not possible or cannot be verified without unreasonable expense, the device shall be destroyed in a manner sufficient to eliminate the information, and then disposed of or recycled. The director or the director's agent shall make reasonable efforts to notify the finder that the device was destroyed and disposed of or recycled because personal information could not be removed.

For purposes of this subsection, "personal information" shall have the same meaning as in section 487N-1."

SECTION 4. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.

SECTION 5. This Act shall take effect upon its approval.

THE SENATE	S.B. NO.	2738
TWENTY-NINTH LEGISLATURE, 2018		S.D. 1
STATE OF HAWAII		H.D. 1
		C.D. 1