STAND. COM. REP. NO. 616

Honolulu, Hawaii

RE: S.B. No. 974

S.D. 1

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Second State Legislature

Regular Session of 2023

State of Hawaii

Sir:

Your Committee on Commerce and Consumer Protection, to which was referred S.B. No. 974 entitled:

"A BILL FOR AN ACT RELATING TO CONSUMER DATA PROTECTION,"

begs leave to report as follows:

The purpose and intent of this measure is to:

(1) Establish a framework to regulate controllers and processors with access to personal consumer data;

(2) Establish penalties for violations of the regulations;

(3) Establish a new consumer privacy special fund; and

(4) Appropriate moneys to fund the special fund.

Your Committee received testimony in support of this measure from the Department of the Attorney General and three individuals. Your Committee received testimony in opposition to this measure from State Farm Mutual Automobile Insurance Company, Hawaiian Electric, Retail Merchants of Hawaii, and National Association of Mutual Insurance Companies. Your Committee received comments on this measure from the Department of Budget and Finance; TechNet; American Property Casualty Insurance Association; Mayer Brown, LLP; Hawaii Financial Services Association; Hawaii Insurers Council; State Privacy & Security Coalition; and California Privacy Protection Agency.

Your Committee finds that online commerce sites, social media, and mobile devices and apps are becoming an integral part of consumers' lives. However, these applications and devices have the capability to collect and share personal information to an extent not possible previously, and sometimes in ways that are not apparent to consumers. Concerns about privacy are heightened with frequent breaches, cyberattacks, and unauthorized online sharing of personal information. Regulation is needed to provide consumers with some control over their personal information. This measure therefore establishes a framework regulating controllers and processors with access to personal consumer data.

Your Committee acknowledges the concerns of multiple testifiers who note the substantial administrative burdens the measure places on certain businesses with regard to the storage and deletion of a consumer's personal data and the requirement to provide consumers with copies of their personal data. Your Committee also notes the testimony of the Department of the Attorney General, which proposed certain housekeeping amendments.

Accordingly, your Committee has amended this measure by:

(1) Clarifying that the calendar year timespan for determining whether a business is subject to the regulation imposed by this measure applies to both thresholds for applicability;

(2) Deleting language that would have granted the Department of the Attorney General investigatory powers to prosecute violations of the regulations established by this measure and replacing it with a reference to investigatory powers already granted to the Department of the Attorney General under existing law;

(3) Deleting language that would have required a controller to comply with a consumer's request to delete personal data that the controller did not obtain directly from the consumer;

(4) Deleting language that would have required a controller to comply with a consumer's request to obtain a copy of the consumer's personal data processed by the controller and replacing it with language that requires a controller to comply with a consumer's request to obtain a copy of the consumer's personal data that the consumer previously provided to the controller;

(5) Inserting a provision allowing companies that collect consumer data from third parties to either retain a limited amount of data to ensure ongoing deletion of a consumer's data or treat deletion requests as if they were opt-out requests;

(6) Inserting an effective date of July 1, 2050, to encourage further discussion; and

(7) Making technical, nonsubstantive amendments for the purposes of clarity and consistency.

As affirmed by the record of votes of the members of your Committee on Commerce and Consumer Protection that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 974, as amended herein, and recommends that it pass Second Reading in the form attached hereto as S.B. No. 974, S.D. 1, and be referred to your Committee on Ways and Means.

Respectfully submitted on behalf of the members of the Committee on Commerce and Consumer Protection,

________________________________

JARRETT KEOHOKALOLE, Chair