STAND. COM. REP. NO. 899

Honolulu, Hawaii

RE: S.B. No. 974

S.D. 2

Honorable Ronald D. Kouchi

President of the Senate

Thirty-Second State Legislature

Regular Session of 2023

State of Hawaii

Sir:

Your Committee on Ways and Means, to which was referred S.B. No. 974, S.D. 1, entitled:

"A BILL FOR AN ACT RELATING TO CONSUMER DATA PROTECTION,"

begs leave to report as follows:

The purpose and intent of this measure is to protect certain consumer data.

More specifically, this measure:

(1) Establishes a framework for the regulation of controllers and processors having access to personal consumer data;

(2) Enumerates consumers' personal data rights;

(3) Establishes a consumer privacy special fund; and

(4) Appropriates moneys for consumer data protection.

Your Committee received written comments in support of this measure from BSA The Software Alliance and Fellow of Information Privacy.

Your Committee received written comments in opposition to this measure from Hawaiian Electric Company, National Insurance Crime Bureau, and State Farm.

Your Committee received written comments on this measure from the Department of Commerce and Consumer Affairs, Office of Consumer Protection; Department of the Attorney General; American Property Casualty Insurance Association; California Privacy Protection Agency; Consumer Reports; Hawaii Bankers Association; Hawaii Credit Union League; Hawaii Financial Services Association; Hawaii Insurers Council; State Privacy & Security Coalition; TechNet; and one individual.

Your Committee finds that enumerating a strong set of consumer rights and establishing restrictions on the use of consumer data and the responsibilities of controllers and processors will provide each consumer with increased control over the consumer's personal data and increased transparency for the use of consumer data.

Your Committee has amended this measure by:

(1) Exempting the National Insurance Crime Bureau from certain consumer data protection requirements;

(2) Clarifying that if a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall disclose the processing to the affected consumer;

(3) Clarifying the required contents of contracts between a controller and a processor; and

(4) Making technical nonsubstantive amendments for purposes of clarity, consistency, and style.

As affirmed by the record of votes of the members of your Committee on Ways and Means that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 974, S.D. 1, as amended herein, and recommends that it pass Third Reading in the form attached hereto as S.B. No. 974, S.D. 2.

Respectfully submitted on behalf of the members of the Committee on Ways and Means,

________________________________

DONOVAN M. DELA CRUZ, Chair