Law note · Hawaii
Hawaii Security Breach of Personal Information Act, penalties and civil action
A business that violates any provision of the Security Breach of Personal Information Act is subject to a penalty of not more than $2,500 per violation, brought by the Attorney General or the executive director of the Office of Consumer Protection. Separately and additionally, a violating business is liable to the injured party for actual damages sustained as a result of the violation, and the court may award reasonable attorneys' fees to the prevailing party.
No action under either route may be brought against a government agency, so the private right of action and the state enforcement action both reach only private businesses despite the notice duty itself extending to government agencies.
What it asks of an app
- Expect a Hawaii resident injured by a business's violation of this Act to have a private right of action for actual damages plus attorneys' fees, on top of a state penalty of up to $2,500 per violation.
- Do not assume government-agency status shields a private violator from suit. The exemption from private and state enforcement action runs to government agencies only, not to a private business handling data on a government agency's behalf.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Hawaii Revised Statutes text, Hawaii State Legislature