Bill Text: HI HB1023 | 2013 | Regular Session | Introduced

---

Bill Title: Internet Privacy Protection Act

Spectrum: Partisan Bill (Democrat 7-0)

Status: (Introduced - Dead) 2013-02-06 - The committee(s) on EDN/HED recommend(s) that the measure be deferred. [HB1023 Detail]

Download: Hawaii-2013-HB1023-Introduced.html

---

HOUSE OF REPRESENTATIVES	H.B. NO.	1023
TWENTY-SEVENTH LEGISLATURE, 2013
STATE OF HAWAII

A BILL FOR AN ACT

 

 

RELATING TO TECHNOLOGY.

 

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 

     SECTION 1.  The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:

"CHAPTER

INTERNET PRIVACY PROTECTION ACT

     §   -1  Title.  This chapter shall be known as the "Internet Privacy Protection Act".

     §   -2  Definitions.  As used in this chapter:

     "Access information" means user name, password, login information, or other security information that protects access to a personal internet account.

     "Educational institution" means a public or private educational institution or a separate school or department of a public or private educational institution or school system, including a preschool; primary or secondary school; kindergarten; private trade, professional, vocational, or technical school; college or university; public or private educational testing service or administrator; or an agent of an educational institution.  "Educational institution" shall be construed broadly to include public and private institutions of higher education to the greatest extent consistent with constitutional limitations.

     "Employer" means any individual, partnership, corporation, or association, including the State or any of its political subdivisions, employing or seeking to employ, any person for hire.

     "Personal internet account" means an account created via a bounded system established by an internet-based service that requires a user to input or store access information via an electronic device to view, create, utilize, or edit the user's account information, profile, display, communications, or stored data.

     §   -3  Internet privacy; prohibited actions.  (a)  An employer is prohibited from:

(1)  Requesting an employee or an applicant for employment to grant access to, allow observation of, or disclose information that allows access to or observation of the employee's or applicant's personal internet account; and

(2)  Discharging, disciplining, failing to hire, or otherwise penalizing an employee or applicant for employment for failure to grant access to, allow observation of, or disclose information that allows access to or observation of the employee's or applicant's personal internet account.

(b)  An educational institution is prohibited from:

(1)  Requesting a student or prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of the student's or prospective student's personal internet account; and

(2)  Expelling, disciplining, failing to admit, or otherwise penalizing a student or prospective student for failure to grant access to, allow observation of, or disclose information that allows access to or observation of the student's or prospective student's personal internet account.

§   -4  Internet privacy; permissible actions.  (a)  An employer may:

(1)  Request or require an employee to disclose access information to allow the employer to gain access to or operate:

(A)  An electronic communications device paid for in whole or in part by the employer; or

(B)  An account or service provided by the employer, obtained by virtue of the employee's employment relationship with the employer, or used for the employer's business purposes;

(2)  Discipline or discharge an employee for transferring the employer's proprietary or confidential information or financial data to an employee's personal internet account without the employer's authorization;

(3)  Conduct an investigation or require an employee to cooperate in an investigation if:

(A)  There is specific information about activity on the employee's personal internet account, for the purpose of ensuring compliance with applicable laws, regulatory requirements, or prohibitions against work-related employee misconduct; or

(B)  The employer has specific information about an unauthorized transfer of the employer's proprietary information, confidential information, or financial data to an employee's personal internet account;

(4)  Restrict or prohibit an employee's access to certain websites while using an electronic communications device paid for in whole or in part by the employer or while using an employer's network or resources, in accordance with state and federal law; and

(5)  Monitor, review, or access electronic data stored on an electronic communications device paid for in whole or in part by the employer, or traveling through or stored on an employer's network or resources, in accordance with state and federal law;

provided that this subsection shall not prohibit or restrict an employer from complying with a duty to screen employees or applicants prior to hiring or to monitor or retain employee communications that is established under federal law or by a self-regulatory organization, as defined in section 3(a)(26) of the federal Securities and Exchange Act of 1934, 15 United States Code 78c(a)(26); and provided further that this subsection shall not prohibit or restrict an employer from viewing, accessing, or utilizing information about an employee or applicant that can be obtained without any required access information or that is available in the public domain.

     (b)  An educational institution may request or require a student to disclose access information to the educational institution to gain access to or operate:

(1)  An electronic communications device paid for in whole or in part by the educational institution;

(2)  An account or service provided by the educational institution that is either obtained by virtue of the student's admission to the educational institution or used by the student for educational purposes;

provided that this subsection shall not prohibit or restrict an educational institution from viewing, accessing, or utilizing information about a student or prospective student that can be obtained without any required access information or that is available in the public domain.

§   -5  Liability.  (a)  Nothing in this chapter shall be construed to create a duty for an employer or educational institution to search or monitor the activity of a personal internet account.

(b)  An employer or educational institution shall not be liable under this chapter for failure to request or require that an employee, a student, an applicant for employment, or a prospective student grant access to, allow observation of, or disclose information that allows access to or observation of the employee's, student's, applicant for employment's, or prospective student's personal internet account.

§   -6  Penalties; enforcement.  (a)  An employer or educational institution who violates this chapter shall be guilty of a misdemeanor punishable by a fine not exceeding $1,000.

(b)  An individual who is the subject of a violation of this chapter may bring a civil action to enjoin the violation and may recover not more than $1,000 in damages plus reasonable attorney fees and court costs; provided that no later than sixty days before filing a civil action for damages or adding a claim for damages to an action seeking injunctive relief, the individual shall make a written demand of the alleged violator for not more than $1,000 in damages.  The written demand shall include reasonable documentation of the alleged violation.  The written demand and documentation shall be either served in the manner provided by part III of chapter 634 or mailed by certified mail with sufficient postage affixed and addressed to the alleged violator at the alleged violator's residence, principal office, or place of business.

(c)  An action under this section may be brought in the district court for the county where the alleged violation occurred or for the county where the person against whom the civil complaint is filed resides or has the person's principal place of business.

(d)  It shall be an affirmative defense to an action under this chapter that the employer or educational institution acted to comply with requirements of a federal or state law."

     SECTION 2.  This Act shall take effect upon its approval.

 

INTRODUCED BY:	_____________________________

 

 

Report Title:

Internet Privacy Protection Act

 

Description:

Prohibits educational institutions and employers from requesting a student, prospective student employee, or prospective employee to grant access to, allow observation of, or disclose information that allows access to or observation of personal internet accounts.  Provides penalties.

 

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.