Bill Text: HI SB2451 | 2020 | Regular Session | Introduced

---

Bill Title: Relating To Personal Information.

Spectrum: Partisan Bill (Democrat 6-0)

Status: (Introduced - Dead) 2020-01-23 - Referred to CPH/TEC, JDC. [SB2451 Detail]

Download: Hawaii-2020-SB2451-Introduced.html

---

THE SENATE	S.B. NO.	2451
THIRTIETH LEGISLATURE, 2020
STATE OF HAWAII

A BILL FOR AN ACT

 

 

relating to personal information.

 

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 

     SECTION 1.  Chapter 487J, Hawaii Revised Statutes, is amended by adding a new section to be appropriately designated and to read as follows:

     "§487J-    Use of personal information; written consent; third parties; opt out.  (a)  A third party shall not use or sell personal information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice, provides express written consent, and is provided an opportunity to exercise the right to opt out pursuant to subsection (b).

     (b)  A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer's personal information.  This right may be referred to as the right to opt out.

     (c)  A business that sells consumers' personal information to third parties shall provide notice to consumers that the information may be sold and that consumers have the right to opt out of the sale of their personal information.

     (d)  A business that has received direction from a consumer not to sell the consumer's personal information or, in the case of a minor consumer's personal information, has not received consent to sell the minor consumer's personal information shall be prohibited from selling the consumer's personal information after its receipt of the consumer's direction, unless the consumer subsequently provides express authorization for the sale of the consumer's personal information.

     (e)  Notwithstanding subsection (a), a business shall not sell the personal information of consumers if the business has actual knowledge that the consumer is less than sixteen years of age, unless the consumer, in the case of consumers between thirteen and sixteen years of age, or the consumer's parent or guardian in the case of consumers who are less than thirteen years of age, has affirmatively authorized the sale of the consumer's personal information.  A business that wilfully disregards the consumer's age shall be deemed to have actual knowledge of the consumer's age.  This right may be referred to as the right to opt in.

     (f)  A business that is required to comply with this section shall, in a form that is reasonably accessible to consumers:

     (1)  Provide a clear and conspicuous link on the business' Internet homepage, titled "Do Not Sell My Personal Information", to an Internet webpage that enables a consumer or a person authorized by the consumer to opt out of the sale of the consumer's personal information.  A business shall not require a consumer to create an account in order to direct the business not to sell the consumer's information;

     (2)  Ensure that all individuals responsible for handling consumer inquiries about the business's privacy practices or the business's compliance with this section are informed of all requirements of this section and how to direct consumers to exercise their rights;

     (3)  For consumers who exercise their right to opt out of the sale of their personal information, refrain from selling personal information collected by the business about the consumer;

     (4)  For a consumer who has opted out of the sale of the consumer's personal information, respect the consumer's decision to opt out for at least twelve months before requesting that the consumer authorize the sale of the consumer's personal information; and

     (5)  Use any personal information collected from the consumer in connection with the submission of the consumer's opt-out request solely for the purposes of complying with the opt-out request.

     (g)  Nothing in this section shall be construed to require a business to comply with this section by including the required links and text on the homepage that the business makes available to the public generally; provided that the business maintains a separate and additional homepage that is dedicated to Hawaii consumers and includes the required links and text; provided further that the business takes reasonable steps to ensure that Hawaii consumers are directed to the homepage for Hawaii consumers and not the homepage made available to the public generally.

     (h)  A consumer may authorize another person solely to opt out of the sale of the consumer's personal information on the consumer's behalf.  A business shall comply with an opt out request received from a person authorized by the consumer to act on the consumer's behalf.

     (i)  For the purposes of this section, "third party" means a person who is not any of the following:

     (1)  The business that collects personal information from consumers under this section; or

     (2)  A person to whom the business discloses a consumer's personal information for a business purpose pursuant to a written contract; provided that the contract:

          (A)  Prohibits the person receiving the personal information from:

               (i)  Selling the personal information;

              (ii)  Retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract; or

             (iii)  Retaining, using, or disclosing the information outside of the direct business relationship between the person and the business; and

          (B)  Includes a certification made by the person receiving the personal information that the person understands the restrictions under subparagraph (A) and will comply with them."

     SECTION 2.  New statutory material is underscored.

     SECTION 3.  This Act shall take effect upon its approval.

 

INTRODUCED BY:	_____________________________

 

 

Report Title:

Personal Electronic Data; Third Parties; Consent

 

Description:

Prohibits a third party from selling or using personal information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice, provides express written consent, and is provided an opportunity to exercise the right to opt out.  Specifies notification requirements for businesses.

 

 

 

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.