Can I use customer data for marketing purposes without violating privacy laws in Hawaii? What are the requirements?

Using Customer Data for Marketing Purposes in Hawaii

If you want to use customer data for marketing purposes in Hawaii, you must comply with the state’s privacy laws. Under HIRS 431:3A-303, a licensee (which includes insurance companies) cannot disclose a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer, except in certain circumstances. These circumstances include:

• Disclosing the information to the licensee’s service provider solely to perform marketing for the licensee’s own products or services, if the service provider is not authorized to directly initiate charges to the account;
• Disclosing the information to a licensee who is a producer solely to perform marketing for the licensee’s own products or services; or
• Disclosing the information to a participant in an affinity or similar program if the participants in the program are identified to the customer when the customer enters into the program.

Additionally, under HIRS 431:3A-203, a licensee must include certain information in its privacy notices, including the categories of nonpublic personal financial information that the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information, and an explanation of the consumer’s right to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties.

Under HIRS 431:3A-205, if a licensee wants to disclose nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer, the licensee must provide the consumer with a clear and conspicuous revised notice that accurately describes its policies and practices, provide the consumer with a new opt-out notice, give the consumer a reasonable opportunity to opt out of the disclosure, and not disclose the information if the consumer opts out.

Privacy Notices and Opt-Out Requirements

Under HIRS 431:3A-201, a licensee must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a consumer not later than when the licensee establishes a customer relationship, except as provided in subsection (d), and before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, if the licensee makes a disclosure other than as authorized by sections 431:3A-402 and 431:3A-403. A licensee must also provide an annual privacy notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship, as required by HIRS 431:3A-202.

Under HIRS 431:3A-204, a licensee must provide a clear and conspicuous notice to a consumer that accurately explains the right to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties and how to exercise that right. A licensee must also provide a reasonable means for the consumer to opt out, such as a toll-free telephone number or a form that can be mailed or electronically submitted.

Conclusion

To use customer data for marketing purposes in Hawaii, you must comply with the state’s privacy laws, including providing privacy notices and opt-out notices to consumers. It is important to review the specific requirements under HIRS 431:3A-303, HIRS 431:3A-203, HIRS 431:3A-205, HIRS 431:3A-201, HIRS 431:3A-202, HIRS 431:3A-204, and other relevant laws and regulations to ensure compliance.

Jurisdiction

Hawaii

• General