Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I collect personal information from participants in Hawaii? What are the requirements?

Requirements for Collecting Personal Information from Participants in Hawaii

If you plan to collect personal information from participants in Hawaii, you must comply with the following requirements:

  1. Submit an Annual Report: Any government agency that maintains one or more personal information systems shall submit an annual report to the council on the existence and character of each personal information system added or eliminated since the agency’s previous annual report. The report shall include specific information about the personal information system [1.1][1.2].
  2. Identify Best Practices: The Information Privacy and Security Council shall identify best practices to assist government agencies in improving security and privacy programs relating to personal information. The best practices identified by the council shall be posted on each government agency’s website in a manner that is readily accessible by employees of the government agency [1.3].
  3. Notify Recruits: If an organization collects criminal record and marital history information, it is required to notify recruits that such information is available upon request, disseminate the information to a recruit in the recruit’s native language, require a Hawaii resident requesting the services of an international matchmaking organization to submit or authorize the international matchmaking organization access to the resident’s complete criminal history and marital history information, and submit an annual report on its business activities to the department of commerce and consumer affairs [3.1].
  4. Allow Access to Personal Record: Upon the request of an individual to gain access to the individual’s personal record, an agency shall permit the individual to review the record and have a copy made within ten working days following the date of receipt of the request by the agency unless the personal record requested is exempted under section 92F-22. The ten-day period may be extended for an additional twenty working days if the agency provides to the individual, within the initial ten working days, a written explanation of unusual circumstances causing the delay [5.1].
  5. Do Not Attempt to Re-identify Personal Information: The agency and the agency’s designees shall not attempt to re-identify subjects of protected health information submitted to the agency or its designee [2.1].
  6. Disclose Personal Record Only to Authorized Persons: The personal record of an individual shall not be disclosed to any person other than the individual to whom the record pertains, except as authorized by sections 92E-4 or 92E-13, HRS, or both [4.2].
  7. Civil Actions and Remedies: An individual may bring a civil action against an agency in a circuit court of the State whenever an agency fails to comply with any provision of this part, and after appropriate administrative remedies have been exhausted. The court may order the agency to correct or amend the complainant’s personal record, to require any other agency action, or to enjoin such agency from improper actions as the court may deem necessary and appropriate to render substantial relief. In any action brought under this section in which the court determines that the agency knowingly or intentionally violated a provision of this part, the agency shall be liable to the complainant in an amount equal to the sum of actual damages sustained by the complainant as a result of the failure of the agency to properly maintain the personal record, but in no case shall an individual complainant entitled to recovery receive less than the sum of $1,000, and the costs of the action together with reasonable attorney’s fees as determined by the court [5.2].

Therefore, to collect personal information from participants in Hawaii, you must comply with the above requirements.

Source(s):
Jurisdiction

Hawaii