Ask Reggi Your Question Now
Can I ignore consumer requests for information or deletion in Hawaii? What are the requirements?
To comply with Hawaii law, businesses and government agencies that maintain or possess personal information of a resident of Hawaii must take reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal. This includes implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, recycling, or shredding of papers containing personal information so that information cannot be practicably read or reconstructed, implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the information cannot practicably be read or reconstructed, and describing procedures relating to the adequate destruction or proper disposal of personal records as official policy in the writings of the business entity [1.1].
Businesses or government agencies may satisfy their obligation by exercising due diligence and entering into a written contract with, and thereafter monitoring compliance by, another party engaged in the business of records destruction to destroy personal information in a manner consistent with this section. Due diligence should ordinarily include reviewing an independent audit of the disposal business’ operations or its compliance with this chapter, obtaining information about the disposal business from several references or other reliable sources and requiring that the disposal business be certified by a recognized trade association or similar third party with a reputation for high standards of quality review, or reviewing and evaluating the disposal business’ information security policies or procedures, or taking other appropriate measures to determine the competency and integrity of the disposal business [1.1].
If a business or government agency knowingly or intentionally violated a provision of this part, the agency shall be liable to the complainant in an amount equal to the sum of actual damages sustained by the complainant as a result of the failure of the agency to properly maintain the personal record, but in no case shall an individual complainant entitled to recovery receive less than the sum of $1,000, and the costs of the action together with reasonable attorney’s fees as determined by the court [3.1].
Therefore, businesses and government agencies cannot ignore consumer requests for information or deletion in Hawaii. They must take reasonable measures to protect personal information and comply with policies and procedures for the destruction or erasure of personal information. Failure to comply may result in legal action and liability for damages and attorney’s fees.
Source(s):
Jurisdiction
Hawaii