Can I skip obtaining consent to sell personal information in Hawaii? What are the requirements?

To sell personal information in Hawaii, you must obtain consent from the individuals whose information you are selling. There are no exceptions to this requirement. Hawaii law requires government agencies to submit an annual report on the existence and character of each personal information system added or eliminated since the agency’s previous annual report. The report must include the name or descriptive title of the personal information system and its location, the nature and purpose of the personal information system and the statutory or administrative authority for its establishment, the categories of individuals on whom personal information is maintained, and the categories of personal information generally maintained in the system, among other things ^[2.1]. The Information Privacy and Security Council is responsible for developing guidelines to be considered by government agencies in deciding whether, how, and when a government agency shall inform affected individuals of the loss, disclosure, or security breach of personal information that can contribute to identity theft ^[2.3]. If a government agency discovers a material occurrence of unauthorized access to personal information records in connection with or after its disposal by or on behalf of the government agency, it must submit a written report to the legislature within twenty days after the discovery of the incident ^[1.2].

Source(s):

• [2.1] Personal information system; government agencies; annual report Personal information protection requirements. L Sp 2008, c 10, §§7 to 15. Personal information policy and oversight responsibilities for government agencies, see §487J-5.
• [2.3] Information privacy and security council; established; duties; reports.
• [1.2] Reporting requirements.

Jurisdiction

Hawaii

• Privacy