Ask Reggi Your Question Now
Can I use third-party cloud storage services that collect personal information in Hawaii? What are the requirements?
Using Third-Party Cloud Storage Services in Hawaii
There are no specific requirements in Hawaii that prohibit the use of third-party cloud storage services that collect personal information. However, government agencies that maintain personal information systems are required to submit an annual report on the existence and character of each personal information system added or eliminated since the agency’s previous annual report [HIRS 487N-7]. If a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, the licensee must provide the initial notice in accordance with section 431:3A-201 and enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information [HIRS 431:3A-401].
Therefore, if you plan to use third-party cloud storage services that collect personal information, you should ensure that the service provider is contractually obligated to protect the confidentiality and security of the information and to use the information only for the purposes for which it was disclosed. Additionally, if you are a government agency, you must submit an annual report on the existence and character of each personal information system added or eliminated since the agency’s previous annual report.
Conclusion
There are no specific requirements in Hawaii that prohibit the use of third-party cloud storage services that collect personal information. However, government agencies that maintain personal information systems are required to submit an annual report on the existence and character of each personal information system added or eliminated since the agency’s previous annual report. If a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, the licensee must provide the initial notice in accordance with section 431:3A-201 and enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.
Jurisdiction
Hawaii