{
 "jurisdiction_id": "US-HI",
 "jurisdiction": "United States – Hawaii",
 "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 22,
  "sub_modules": 57,
  "source_register": 16
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A regulator and a breach-notification instrument exist and are actively enforced/amended, but there is no omnibus material-scope, territorial-scope, or registration regime.",
   "claims": [
    {
     "statement": "The Hawaii Attorney General, through its Office of Consumer Protection, enforces privacy and data-security matters under the state's unfair-or-deceptive-acts-and-practices statutes, HRS chs. 480 and 481A.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/wp-content/uploads/2021/10/629-2017.08.09-Multistate-Nationwide-Mutual-Insurance-Assurance-of-Voluntary-Compliance.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Hawaii does not currently have a general/omnibus consumer-privacy law in effect.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Hawaii's breach-notification statute (HRS ch. 487N) defines 'personal information' narrowly as a first name/initial and last name combined with SSN, driver's license/Hawaii ID number, or financial account access credentials, and uniquely extends to paper records.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/iapp-updates-its-us-state-breach-notice-resource",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Hawaii-specific extraterritorial/controller-scope test exists; the applicable extraterritorial baseline for Hawaii residents is federal FTC Act Section 5.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "House Bill 2463 (the Hawaii 'Drop and Delete Act') would require data brokers to register annually and establish a consumer deletion mechanism, but has not been enacted.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No general lawful-basis, consent, or special-category regime is in force; only narrow sectoral carve-outs and pending bills exist.",
   "claims": [
    {
     "statement": "Hawaii Senate Bill 1163 would prohibit the sale of geolocation, microphone-derived, and internet browser information without explicit opt-in consent, but is not yet enacted.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Hawaii Revised Statutes §622-57 (Chapter 622, Title 33) protects medical records and privacy rights, and the Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, and other licensees.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No comprehensive statutory data-subject-rights framework is in force in Hawaii; the closest analogue (SB 1037) remains a pending bill.",
   "claims": [
    {
     "statement": "Hawaii Senate Bill 1037 proposes a consumer data-protection framework, including data-subject rights, with enforcement by the Attorney General, but has not been enacted into law.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "A binding breach-notification duty exists and is under active legislative amendment, but accountability/DPIA/DPO/ROPA/retention obligations are absent.",
   "claims": [
    {
     "statement": "Hawaii Revised Statutes Chapter 487N requires notification to Hawaii residents following a breach of security involving the statute's defined personal information, and is one of the few state breach laws to also cover paper records.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/iapp-updates-its-us-state-breach-notice-resource",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Hawaii Senate Bill 1038 (2026 session) would amend HRS ch. 487N by redefining 'specified data element' and 'personal information'.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state-level transfer-mechanism, adequacy, SCC/BCR, TIA, or localisation regime exists or can exist absent federal/state legislative action; this module is a structural gap by design for a US state JID.",
   "claims": [
    {
     "statement": "Hawaii has no independent state-law cross-border data-transfer mechanism; applicable transfer constraints, where they exist, arise from federal sectoral instruments such as HIPAA and GLBA rather than state statute.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Meaningful coverage exists in health and insurance/financial sectors via federal-plus-state overlay; other sub-modules show no Hawaii-specific coverage.",
   "claims": [
    {
     "statement": "The Hawaii Insurance Code imposes privacy-practice requirements on licensed insurers, producers, or other licensees, supplementing federal GLBA obligations for financial institutions.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Hawaii Revised Statutes §622-57 (Title 33, Chapter 622) protects medical records and the right to privacy, operating alongside federal HIPAA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No adtech/commercial-privacy obligation is currently in force; the only relevant instrument (SB 1163) remains pending.",
   "claims": [
    {
     "statement": "Hawaii Senate Bill 1163 would prohibit the sale of geolocation, microphone-derived, and internet browser information without explicit opt-in consent, but remains pending and is not yet law.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Newly enacted chatbot/AI-disclosure and deepfake laws provide real, recent coverage, but broader profiling/ADM-transparency, biometric, and genetic regimes remain unconfirmed or absent.",
   "claims": [
    {
     "statement": "Hawaii Senate Bill 2524 and its companion House Bill 1607 address algorithmic discrimination, proposing audit and transparency requirements and prohibitions on bias in eligibility determinations, but have not been confirmed as enacted.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Hawaii Governor signed an Artificial Intelligence Disclosure Act in the weeks preceding this research run, alongside a related bill on AI-companion-chatbot disclosures and a bill on deepfakes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/hawaii-governor-signs-artificial-intelligence",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A 2022 Hawaii Senate bill addressing genetic-information privacy was sent forward in the legislative process, but confirmation of its final enactment could not be obtained.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Federal COPPA plus a state minors/addictive-content law and a new AI-companion minor-protection law provide meaningful coverage, but education-settings and dependent-adults sub-modules show no Hawaii-specific coverage.",
   "claims": [
    {
     "statement": "Hawaii House Bill 566 seeks to protect minors from addictive content and unauthorized data processing, reported with an effective date of July 1, 2025.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/hawaii",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Federal COPPA requires operators to obtain verifiable parental consent before collecting personal information from children under 13, and applies to Hawaii-based and Hawaii-directed online services.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "FTC",
     "source_url": "https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-hawaii/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "The AG has confirmed UDAP/breach enforcement authority and there is substantial recent (within-180-day) legislative activity, but enforcement-track-record, funding/capacity, and private-right-of-action data are unconfirmed.",
   "claims": [
    {
     "statement": "The Hawaii Attorney General enforces consumer-protection and data-security matters under HRS chs. 480 and 481A (UDAP) and HRS ch. 487N (breach notification).",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/wp-content/uploads/2021/10/629-2017.08.09-Multistate-Nationwide-Mutual-Insurance-Assurance-of-Voluntary-Compliance.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A subset of US state breach-notification statutes allow a private right of action for noncompliance, but Hawaii's specific status under HRS ch. 487N was not confirmed in the sources reviewed.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/state-data-breach-notification-chart",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "In the 180 days preceding this run, Hawaii's governor signed bills on AI-companion-chatbot disclosures, an Artificial Intelligence Disclosure Act, and deepfakes, while the legislature advanced SB 1163, SB 1038, and HB 2463.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/hawaii-governor-signs-bill-ai-companion-disclosures",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}