reglab/statecodes huggingface dataset:
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-8 Powers and duties of other departments and agencies.

§487-8 Powers and duties of other departments and agencies.
Nothing contained in this chapter shall be deemed to delegate or detract in any way from the functions, powers and duties prescribed by law for any other department or agency of the State, nor to interrupt or preclude the direct relationships of any such department or agency or units of county government in the performance of such functions, powers and duties. [L 1969, c 175, §8]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-9 Investigations.

§487-9 Investigations.
The director in the course of the director's investigations may subpoena witnesses, examine them under oath, and require the production of books, papers, documents, or objects which the director deems relevant to the investigation. Service of the subpoena may be made personally within this State, but if personal service cannot be obtained, substituted service may be made on any witness over whom the courts can exercise jurisdiction pursuant to chapter 634, in the following manner:
(1) Personal service outside the State;
(2) Mailing by registered or certified mail to the last known place of business, residence, or abode within or without this State of the person to be served;
(3) As to any person other than a natural person, in the manner provided in the Hawaii rules of civil procedure as if a complaint had been filed; or
(4) Such service as the circuit court may direct in lieu of personal service within this State.
Upon application by the director, obedience to the subpoena may be enforced by the circuit courts of this State in the county where the person subpoenaed resides or is found in the same manner as a subpoena issued by the clerk of a circuit court. If the person is a nonresident or has no principal place of business within this State, obedience to the subpoena may also be enforced by a circuit court of this State in the county where the subpoena was issued. The director may conduct hearings in aid of any investigation or inquiry, and may prescribe forms and adopt rules as may be necessary in the interest of the consumer public. [L 1969, c 175, §9; am L 1976, c 94, §1; gen ch 1985; am L 1998, c 200, §1]
Cross References
Hearings, see chapter 91.
Rules of Court
Service of process, see HRCP rule 4.
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-10 Investigators, appointment and powers.

§487-10 Investigators, appointment and powers.
The director shall appoint and commission one or more investigators as the exigencies of the public service may require. Persons appointed and commissioned under this section shall have and may exercise all the powers and authority of a police officer or of a deputy sheriff in the service of process or in the service of subpoenas. [L 1969, c 175, §10; am L 1989, c 211, §10; am L 1990, c 281, §11; am L 2016, c 5, §1]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-12 Assurance of voluntary compliance.

§487-12 Assurance of voluntary compliance.
In lieu of instituting or continuing an investigation or action pursuant to section 487-5(6), the director may accept written assurance of voluntary compliance from the person or persons suspected of violation. The director will obtain the agreement of the affected consumers where possible. In no event shall the fact that a person who enters into an assurance of voluntary compliance be considered an admission of violation, nor shall such written assurance constitute prima facie evidence of any violation. The assurance may include a stipulation for reimbursement to some or all consumers who have been damaged by an alleged unlawful act or practice and payment of costs of investigation. All assurances of voluntary compliance may be made a matter of public record. A consumer need not accept restitution pursuant to the stipulation, but the consumer's stipulated agreement to the assurance or the consumer's acceptance and full performance of restitution shall bar recovery of any other damages in any action on account of the same acts or practices by the consumer against the person or persons making restitution. [L 1974, c 61, §1; gen ch 1985]
Revision Note
Section "487-5(6)" substituted for "487-5(5)".
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-13 Unlicensed acts; penalties.

§487-13 Unlicensed acts; penalties.
(a) Any person who furnishes commodities or services for which a license, registration, or certificate is required from the department of commerce and consumer affairs or any board or commission thereunder without having such license, registration, or certificate is engaged in an unlawful act or practice and shall be subject to the penalty provided in subsection (b).
(b) Any person who engages in an unlawful act or practice as provided in subsection (a) shall be fined by a sum not less than $500 nor more than $2,500 for each unlawful act or practice, which sum shall be collected in a civil suit brought by the office of consumer protection or the department of commerce and consumer affairs.
(c) Any contract for the furnishing of commodities or services by an unlicensed, unregistered, or uncertificated person shall be void and shall prevent such person from recovering the contract price or the reasonable value thereof. [L 1974, c 120, §1; am L 1977, c 18, §1; am L 1982, c 204, §4; am L 1988, c 101, §1; am L 2008, c 19, §67]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-15 Injunction.

§487-15
Injunction.
The director of commerce and consumer affairs or the office of consumer protection may bring civil proceedings to enjoin any violation of section 487-13(a) or any other unlawful act or practice affecting consumers, trade, or commerce. [L 1979, c 198, §1; am L 1982, c 204, §5; am L 1989, c 230, §4]
Rules of Court
Injunctions, see HRCP rule 65.
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487. Consumer Protection › 487-16 Appointment of receiver; powers; limitation.

§487-16 Appointment of receiver; powers; limitation.
(a) If the director initiates any action in circuit court under this chapter against a person for allegedly engaging in unfair or deceptive acts or practices in violation of section 480-2, the court may appoint a receiver for the assets of such person upon application by the director and proof submitted at a hearing on the application which is sufficient to establish that:
(1) The person previously engaged in a pattern of unfair or deceptive acts or practices which resulted in substantial actual damages to consumers;
(2) The person is outside the State or is actually removing or about to remove self or property outside the State or is concealing self or property; or
(3) The appointment of a receiver is necessary to preserve the assets of the person for the benefit of consumers allegedly damaged by the person's unfair or deceptive acts or practices.
(b) Subject to the limitation in subsection (c), a receiver appointed by the court pursuant to subsection (a) may sue for, collect, receive, and take into possession all the goods and chattels, rights, credits, moneys, effects, lands, tenements, books, records, documents, papers, choses in action, bills, notes, and property of every description, including property with which such property has been commingled, which is owned by or owing to the defendant. The receiver may sell, convey, or assign the property and hold or dispose of the proceeds thereof subject to the approval of the court.
(c) Prior to the judgment, the receiver shall exercise such powers enumerated in subsection (b) as may be necessary to preserve the assets of the defendant pending the judgment. [L 1983, c 35, §1]
Rules of Court
Receivers, see HRCP rule 66.
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487A. Language of Consumer Transactions › 487A-2 Effect of noncompliance.

§487A-2 Effect of noncompliance.
Failure to comply with any requirement imposed by this chapter shall not render any agreement void or voidable nor shall it constitute a defense to any action to enforce such agreement or any action for breach of such agreement. [L 1980, c 36, pt of §1]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487A. Language of Consumer Transactions › 487A-3 Attorney general or director of the office of consumer protection to enforce chapter.

[ §487A-3] Attorney general or director of the office of consumer protection to enforce chapter.
The attorney general or the director of the office of consumer protection may bring an action in the name of the State against any person to restrain and prevent any violation of this chapter. [L 1980, c 36, pt of §1]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487D. Retail Merchant Club Cards › 487D-1 Definitions.

§487D-1
Definitions.
For purposes of this chapter:
"Cardholder" means any consumer to whom a retail merchant club card is issued, and may include all persons holding the club card under the same account.
"Cardholder information" means the cardholder's name, mailing address, electronic mail address, and any unique membership identifiers assigned by the club card issuer to the cardholder for purposes of targeting marketing activities.
"Club card" means any card or device used for the purpose of obtaining access to purchase retail products through membership, for price discounts, or to receive other no-cost benefits provided by the retail merchant. A "club card" is not a credit card, charge card, or check cashing card.
"Club card issuer" means a retail merchant that provides club cards to consumers, and includes a contract information services provider of the retail merchant.
"Marketing purposes" means the categorization of cardholders based on the cardholder €™s shopping patterns, spending history, or behavioral characteristics derived from account activity that is provided to an unaffiliated third party for consideration.
"Personal information" means information associated with an actual person that is a name, an address, a telephone number, an electronic mail address, a driver's license number, a social security number, an employer, a place of employment, information related to employment, an employee identification number, a mother's maiden name, an identifying number of a depository account, a bank account number, a password used for accessing information, a taxpayer identification number, health insurance identification number, date of birth, a personal identification number (PIN), a government passport number, credit card number, or any other name, number, or code that is used to access personal financial information about the actual person.
"Retail merchant" means any retailer that sells food, products, or merchandise.
"Unaffiliated third party" means a business that is not under the corporate control or common ownership of the club card issuer or is not a contract information services provider of the retail merchant. [L 2004, c 92, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487D. Retail Merchant Club Cards › 487D-2 Retail merchant club cards; requirements.

§487D-2
Retail merchant club cards; requirements
. (a) No club card issuer shall request in a club card application, or require as a condition of obtaining a club card, that the applicant provide any personal information except name, address, and telephone number. If the club card issuer requires a unique identifier to confirm the identity of the applicant, the club card issuer may ask for the last four digits of the applicant's social security number.
(b) No club card issuer may sell or share a cardholder €™s name, address, telephone number, or any personal information to any unaffiliated third party except as permitted in this subsection. A club card issuer may share cardholder information for marketing purposes if the club card issuer complies with all the following:
(1) The club card issuer charges an annual fee for the club card and requires the cardholder to renew the club card annually;
(2) The club card issuer allows only cardholders to make purchases and not members of the general public;
(3) The club card issuer provides a written statement to the cardholder upon payment of the annual fee that notifies the cardholder that:
(A) The cardholder information may be shared with other businesses for purposes of marketing information;
(B) Payment of the annual fee means the cardholder has agreed to allow the club card issuer to share cardholder information; and
(C) The cardholder may choose to opt-out from the sharing of cardholder information; and
(4) The club card issuer obtains a written confidentiality agreement from the unaffiliated third party that the shared information will not be transferred to any other entity.
(c) The restrictions of subsection (a) shall not apply when the club card application form is used for the dual purpose of club card membership and establishing privileges for check cashing, check verification, or as a credit application; provided that no club card issuer shall require as a condition of obtaining a club card that the cardholder obtain the club card as an identification card for purposes of check cashing or credit.
(d) Nothing in this section prohibits a club card issuer from including on its club card application form a credit application to a designated credit card company and transmitting the credit application to the credit card company, provided that:
(1) The credit application form is separately identified as an option on the club card application form; and
(2) The credit application clearly discloses that the cardholder is applying for credit with the designated credit card company. [L 2004, c 92, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487J. Personal Information Protection › 487J-1 Definitions.

§487J-1 Definitions.
As used in this chapter:
"Affiliated" means businesses or persons who have contractual arrangements with, or are subject to the control of, the pharmacy benefit manager.
"Business" means a sole proprietorship, partnership, limited partnership, corporation, limited liability company, association, or any other form of business entity. The term also includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.
"Employee benefit plan" means any plan as defined in title 29 United States Code section 1002(3), as amended.
"Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.
"Health benefits plan" has the same meaning as in section 87A-1.
"Health information" has the same meaning as in 45 Code of Federal Regulations section 160.103, as may be amended.
"Managed care plan" has the same meaning as in section 432E-1.
"Marketing" means making a communication about a product or service that encourages a recipient of the communication to purchase or use the product or service.
"Personal information" has the same meaning as in section 487N-1.
"Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.
"Pharmacy benefit manager" means any person, business, or entity that performs pharmacy benefit management, including but not limited to a person or entity under contract with a pharmacy benefit manager to perform pharmacy benefit management on behalf of a managed care company, nonprofit hospital or medical service organization, insurance company, third-party payor, or health program administered by the State.
"Scan" or "scanning" means to access the machine-readable zone of an individual's Hawaii identification card or driver's license with an electronic device capable of deciphering, in an electronically readable format, information electronically encoded on an individual's Hawaii identification card or driver's license. [L 2006, c 137, pt of §2; am L Sp 2008, c 10, §3; am L 2012, c 191, §2; am L 2013, c 225, §3]
Revision Note
In this section, "pharmacy benefit manager" substituted for "pharmacy benefits manager" and "pharmacy benefit management" substituted for "pharmacy benefits management".
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487J. Personal Information Protection › 487J-3 Penalties; civil action.

§487J-3 Penalties; civil action.
(a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.
(b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.
(c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 137, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487J. Personal Information Protection › 487J-4 Reporting requirements.

§487J-4 Reporting requirements.
A government agency shall submit a written report to the legislature within twenty days after the discovery of a material occurrence of a social security number disclosure by the government agency that is prohibited by this chapter. The report shall contain information relating to the nature of the incident, the number of individuals affected by the incident, and any procedures that have been implemented to prevent the incident from reoccurring. In the event that a law enforcement agency informs the government agency that the report may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that the report will no longer impede the investigation or jeopardize national security. [L 2006, c 137, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487J. Personal Information Protection › 487J-5 Policy and oversight responsibility.

§487J-5 Policy and oversight responsibility.
(a) By
September 1, 2009,
each government agency shall designate an agency employee to have policy and oversight responsibilities for the protection of personal information.
(b) The designated agency employee shall:
(1) Ensure and coordinate agency compliance with this chapter, chapter 487N, and chapter 487R;
(2) Assist individuals who have identity theft and other privacy-related concerns;
(3) Provide education and information to agency staff on privacy and security issues;
(4) Coordinate with state, county, and federal law enforcement agencies on identity theft investigations; and
(5) Recommend policies and practices to protect individual privacy rights relating to the individual's personal information. [L Sp 2008, c 10, §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487J. Personal Information Protection › 487J-7 Pharmacy benefit managers; health information; prohibited marketing practices.

§487J-7 Pharmacy benefit managers; health information; prohibited marketing practices.
(a) A pharmacy benefit manager shall not:
(1) Use an individual's health information, or share an individual's health information with any pharmacy affiliated with or owned, wholly or in part, by the pharmacy benefit manager, for the purpose of marketing, unless:
(A) Use of the individual's health information is medically necessary to the health and safety of the individual;
(B) Use of the individual's health information is consistent with regulations of the federal Centers for Medicare and Medicaid, if the plan is governed by those rules; or
(C) The individual has affirmatively opted in, in writing, to use of the information;
(2) Sell or disseminate such information unless the sale or dissemination complies with all federal and state laws and the pharmacy benefit manager has received written approval for such sale or dissemination from the employee benefit plan, health benefits plan, or managed care plan sponsor, and the individual; or
(3) Directly contact an individual by any means, including via electronic delivery, telephonic, SMS text, or direct mail, for the purposes of marketing pharmacy benefit manager-owned pharmacies without the express written permission of the employee benefit plan, health benefits plan, or managed care plan sponsor, and the individual, unless the employee benefit plan, health benefits plan, or managed care plan sponsor first determines that the contact is medically necessary to the health and safety of the individual.
(b) Nothing in this section shall prohibit the use of a patient's health information that is used in conjunction with an insurer-authorized program to more effectively use prescription drugs to improve the health and safety of the individual.
(c) A pharmacy benefit manager shall provide each individual with an opportunity to affirmatively opt in to the sale or dissemination of their health information prior to entering into any arrangement for the lease, rental, dissemination, or sale of such information to any other entity, or to any subsidiary owned, wholly or in part, by the pharmacy benefit manager; provided that an individual may freely revoke the affirmative opt in at any time. [L 2013, c 225, §2]
Revision Note
In this section, "pharmacy benefit managers" substituted for "pharmacy benefits managers", "pharmacy benefit manager" substituted for "pharmacy benefits manager", and "pharmacy benefit manager-owned pharmacies" substituted for "pharmacy benefits manager-owned pharmacies".
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487N. Security Breach of Personal Information › 487N-1 Definitions

§487N-1 Definitions
. As used in this chapter, unless the context otherwise requires:
"Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized, and whether or not organized to operate at a profit. The term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.
"Council" means the information privacy and security council established under section 487N-5.
"Encryption" or "encrypted" means the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.
"Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.
"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(1) Social security number;
(2) Driver's license number or Hawaii identification card number; or
(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account.
"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
"Records" means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.
"Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.
"Security breach" means an incident of unauthorized access to and acquisition of unencrypted or unredacted records or data containing personal information where illegal use of the personal information has occurred, or is reasonably likely to occur and that creates a risk of harm to a person. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key constitutes a security breach. Good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose is not a security breach; provided that the personal information is not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure. [L 2006, c 135, pt of §2; am L 2008, c 19, §69; am L Sp 2008, c 10, §5]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487N. Security Breach of Personal Information › 487N-3 Penalties; civil action.

§487N-3 Penalties; civil action.
(a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.
(b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.
(c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 135, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487N. Security Breach of Personal Information › 487N-4 Reporting requirements.

§487N-4 Reporting requirements.
A government agency shall submit a written report to the legislature within twenty days after discovery of a security breach at the government agency that details information relating to the nature of the breach, the number of individuals affected by the breach, a copy of the notice of security breach that was issued, the number of individuals to whom the notice was sent, whether the notice was delayed due to law enforcement considerations, and any procedures that have been implemented to prevent the breach from reoccurring. In the event that a law enforcement agency informs the government agency that notification may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that notice will no longer impede the investigation or jeopardize national security. [L 2006, c 135, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487N. Security Breach of Personal Information › 487N-6 Personal information security; best practices; websites.

§487N-6 Personal information security; best practices; websites.
(a) The council shall identify best practices to assist government agencies in improving security and privacy programs relating to personal information. No later than March 31, 2009, the council shall identify best practices relating to:
(1) Automated tools;
(2) Training;
(3) Processes; and
(4) Applicable standards.
(b) No later than July 31, 2009, the best practices identified by the council shall be posted on each government agency's website in a manner that is readily accessible by employees of the government agency. [L Sp 2008, c 10, pt of §4]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487N. Security Breach of Personal Information › 487N-7 Personal information system; government agencies; annual report.

§487N-7 Personal information system; government agencies; annual report.
(a) Effective January 1, 2009, any government agency that maintains one or more personal information systems shall submit to the council an annual report on the existence and character of each personal information system added or eliminated since the agency's previous annual report. The annual report shall be submitted no later than September 30 of each year.
(b) The annual report shall include:
(1) The name or descriptive title of the personal information system and its location;
(2) The nature and purpose of the personal information system and the statutory or administrative authority for its establishment;
(3) The categories of individuals on whom personal information is maintained, including:
(A) The approximate number of all individuals on whom personal information is maintained; and
(B) The categories of personal information generally maintained in the system, including identification of records that are:
(i) Stored in computer accessible records; or
(ii) Maintained manually;
(4) All confidentiality requirements relating to:
(A) Personal information systems or parts thereof that are confidential pursuant to statute, rule, or contractual obligation; and
(B) Personal information systems maintained on an unrestricted basis;
(5) Detailed justification of the need for statutory or regulatory authority to maintain any personal information system or part thereof on a confidential basis for all personal information systems or parts thereof that are required by law or rule;
(6) The categories of sources of personal information;
(7) The agency's policies and practices regarding personal information storage, duration of retention of information, and elimination of information from the system;
(8) The uses made by the agency of personal information contained in any personal information system;
(9) The identity of agency personnel, by job classification,
and other agencies, persons, or categories to whom disclosures of personal information are made or to whom access to the personal information system may be granted, including the purposes of access and any restrictions on disclosure, access, and redisclosure;
(10) A list identifying all forms used by the agency in the collection of personal information; and
(11) The name, title, business address, and telephone number of the individual immediately responsible for complying with this section.
(c) For purposes of this section:
"Personal information system" means any manual or automated recordkeeping process that contains personal information and the name, personal number, or other identifying particulars of a data subject.
(d) Notwithstanding any other law to the contrary, this report shall be confidential and not disclosed publicly in any form or forum. [L Sp 2008, c 10, pt of §4]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487R. Destruction of Personal Information Records › 487R-1 Definitions.

§487R-1 Definitions.
As used in this chapter:
"Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. Except as provided in section 487R-2(e), the term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.
"Disposal"
means the discarding or abandonment of records containing personal information or the sale, donation, discarding, or transfer of any medium, including computer equipment or computer media, containing records of personal information, or other nonpaper media upon which records of personal information are stored, or other equipment for nonpaper storage of information.
"Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or any county.
"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(1) Social security number;
(2) Driver's license number or Hawaii identification card number; or
(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account.
"Personal information" shall not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. "Encrypted", as used in this definition means the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.
"Records" means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics. [L 2006, c 136, pt of §2; am L 2008, c 19, §71]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487R. Destruction of Personal Information Records › 487R-3 Penalties; civil action.

§487R-3 Penalties; civil action.
(a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.
(b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.
(c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 136, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 487R. Destruction of Personal Information Records › 487R-4 Reporting requirements.

§487R-4 Reporting requirements.
A government agency shall submit a written report to the legislature within twenty days after the discovery of a material occurrence of unauthorized access to personal information records in connection with or after its disposal by or on behalf of the government agency. The report shall contain information relating to the nature of the incident, the number of individuals affected by the incident, and any procedures that have been implemented to prevent the incident from reoccurring. In the event that a law enforcement agency informs the government agency that the report may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that the report will no longer impede the investigation or jeopardize national security. [L 2006, c 136, pt of §2]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-1 Definitions.

§488-1 Definitions.
As used in this chapter:
"Accumulation or payment of money" or "accumulates funds" means the payment of funds by a member to the plan.
"Commissioner" means the insurance commissioner of the department of commerce and consumer affairs.
"Legal service plan" or "plan" means any arrangement by which a person as defined in section 431:1-212, or entity, not otherwise authorized to engage in the practice of law, offers to provide or arranges for the provision of legal services in exchange for any valuable consideration that is paid to the plan.
"Plan administrator" means those persons who have discretionary authority for the management of the plan or for the collection, management, or disbursement of plan moneys. [L 1976, c 156, pt of §1; am L 1982, c 204, §8; am L 1992, c 19, §1; am L 2008, c 19, §73; am L 2010, c 47, §1(1); am L 2011, c 186, §3]
Revision Note
Definitions rearranged.
Attorney General Opinions
Prepaid legal service plan whose membership is open to the public is a "group legal service plan". Att. Gen. Op. 86-22.
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-2 Applicability; other statutes, rules of court.

§488-2 Applicability; other statutes, rules of court.
(a) This chapter shall apply to all plans in the State other than:
(1) Plans in which any party to the plan is the federal government or any agency thereof; or
(2) Any employer-employee plan that is subject to the federal Employee Retirement Income Security Act of 1974, Public Law 93-406.
Plans that are owned and operated by an insurer subject to chapter 431 shall be exempt from the requirements of this chapter; provided that the insurer shall comply with the provisions of chapter 431 and file a statement certifying compliance with chapter 431.
(b) The commissioner shall have jurisdiction to enforce this chapter. The operation of all plans subject to this chapter shall also be subject to chapters 480, part I of chapter 481, 481A, and 481B, 481C, and other provisions of law that may be applicable. Chapters 431 and 432 shall not apply to any plans or the operations thereof that are subject to this chapter, except as provided in sections 488-4, 488-5, 488-6, and 488-7.
(c) No plan subject to this chapter shall contravene rules of court adopted by the Hawaii supreme court. [L 1976, c 156, pt of §1; am L 2008, c 19, §74; am L 2010, c 47, §1(2); am L 2011, c 186, §4]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-4 Accumulated funds, protection, violation.

§488-4 Accumulated funds, protection, violation.
(a) The plan administrator shall have the responsibilities of a trustee for all funds received, accumulated, or collected under this chapter.
(b) The plan administrator, upon receipt of funds intended for payment to a person providing legal services pursuant to this chapter, shall maintain the funds at all times in a federally insured account with a bank, savings and loan association, or financial services loan company located in Hawaii, separate from the plan's own funds or funds held by the plan administrator in any other capacity, in an amount at least equal to the funds collected and unpaid to the persons providing legal services, unless otherwise approved by the commissioner. Only additional funds that are reasonably necessary to pay bank, savings and loan association, or financial services loan company charges may be commingled with the funds accumulated pursuant to this section. If the bank, savings and loan association, or financial services loan company account is an interest earning account, the plan shall not retain the interest earned on accumulated funds for the plan or plan administrator's own use or benefit without the prior written consent of the person entitled to the funds. A plan trustee account shall be designated on the records of the bank, savings and loan association, or financial services loan company as a "trustee account established pursuant to section 488-4, Hawaii Revised Statutes", or words of similar import.
(c) The plan administrator shall obtain a $100,000 bond, which shall be executed by the plan administrator and a surety company authorized to do business in the State as a surety.
The bond shall run to the State for the benefit of any claimants against the plan to secure the faithful performance of the obligations of the plan. The aggregate liability of the surety shall not exceed the principal sum of the bond. The plan administrator shall provide the commissioner with proof of the bond at the time of the initial request for approval and at any time thereafter as requested by the commissioner. The plan shall not release the bond without the commissioner's approval. In lieu of the bond required by this section, the commissioner may accept letters of credit, certificates of deposits, or other evidence of security in form and amounts deemed appropriate by the commissioner.
(d) Any person, including a plan administrator, owner, operator, officer, employee, or representative who, not being lawfully entitled to do so, diverts or appropriates funds accumulated pursuant to this section or any portion of accumulated funds for the person's own use, shall be subject to penalties as provided by law. [L 1976, c 156, pt of §1; am L 1992, c 78, §2; am L 2010, c 47, §1(4); am L 2011, c 186, §6]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-5 Annual exhibits; examination by commissioner.

§488-5 Annual exhibits; examination by commissioner.
(a) Each plan shall file with the commissioner within sixty days after the end of its fiscal year an income statement and balance sheet compiled, reviewed, or audited by a certified public accountant.
(b) The powers, authorities, and duties relating to examinations vested in and imposed upon the commissioner under chapter 431 apply with respect to examinations of plans subject to this section; provided that no examination shall attempt to obtain or inspect written or oral information or documents in violation of the rules for client-lawyer confidentiality as contained in the Hawaii rules of professional conduct adopted by the supreme court. [L 1976, c 156, pt of §1; am L 1982, c 204, §8; am L 1983, c 124, §17; am L 2008, c 19, §75; am L 2010, c 47, §1(5)]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-6 Investments of certain plans.

§488-6 Investments of certain plans.
No plan promising or offering to pay for legal services in an amount equal to or in excess of $25 a year shall invest any of its assets other than as authorized and provided for in respect to domestic insurance companies and societies under chapters 431 and 432, which provisions are hereby extended to and made applicable to prepaid legal service plans. [L 1976, c 156, pt of §1; am L 2008, c 19, §76]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-7 Failure to comply; penalty.

§488-7 Failure to comply; penalty.
(a) Any plan that does not comply with this chapter shall be notified in writing by the commissioner of the noncompliance and of the need to take corrective action within seven days. If the noncompliance continues for seven days after notification, the plan or plan administrator may be fined not more than $1,000 per day for each day of noncompliance.
(b) In addition to penalties provided in subsection (a), the commissioner may deny, suspend, revoke, or refuse to approve the certificate of authority of any plan or any plan amendments.
(c) If the commissioner takes any action pursuant to subsection (b), the commissioner shall notify the applicant or licensee in writing of the reason for that action. The applicant or licensee may submit a written request within ten days of the date of receipt of the notice for a hearing before the commissioner to determine the propriety of the commissioner's action. A hearing pursuant to this subsection shall be held within thirty days of receipt of the written request, unless postponed by mutual consent, and shall be conducted pursuant to chapter 91.
(d) If the commissioner has cause to believe that any plan is violating or is about to violate any provision of this chapter or any order of the commissioner, the commissioner may issue a cease and desist order to enforce compliance with this chapter or any order of the commissioner, or may bring an action in any court of competent jurisdiction to enjoin the plan from continuing the violation. The commissioner may order or petition the court to order restitution on behalf of persons aggrieved by a violation of this chapter and an assessment of a monetary penalty against any plan, plan administrator, or owner, operator, or officer of the plan for violation of this chapter or an order of the commissioner. [L 1976, c 156, pt of §1; am L 1982, c 204, §8; am L 1983, c 124, §17; am L 2010, c 47, §1(6); am L 2011, c 186, §7]
2023 Hawaii Revised Statutes › Title 26. Trade Regulation and Practice › 488. Legal Service Plans › 488-8 Access to records.

§488-8 Access to records.
(a) Every plan and its owners, operators, officers, employees, and representatives shall:
(1) Be subject to investigation or examination by the commissioner;
(2) Produce and make freely accessible to the commissioner all accounts, records, documents, and files in the person's possession or control relating to the subject of the investigation or examination; and
(3) Cooperate with any investigation or examination by the commissioner.
(b) If the commissioner finds the accounts or records of a plan, or of its owners, operators, officers, employees, or representatives, to be inadequate, improperly kept, or improperly posted, and if the plan has failed to correct the accounts or records after the commissioner has given the plan written notice and a reasonable opportunity to do so, the commissioner may employ experts to rewrite, post, or balance the accounts at the expense of the plan being examined.
(c) A plan administrator shall provide a written response within seven days to any written inquiry made by the commissioner. The response shall be more than an acknowledgment that the commissioner's communication was received and shall adequately address the concerns stated in the communication. [L 2011, c 186, pt of §1]