HRS §487R-4
Government agencies must report data breaches to the legislature
When a government agency finds out that someone got into personal information records without permission, especially during or after disposal, it must tell the legislature in writing within 20 days. The report must say what happened, how many people were affected, and what steps are being taken to stop it from happening again. If police say the report would hurt an investigation or national security, the agency can wait until 20 days after police say it's okay.
The statute, as written — Reporting requirements
A government agency shall submit a written report to the legislature within twenty days after the discovery of a material occurrence of unauthorized access to personal information records in connection with or after its disposal by or on behalf of the government agency. The report shall contain information relating to the nature of the incident, the number of individuals affected by the incident, and any procedures that have been implemented to prevent the incident from reoccurring. In the event that a law enforcement agency informs the government agency that the report may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that the report will no longer impede the investigation or jeopardize national security.
LawTrove is not legal advice. The summary above is a computer-generated restatement — the authoritative text is the official version linked above.