Hawaii Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Hawaii has no dedicated biometric privacy law, and its current data breach notification statute, HRS Chapter 487N, does not include biometric data such as fingerprints, voice prints, or iris images in its definition of protected personal information. A 2026 bill, SB 3016, would have added biometric data to that definition, but it died in committee and never became law. No consent requirement exists for collecting biometric data, and residents have no private right of action for unauthorized collection.

Hawaii does not have a standalone biometric privacy law like the Illinois Biometric Information Privacy Act (BIPA) or the Texas Capture or Use of Biometric Identifier Act. Instead, the state protects biometric information through its data breach notification statute, its constitutional right to privacy, and its consumer protection framework.

If you collect fingerprints, facial scans, or other biometric identifiers from Hawaii residents, you need to understand how these overlapping protections apply to your organization. This guide breaks down every relevant Hawaii law, recent legislative changes, and what businesses and individuals should expect going forward.

For the full picture of Hawaii's broader privacy framework, see our parent guide on Hawaii Data Privacy Laws.

How HRS Chapter 487N Treats Biometric Data

Hawaii's closest thing to a biometric protection is the Security Breach of Personal Information Act (HRS Chapter 487N), but its current definition of personal information does not include biometric data. It does not regulate how businesses collect or use biometric data, and it does not currently require notification when biometric data alone is compromised in a security breach.

What Biometric Data Is Covered

Under HRS 487N-1, Hawaii's current definition of "personal information" covers only an individual's name combined with a Social Security number, driver's license or state ID number, or financial account number with an access code or password. It does not include biometric data, and the statute does not currently define a "specified data element" category at all.

A 2026 bill, SB 3016, would have added biometric data, including fingerprints, voice prints, retina or iris images, and other physical or digital biometric identifiers, as a new "specified data element" category. That bill died in committee and never became law, so businesses whose only compromised data is biometric, without an accompanying Social Security number, driver's license number, or financial account number, are not currently required to notify Hawaii residents under HRS Chapter 487N.

When Breach Notification Is Required

A business must notify affected Hawaii residents when there has been unauthorized access to and acquisition of unencrypted records containing personal information, and that access creates a risk of harm. Under the current statute, "personal information" means an individual's name combined with a Social Security number, driver's license or state ID number, or financial account number with an access code or password; biometric data alone is not included.

Notification must happen "without unreasonable delay." Hawaii does not set a specific day count, unlike states such as Florida (30 days) or Texas (60 days). This flexibility standard means businesses should act promptly once they understand the scope of the breach.

Who Must Comply

Three categories of entities fall under the law:

• Any business that owns or licenses personal information of Hawaii residents
• Any business conducting business in Hawaii that owns or licenses personal information in any form
• Any government agency that collects personal information

There is no minimum company size or revenue threshold. A small employer with a single Hawaii-based employee whose Social Security number, driver's license number, or financial account data is breached must comply, though a breach of fingerprint data alone would not currently trigger this obligation.

Hawaii's Constitutional Privacy Protections

Hawaii offers something most states do not: an explicit constitutional right to privacy that can strengthen biometric privacy claims.

Article I, Section 6

Article I, Section 6 of the Hawaii State Constitution states:

"The right of the people to privacy is recognized and shall not be infringed without the showing of a compelling state interest. The legislature shall take affirmative steps to implement this right."

Added by voters in 1978, this provision applies the highest standard of judicial review (compelling state interest) to government intrusions on privacy. It also places an affirmative duty on the legislature to pass laws protecting privacy.

How This Affects Biometric Data

The constitutional right to privacy primarily restricts government action. A state agency that collects employee fingerprints or uses facial recognition technology in public spaces must demonstrate a compelling interest to justify that collection.

For private businesses, the constitutional provision has indirect effects. Courts may interpret statutes more broadly in favor of privacy protections, and the legislature's constitutional duty to protect privacy drives ongoing efforts to pass stronger biometric data laws.

Article I, Section 7

Section 7 provides additional protection by prohibiting unreasonable "invasions of privacy," going beyond the federal Fourth Amendment. This provision gives Hawaii courts an independent constitutional basis for challenging biometric surveillance or data collection by government agencies.

SB 3016: Failed Attempt to Add Biometric Data to the Breach Law (2026)

The Hawaii Legislature considered SB 3016 in 2026, which would have strengthened biometric data protections within the breach notification framework. The bill passed the Senate 25-0, but it stalled in the House Judiciary and Hawaiian Affairs Committee and died when the legislature adjourned sine die on May 8, 2026, without being enacted.

What SB 3016 Would Have Changed

Had it passed, SB 3016 would have updated the definition of "personal information" under HRS Chapter 487N and formally codified "specified data element" as a category, with biometric data listed explicitly among the nine specified data elements set out in the House-amended version (SB 3016, HD 1). None of this took effect:

• Social Security numbers (in their entirety or the last four or more digits)
• Driver's license, federal or state identification card, or passport numbers
• Federal individual taxpayer identification numbers
• Military identification numbers
• Financial account numbers, or credit or debit card numbers, unless redacted
• Security codes, access codes, PINs, or passwords that would allow access to an individual's account
• Biometric data (fingerprints, voice prints, retina or iris images)
• Private keys unique to an individual and used to authenticate or sign an electronic record
• Health insurance policy, subscriber, or medical identification numbers

The bill would also have introduced a new "identifier" definition that broadens what counts as identifying information, including names, usernames, phone numbers, and email addresses. None of this is in effect because the bill died in committee.

Current Status: Bill Died

SB 3016 did not pass. It stalled in the House Judiciary and Hawaiian Affairs Committee and died when the Hawaii Legislature adjourned sine die on May 8, 2026. HRS Chapter 487N remains unchanged, and businesses have no expanded biometric notification obligations under this bill.

Failed Biometric Privacy Legislation: SB 1085

Hawaii lawmakers have attempted to pass a dedicated biometric privacy statute. SB 1085, modeled after Illinois BIPA, was introduced in the 2023 legislative session. The bill would have required:

• Written consent before collecting biometric identifiers
• Published retention and destruction policies
• A prohibition on selling or profiting from biometric data
• A three-year maximum retention period after an individual's last interaction with the collecting entity
• A private right of action allowing individuals to sue for violations

The Senate Committee on Labor and Technology deferred SB 1085 in February 2023, and the bill did not advance. It was carried over to the 2024 session under Hawaii's biennium procedure but died at the end of the biennium without a hearing.

This means Hawaii still lacks the general consent, purpose limitation, and private right of action provisions found in states like Illinois and Washington. Without SB 1085 or similar legislation, businesses in Hawaii are not required to obtain consent before collecting biometric data from residents.

One narrow exception is worth naming. HRS 302A-499 and HRS 302A-500, enacted as Act 40 in 2016, expressly include biometric information within the "covered information" handled by operators of websites, online services, and applications designed and marketed primarily for Hawaii K-12 school purposes. Those operators may not sell or rent a student's covered information, use it for targeted advertising, or use it to amass a student profile outside K-12 school purposes, and they must maintain reasonable security practices and delete covered information when a school requests it. This is a purpose-limitation rule aimed at student ed-tech vendors, not a consent regime, and it does not reach an employer or a general business collecting biometric data from Hawaii residents.

Consumer Protection as a Biometric Safeguard

Hawaii's Unfair and Deceptive Acts or Practices (UDAP) law (HRS Section 480-2) provides a secondary layer of protection for biometric data. If a business makes promises in its privacy policy about how it handles biometric information and then breaks those promises, it could face enforcement action under this statute.

The Office of Consumer Protection and the Attorney General can bring actions under Hawaii's unfair-practices statutes. HRS 480-3.1 sets the civil penalty for violating HRS Section 480-2 at not less than $500 and not more than $10,000 for each violation, a range well above the $2,500 per violation ceiling under the breach notification law. That penalty is a government remedy: the statute directs that the sum be collected in a civil action brought by the attorney general or the director of the office of consumer protection on behalf of the State, so a private plaintiff cannot recover it.

An injured consumer has a separate private remedy under HRS 480-13(b): the greater of $1,000 or threefold the damages sustained, plus reasonable attorney's fees and costs. Where the plaintiff is an elder, the court may instead award the greater of $5,000 or threefold damages.

This matters for employers and businesses that publish privacy policies covering biometric data. If your policy states you will not share fingerprint data with third parties, violating that promise could trigger UDAP liability.

Employer Use of Biometric Data in Hawaii

Hawaii does not have a law specifically governing employer use of biometric data for time tracking, building access, or identity verification. No state statute requires employers to obtain consent before scanning an employee's fingerprint for a biometric time clock.

However, employers should consider these factors:

Breach notification obligations. Current HRS Chapter 487N does not require notification for a breach of fingerprint or facial scan data alone. That obligation only applies if the breach also involves a Social Security number, driver's license number, or financial account number; a 2026 bill that would have added biometric data on its own died in committee.

Constitutional privacy (government employers). State and county government employers in Hawaii must consider Article I, Sections 6 and 7 before implementing biometric collection programs. A government agency that requires employee fingerprint scans may need to demonstrate a compelling interest.

UDAP exposure. Employers that describe biometric data handling practices in employee handbooks or privacy notices create enforceable expectations. Failing to follow through could constitute a deceptive practice.

Federal considerations. Employers subject to federal regulations, such as those in financial services or healthcare, may have additional obligations under HIPAA, GLBA, or other federal frameworks.

Penalties and Enforcement

Breach Notification Violations

Under HRS 487N-3, any business that violates the breach notification requirements faces penalties of not more than $2,500 for each violation. The Attorney General or the executive director of the Office of Consumer Protection may bring the action, and no such action may be brought against a government agency.

Because biometric data is not part of the statutory definition of personal information, a breach of biometric data alone creates no notification duty and therefore no exposure to this penalty. The penalty reaches breaches involving a name plus a Social Security number, driver's license or Hawaii identification card number, or financial account number.

Individual Hawaii residents who are adversely affected by a breach may also bring a civil action seeking actual damages and attorney fees.

UDAP Violations

Under HRS 480-3.1, a violation of HRS Section 480-2 carries a civil penalty of $500 to $10,000 per violation. That sum is collected only in a civil action brought by the Attorney General or the director of the Office of Consumer Protection on behalf of the State; it is not a figure a private plaintiff can recover.

A consumer injured by an unfair or deceptive practice sues under HRS 480-13(b) instead, recovering the greater of $1,000 or threefold damages, plus reasonable attorney's fees and costs, with a $5,000 alternative minimum available where the plaintiff is an elder.

No Private Right of Action for Biometric Collection

Because Hawaii does not have a dedicated biometric privacy statute, there is no private right of action for unauthorized biometric data collection itself. Residents cannot sue a business simply for collecting their fingerprints without consent, as they can in Illinois. Legal recourse is limited to breach notification failures and deceptive practices claims.

What to Watch: Future Biometric Legislation

Hawaii's legislative trend suggests stronger biometric protections are coming. Key developments to monitor:

A revived SB 3016. The 2026 bill died in committee, but similar legislation could be reintroduced in a future session to add biometric data to the breach notification law.

Dedicated biometric privacy bills. The repeated introduction of SB 1085 signals ongoing legislative interest in an Illinois-style biometric consent law. Future sessions may see a version that advances further.

Comprehensive privacy law. Hawaii has introduced consumer data protection acts in 2024 and 2025 sessions. If a comprehensive privacy law passes, it would likely include biometric data provisions alongside broader consumer rights.

Geolocation and surveillance data. SB 1163 (2026), which restricts the sale of geolocation and browser data, signals expanding legislative attention to all forms of personal data, including biometrics.

This article is for informational purposes only and does not constitute legal advice. Biometric privacy laws change frequently, and enforcement interpretations evolve over time. Consult a licensed attorney in Hawaii for advice about your specific situation. Last reviewed: March 2026.

More Hawaii Laws

• Hawaii Deepfake Laws
• Hawaii Employee Monitoring Laws
• Hawaii GPS Tracking Laws
• Hawaii Recording Laws

Frequently Asked Questions

Does Hawaii require consent before collecting biometric data?

No. Hawaii does not currently have a law requiring businesses to obtain consent before collecting fingerprints, facial scans, or other biometric identifiers. Hawaii's breach notification law (HRS Chapter 487N) does not currently include biometric data in its definition of personal information, so it offers no biometric-specific protection; Hawaii's unfair-practices law (HRS Section 480-2) may apply only if a business breaks its own stated privacy promises. A dedicated consent law (SB 1085) was proposed in 2023 and 2024 but did not pass, and a 2026 bill to add biometric data to the breach law (SB 3016) also died in committee.

What happens if my fingerprint data is exposed in a data breach in Hawaii?

Under current Hawaii law, a breach of fingerprint data alone does not trigger notification under HRS Chapter 487N, because biometric data is not part of the statute's definition of personal information. Notification is required only if the breach also involves your name combined with a Social Security number, driver's license number, or financial account number. A 2026 bill, SB 3016, would have added biometric data to that definition, but it died in committee and never took effect.

Can my employer require me to use a fingerprint scanner for time tracking in Hawaii?

Yes. Hawaii has no law prohibiting employers from requiring biometric time clocks or mandating employee fingerprint scans. Current HRS Chapter 487N would not require notification if only that fingerprint data were breached, because biometric data is not part of the statute's definition of personal information. Government employers face additional constraints under Hawaii's constitutional right to privacy.

How does Hawaii compare to Illinois for biometric privacy protections?

Hawaii's protections are significantly weaker than Illinois. The Illinois Biometric Information Privacy Act requires written consent before collection, mandates published retention policies, and provides a private right of action with statutory damages of $1,000 to $5,000 per violation. Hawaii has no general biometric consent or collection statute, and its breach notification law does not currently cover biometric data either. The one Hawaii statute that reaches private-sector handling of biometric information is narrow: HRS 302A-499 and 302A-500 include biometric information within the 'covered information' that K-12 ed-tech operators may not sell, rent, or use for targeted advertising. Hawaii has no private right of action for unauthorized biometric data collection.

Does Hawaii's SB 3016 (2026) create new biometric consent requirements?

No. SB 3016 would have expanded the definition of personal information under Hawaii's breach notification law to explicitly include biometric data as a 'specified data element,' but the bill died in committee in 2026 and never became law. Even if it had passed, it would not have required consent for biometric data collection, established retention limits, or created a private right of action for unauthorized collection.