Hawaii SB-2290 is a state data privacy law which protects personally identifiable information.

Hawaii SB-2290 was signed into law May 25, 2006 and became effective January 1, 2007. The law applies to any sole proprietorship, partnership, corporation, association, or other group, however organized, and whether or not organized to operate at a profit, including financial institutions organized, chartered, or holding a license or authorization certificate under the laws of Hawaii, any other state, the US, or any other country, or the parent or the subsidiary of any such financial institution, and any entity whose business is records destruction, or any government agency that collects personally identifiable information for specific government purposes

The policy looks for at least one match to personally identifiable information, which may include:

Credit Card Number

Credit Card Track Data

US Drivers License Number

US Social Security Number