Hawaii Privacy Enforcement Cases

Why the action was brought

Marriott’s Starwood reservation database was breached from July 2014 through September 2018, exposing 131.5 million U.S. guest records, including contact, birth-date, reservation, preference, limited unencrypted passport, and unexpired payment-card information. The attorneys general alleged Marriott failed to implement reasonable data-security measures and remediate deficiencies while using and integrating Starwood, violating state laws and risking consumer harm.

Why the action was brought

Blackbaud’s deficient data security and failure to remediate known security gaps allowed unauthorized access during a 2020 ransomware event, exposing contact and demographic information, Social Security numbers, driver’s license numbers, financial and health information affecting more than 13,000 customers. Blackbaud then delayed, incomplete, or failed breach notifications and downplayed the incident.

Why the action was brought

Google’s Location History and Web & App Activity settings collected location information. Since at least 2014, the states found Google misled consumers about the scope of Location History, the existence of Web & App Activity and its location collection, and how users could limit tracking through account and device settings, creating confusion and potentially exposing sensitive personal information.