Hawaii’s State Data Office recently issued a series of guidance documents for its state agencies on how to handle artificial intelligence. This includes guidance on data protection, data retention and use of Generative AI.

For data protection, the agencies are requires to abide by principles of:

• Data minimization
• Acting with legal authorization
• Allowing individuals to opt out of certain data collection
• Transparency: Providing clear notice
• Consumer rights of access, rectification and deletion
• Segregation and access control
• Appropriate information security safeguards
• De-identification and pseudonymization wherever possible

For data retention, the guidance provides for each type of data, including what information security level is required and how the data should be disposed.

For GenAI tools, the guidance gives general parameters as well as Dos and Don’ts for specific types of AI products.