Office of Information Practices

The Office of Information Practices’ 2025 Annual Report has been posted.  Last year’s highlights include the following accomplishments:

• OIP resolved 96% of the 1,922 formal and informal cases filed in FY 2025 within the same year.
• Of the 1,695 informal cases constituting 88% of all new cases in FY 2025, OIP typically resolved them within 24 hours.
• OIP resolved over 66% (151 of 227) of all new formal cases filed in FY 2025 in the same year.
• OIP issued 35 opinions.
• OIP revised or added to its online Training page a total of 10 training materials or forms.

 

Additionally, OIP has updated its Court Opinions List, detailing relevant appellate opinions of interest relating to the UIPA and the Sunshine Law.  It can be found on the Opinions page at oip.hawaii.gov.

 

OIP also provides this summary of a recent appellate court decision involving the Uniform Information Practices Act (Modified), chapter 92F, Hawaii Revised Statutes (UIPA).  In August of 2021, an employee of the Department of Public Safety (DPS) (DPS has since been redesignated as the Department of Corrections and Rehabilitation) sent an email to approximately 260 PSD employees regarding compliance with the Governor’s COVID-19 Emergency Proclamation issued on August 5, 2021, which included, among other things, a requirement that state and county employees attest to whether they were vaccinated or unvaccinated.  Because the employee sent the email as a “cc,” the email addresses of all employees the email was sent to were visible to all recipients of the email.  Thereafter, the Hawaii Government Employees’ Association and United Public Workers (collectively, Plaintiffs) filed a complaint against DPS which alleged (1) invasion of privacy because the email implied that DPS believed the recipients were unvaccinated and DPS thereby disclosed employees’ vaccination status, and (2) negligence and negligent supervision.

DPS moved to dismiss the complaint, arguing that Plaintiffs did not have standing and that  Plaintiffs’ complaint failed to adequately plead the claims.  DPS also argued that the email did not include the employees’ vaccination status and that it was sent to both employees who were unvaccinated and employees who were vaccinated but had not yet submitted their vaccination card or an attestation that they were vaccinated.  The Circuit Court determined that, based on the Hawai`i Supreme Court’s decision in State of Hawaii Org. of Police Officers v. City & Cnty. of Honolulu, 149 Haw. 492, 494 P.3d 1225 (2021) (SHOPO), the UIPA does not prohibit disclosure of information and that Plaintiffs could not sue under the UIPA for the disclosure.  Therefore, the Circuit Court found that Plaintiffs lacked standing, and granted the motion to dismiss.  Plaintiffs appealed to the Intermediate Court of Appeals.

In SHOPO, the Supreme Court had found that “there is no private cause of action to prevent, as opposed to compel, the release of records under UIPA” and the UIPA did “not require disclosure” if an exception applied but did not prohibit it either.  The ICA’s opinion dated August 28, 2025 (see Hawaii Government Employees’ Ass’n. v. Department of Public Safety, CAAP-22-0000506 (Haw. App. Aug. 18, 2025), concluded that the UIPA does not provide an express or implied private cause of action for disclosure of private information and the Circuit Court did not err in ruling that Plaintiffs could not bring suit under the UIPA for DPS’ alleged disclosure of their members’ vaccination status.  The ICA also found that the complaint stated a claim for invasion of privacy as a tort, and that viewing the allegations in the Plaintiffs’ complaint in the light most favorable to the Plaintiffs, it was not beyond doubt that Plaintiffs could not prove a set of facts that would support such a claim.  Therefore, the ICA concluded that the Circuit Court erred in dismissing the complaint’s privacy claim, and that, because the complaint stated a tort claim that could have been brought by the Plaintiffs’ individual members, the Plaintiffs had associational standing to file suit on behalf of their members.

The ICA also concluded that the Circuit Court did not err in dismissing the Plaintiffs’ claims of negligence and negligent supervision.  A claim of negligent supervision requires that an employee act outside the scope of their employment, and the ICA found that Plaintiffs did not allege that the DPS employee was acting outside the scope of her employment.  A negligence claim requires the existence of a legal duty or obligation, and the ICA found that while Plaintiffs argued that the UIPA and the Governor’s Emergency Proclamation created a legal duty to not disclose employees’ personal information, neither the UIPA nor the Governor’s Emergency Proclamation created such a duty.