California Consumer Privacy Rights Notice

Last updated: April 19, 2021

1.    OVERVIEW
This California Consumer Privacy Rights Notice (“Notice”) applies to First Hawaiian Bank (“First Hawaiian Bank,” “we,” “us,” or “ours”) and is effective as of the date last updated above.  This Notice describes the rights California residents have with respect to our collection, use, and disclosure of personal information covered by the California Consumer Privacy Act (CCPA). All defined terms within the CCPA, including those defined in Cal. Civ. Code § 1798.140, apply for the purposes of interpreting this Notice. Terms that are capitalized but not defined in this Notice have the meanings assigned in our Privacy Policy.

Under the CCPA, “Personal Information” is information that identifies, relates to, or could reasonably be linked directly or indirectly with a particular California resident.  However, the CCPA exempts certain categories of information, including information subject to the Gramm-Leach-Bliley Act (“GLBA”). This Notice does not apply to information that we collect about California residents who apply for or obtain our financial products and services for personal, family or household purposes.  For more information about how we collect, disclose, and secure information relating to these customers, please refer to our Privacy Policy.

2.    COLLECTION AND DISCLOSURE OF PERSONAL INFORMATION
In the past 12 months, we collected, and disclosed to third parties for our business purposes, the following categories of Personal Information relating to California residents covered by this Notice:

• Identifiers, such as name, address, unique personal identifier, online identifier, internet protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, and other similar identifiers
• Personal information described in Cal. Civ. Code 1798.80, such as telephone number, insurance policy number, bank account number, credit card number, debit card number, or other financial information, medical information, or health insurance information
• Characteristics of protected classifications under California or federal law, such as age, sex, national origin, citizenship and marital status
• Commercial information, such as records of personal property, products or services purchased, and transaction histories
• Internet or network activity information, such as browsing history and interactions with our websites, applications, or advertisements
• Geolocation data, such as device location and IP location
• Audio, electronic, visual, and similar information, such as call and video recordings
• Professional or employment-related information, such as work history and prior employer
• Education information that is not publicly available
• Inferences drawn from an of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics

The categories of sources from whom we collected Personal Information are:

• California consumers and individuals acting on their behalf, including their interactions with our website, mobile application, and social media
• Our service providers and marketing partners
• Third parties from whom consumers authorize us to collect information 
• Credit bureaus
• Public records and other widely available sources

The categories of third parties to whom we disclosed Personal Information for our business purposes described in this Notice are: 

• Service providers, such as software providers, marketing companies, fraud prevention services, and payment processors
• Marketing partners with whom we share joint marketing and co-brand relationships
• Accountants, auditors, lawyers and other outside provisional advisors  
• Data aggregation services (at the direction of consumers)
• Credit bureaus
• Government agencies as required by laws and regulations

3.    USE OF PERSONAL INFORMATION

In the past 12 months, we have used Personal Information relating to California residents to operate, manage and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, including the following

• Performing services, including opening or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Auditing related to a current interaction and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Undertaking activities to verify or maintain the quality or safety of a service controlled by us, and to improve, upgrade, or enhance the service controlled by the business.
• Debugging to identify and repair errors that impair existing intended functionality.
• Undertaking internal research for technological development and demonstration.
• Complying with laws and regulations and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes or opinions)

4.    SALE OF PERSONAL INFORMATION

In the past 12 months, we have not sold Personal Information subject to the CCPA, including Personal Information of minors under the age of 16.  

5.    YOUR RIGHTS UNDER THE CCPA

If you are a California resident, you have rights to the following upon submission of a verifiable request:

• Right to Know
  For consumers who require this Notice in an alternative formation, this version is compatible with text-to-speech technologies. If you require additional formats or assistance, please contact us at the email address below.

• Right to Deletion
  You have the right to deletion of your Personal Information from our records, and to have us direct our service providers to delete your Personal Information from their records, subject to the exceptions below. 

  We are not required to, and reserve our right not to, delete your Personal Information if it is necessary to complete the transaction for which the Personal Information was collected, provide a good or service requested by you or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us; detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity; debug, identify, or repair errors that impair existing intended functionality; exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law; comply with the California Electronic Communications Privacy Act; enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; comply with a legal obligation; and otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

• Right to Opt Out of the Sale of Personal Information
  California residents have the right to opt out of the sale of Personal Information by businesses that sell their Personal Information. This right does not apply because we do not sell your Personal Information.

• Right to Freedom from Discrimination
  You have the right to not be discriminated against by us if you exercise any of your rights under the California Consumer Privacy Act. This means we cannot do any of the following on the basis of your exercise of these rights: deny goods or services to you; charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to you; or suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services. 

• Rights Regarding Children’s Personal Information
  We do not knowingly sell Personal Information from individuals under 16 years of age without affirmative authorization. If you a parent or legal guardian, do not to allow your children to submit Personal Information to us without your authorization.

6.    HOW TO EXERCISE YOUR RIGHTS

To exercise any of your rights described in this Notice, please submit a data subject request by: (a) calling 1-855-774-8228; (b) completing this form and submitting it to privacy@fhb.com; (c)sending us a Secure Message in FHB Online.

In order for us to verify your request, you will need to provide us with enough information to identify you and verify your identity and address.  You will also need to provide us with a description of what right you wish to exercise along with any information to which your request relates.

You may also designate an authorized agent to make a request under the California Consumer Privacy Act on your behalf. In order for us to fulfill your request to know or delete submitted by an authorized agent, you must provide the authorized agent written permission to submit such a request, and we may require you to verify your own identity with us directly. 

Please note we are prohibited by law from fulfilling requests if we cannot verify that the person making the request is the person about whom we collected information or is authorized to act on such person’s behalf. Any Personal Information we collect to verify a requestor’s identity will be used solely for the purposes of verification. If we cannot verify your identity or authority to make the request, or where otherwise permitted by the California Consumer Privacy Act, we will deny your request.

You will not have to pay a fee to exercise your rights described herein. However, we may charge a reasonable fee or decline to comply with your request if your request is manifestly unfounded, repetitive, or excessive. You may only make a request to know or receive Personal Information twice within a 12-month period.

7.    CHANGES TO THIS PRIVACY NOTICE

We may update this Notice from time to time, in our sole discretion. When we do so, we will post the new Notice on our website. You should consult this Notice regularly for any changes. Continued use of services following posting of such changes constitutes your acknowledgement of such changes and agreement to be bound by the changes. If you do not agree, you should immediately discontinue your use of our website and services. 

8.    ACCESSIBILITY NOTICE 

For consumers who require this Notice in an alternative formation, this version is compatible with text-to-speech technologies.  If you require additional formats or assistance, please contact us at the email address below.

9.    CONTACT US

If you have questions regarding this Notice or our treatment of your Personal Information, you may contact us at the following: privacy@fhb.com

Copyright © 2021 First Hawaiian Bank. All rights reserved.