iOn March 27, 2024, the Kentucky legislature passed a comprehensive data privacy bill (“H.B. 15”), which was delivered to the Governor for signature. If H.B. 15 is enacted, Kentucky will join the growing list of states with comprehensive data privacy laws.
Applicability
H.B. 15 applies to persons that “conduct business” in Kentucky or produce products or services that are targeted to Kentucky residents and, during a calendar year, either control or process personal data of at least: (1) one hundred thousand (100,000) consumers; or (2) twenty-five thousand (25,000) consumers and derive more than 50 percent of gross revenue from the sale of personal data.
Similar to other comprehensive state privacy laws, H.B. 15’s protections do not apply to individuals acting in a commercial or employment context. H.B. 15 also includes several exemptions that are common in other state data privacy regimes, such as for covered entities, business associates, and PHI under HIPAA; non-profit organizations; institutions of higher education; and financial institutions, their affiliates, and data subject to the Gramm-Leach-Bliley Act.
Controller Obligations
If enacted, H.B. 15 would require controllers to: (1) limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed as disclosed to the consumer; (2) establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data; (3) not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which the personal data is processed, unless the controller obtains the consumer’s consent; and (4) not process sensitive data concerning a consumer without obtaining the consumer’s consent, or in the case of sensitive data collected from a known child, process the data in accordance with the Children’s Online Privacy Protection Act.
Controllers must also conduct and document a data protection impact assessment with respect to the processing of personal data for purposes of: (1) targeted advertising; (2) selling personal data; and (3) profiling, where the profiling presents certain reasonably foreseeable risks, including of financial, physical, or reputational injury, to consumers.
H.B. 15 would also require controllers to provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes, among other items: (1) the categories of personal data processed by the controller; (2) the purpose for processing personal data; (3) how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request; (4) the categories of personal data that the controller shares with third parties, if any; and (5) the categories of third parties, if any, with whom the controller shares personal data.
Consumer Rights
H.B. 15 provides consumers with the following rights: (1) to confirm whether a controller is processing the consumer’s personal data and to access such personal data, unless the confirmation and access would require the controller to reveal a trade secret; (2) to correct inaccuracies in the consumer’s personal data; (3) to delete personal data provided by, or obtained about, the consumer; (4) to obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; (5) to opt out of the processing of the personal data for purposes of (a) targeted advertising, (b) the sale of personal data or (c) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
Like other state privacy laws, controllers have 45 days to respond to consumer rights requests, with a potential 45-day extension where reasonably necessary.
Enforcement
H.B. 15 does not contain a private right of action and would be enforced exclusively by Kentucky’s Attorney General. It provides a 30-day cure period where, if utilized, controllers and processors must provide a written statement that the alleged violations have been cured and that no further violations will occur in the future. The cure provision does not expire.
Effective Date
If enacted, H.B. 15 will take effect on January 1, 2026.
