Kentucky’s new privacy law, the Kentucky Consumer Data Protection Act (KCDPA), will afford Kentucky consumers certain rights over their personal data. Importantly, the KCDPA imposes new requirements on certain businesses that either control or process personal data, called “controllers” and “processers.”  The KCDPA was signed into law on April 4, 2024, and goes into effect on January 1, 2026. It is codified at KRS 367.3611 to KRS 367.3629.  The KCDPA’s approximate 21-month lead time before its effective date allowed businesses who are “controllers” to bring consumer data collection and processing practices in line with the law’s requirements.  Businesses who have not yet reviewed the KCDPA should do so immediately to determine whether the law applies to them and, if so, what actions they need to take to comply.

PROTECTED PERSONAL DATA

The KCDPA creates protections for “personal data,” which means information that is linked, or reasonably could be linked, to an identified or identifiable natural person. It does not include de-identified data or information that is publicly available.

One useful exemption is data processed or maintained by a controller in their role as an employer. The KCDPA exempts data regarding job applicants, employees, agents, and independent contractors that is used for employment, relates to the administration of benefits, or is used for emergency contact purposes.

The KCDPA also exempts numerous other types of personal data, much of which is protected under other laws. For example, it exempts personal health information (PHI) protected under the Health Insurance Portability and Accountability Act (HIPAA) and human subjects research data protected by various laws. In addition, the KCPDA exempts from its application data regulated by the Health Care Quality Improvement Act of 1986, the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act (FERPA), and the federal Farm Credit Act.

CONSUMER RIGHTS

The KCDPA grants consumers certain rights over their personal data. For purposes of the KCDPA, a “consumer” is a Kentucky resident, a natural person acting only in an individual context. A “consumer” does not include a person who is acting in a commercial or employment context.

The KCDPA grants consumers the following rights:

1. To confirm whether a controller is processing the consumer’s personal data;
2. To obtain access to the consumer’s personal data;
3. To correct inaccuracies in the consumer’s personal data;
4. To delete personal data provided by or obtained about the consumer;
5. To obtain a copy of the consumer’s personal data in a portable and readily usable format; and
6. To opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

In order to exercise these rights, a consumer may submit a request to a controller, at any time, via the method specified in the controller’s privacy notice, which is discussed further below. A child’s parent or legal guardian may invoke such consumer rights on behalf of the child. Controllers must respond to consumer requests within 45 days.

BUSINESSES THAT ARE SUBJECT TO THE KCDPA

The KCDPA applies to certain businesses located in Kentucky or targeting Kentucky residents. In particular, it applies to natural persons or legal entities that conduct business in Kentucky or produce products or services that are targeted to residents of Kentucky and that, during a calendar year, “control” or “process” personal data of at least: (a) 100,000 consumers, or (b) 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

There are a handful of business categories exempt from the KCDPA. Specifically, the KCDPA does not apply to any:

1. City, state agency, or any political subdivision of the state;
2. Financial institution, its affiliates, or data subject to the Gramm-Leach-Bliley Act;
3. HIPAA covered entity or a business associate of such covered entity;
4. Nonprofit organization;
5. Institution of higher education;
6. Small telephone utility, a Tier III CMRS provider, or a municipally owned utility that does not sell or share personal data with any third-party processor; or
7. Organization that:
   i) Does not provide net earnings to, or operate in any manner that inures to the benefit of any officer, employee, or shareholder of the entity; and
   ii) collects, processes, uses, or shares data solely in relation to identifying, investigating, or assisting either (a) law enforcement agencies suspected of insurance-related crimes or fraud, or (b) first responders in connection with catstrophic events.

Many of these exempted entities are already subject to other state or federal data protection laws.

CONTROLLER RESPONSIBILITIES AND OBLIGATIONS

The KCDPA imposes various responsibilities and obligations upon controllers, which include, but are not limited to, the following:

1. Limit Collection and Use of Personal Data. Controllers must limit the collection of personal data to what is “reasonably necessary.” If the controller desires to process personal data for purposes that are neither reasonably necessary nor compatible with the disclosed purposes, then they must obtain the consumer’s consent.
2. Implement Reasonable Security Practices. Controllers are required to protect the personal data entrusted to them. They must ensure that they have in place “reasonable administrative, technical, and physical data security practices” to protect the “confidentiality, integrity, and accessibility” of personal data. The KCDPA declines to specify exactly what these data security practices entail but allows flexibility and scalability based on the volume and nature of the personal data involved. More personal data and more sensitive data would, of course, demand tighter security measures.
3. Consumer Rights. Controllers will need to timely comply with an authenticated request from a consumer to exercise a consumer right. In addition, they will need to establish; and follow; a process for a consumer to appeal the controller’s refusal to act on a request.
4. Nondiscrimination. A controller must comply with state and federal laws that prohibit unlawful discrimination against consumers.
5. Obtain Consent for Use of Sensitive Data. Sensitive data requires special handling procedures. “Sensitive data” is personal data indicating racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data that can identify a specific natural person, personal data collected from a known child, or precise geolocation data. Controllers must first obtain the consumer’s consent before processing any sensitive data. Controllers must comply with the federal Children’s Online Privacy Protection Act (COPPA) when processing sensitive data from a known child.
6. Contracts with Processors. Controllers must enter into binding contracts with processors that perform operations on personal data on behalf of a controller, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. This contract shall include:
   
   a. Clear instructions for processing personal data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties;
   b. A requirement that the processor ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
   c. A provision regarding the deletion or return of all personal data to the controller upon termination of the contract;
   d. A requirement for the processor to make available to the controller all information in the processor’s possession in order to demonstrate the processor’s compliance with the KCDPA;
   e. A requirement for the processor to cooperate with the controller’s assessments of the processor’s policies and technical and organizational measures designed to comply with the KCDPA; and
   f. A requirement to enter into a written contract with any subcontractor that requires the subcontractor to meet the obligations of the processor with respect to the personal data.

Controller versus Processor. Whether your business is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends on upon the context in which personal data is to be processed.  Nevertheless, a processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor. (KRS 367.3619(4).) The KCDPA provides, however, that nothing in the law’s section on obligations of a processor (in KRS 367.3619) is to be construed as relieving a controller or processor from the liability imposed on it by virtue of its role in a processing relationship as defined by the KCDPA. KRS 367.3619(3).

7. Privacy Notices. Like HIPAA and other privacy laws, the KCDPA requires controllers to provide consumers with a privacy notice that informs them about how the controller uses and discloses their personal data and how consumers can exercise their rights. The privacy notice must be “reasonably accessible, clear, and meaningful” and include:
a. The categories of personal data processed by the controller;
b. The purpose for processing personal data;
c. How consumers may exercise their consumer rights, including how a consumer may submit a request to exercise their consumer rights as well as how to appeal a controller’s decision to such a request;
d. The categories of personal data that the controller shares with third parties, if any, and the categories of third parties, if any, with whom the controller shares personal data; and
e. Whether a controller sells personal data or uses the personal data for targeted advertising, and how a consumer may exercise the right to opt out of processing.

This KCDPA does not specify how the privacy notice should be communicated to consumers, merely that it should be “conspicuously available.”

8. Data Protection Impact Assessment. Controllers must perform, and document, a data protection impact assessment identifying the benefits from certain processing of personal data (such as sensitive data, targeted advertising, profiling, and the sale of personal data). These identified benefits should be weighed against the potential risks to the consumer’s rights associated with such processing. The controller should also consider whether employing safeguards could mitigate those risks. The data protection impact assessment should be performed on processing activities generated on or after June 1, 2026. The Kentucky Attorney General may demand a copy of this assessment as part of an investigation.

ENFORCEMENT

The Kentucky Attorney General has exclusive authority to enforce violations of the KCDPA. Before it can seek damages for alleged violations, the KCDPA requires the Kentucky Attorney General to first provide a controller or processor with written notice identifying alleged violations and allow the controller or processor an opportunity to cure the violation(s). If cured, then no further enforcement action is taken. If not cured, then the Kentucky Attorney General may bring an action seeking damages of up to $7,500 for each violation. There is no private right of action for violations of the KCDPA.

Looking for assistance in navigating compliance with the KCDPA?  We work with our clients regarding their policies and procedures related to compliance with the KCDPA, HIPAA and other data privacy and security laws and regulations. If you are looking for assistance in this area, contact Kathie McDonald-McClure at (502) 562-7526 or Margaret Young Levi at (859) 288-7469. To learn more about Wyatt’s health care, data privacy and cyber security practice, visit the following Wyatt website pages: Wyatt Data Privacy & Cyber Security and Wyatt Health Care.