Duty LXD-1054
Processes personal data, in Kansas
Kansas Breach Notification Act, notice of security breachsince 3 lines
K.S.A. 50-7a02(a)-(f) · Read the law's page
- Conduct a good-faith, reasonable, and prompt investigation on becoming aware of a breach of system security involving personal information about a Kansas resident.
- Give notice to each affected Kansas resident as soon as possible, in the most expedient time possible and without unreasonable delay, if the investigation shows misuse occurred or is reasonably likely. There is no fixed numeric deadline in the statute; do not rely on a 45-day figure some secondary sources describe.
- Notify each nationwide consumer reporting agency if more than 1,000 Kansas consumers are affected by one breach.
Kansas Breach Notification Act, enforcementsince 1 line
K.S.A. 50-7a02(g)-(h) · Read the law's page
- Expect a violation of the Kansas Breach Notification Act to be enforced by the Attorney General, or, for an insurance company, solely by the Insurance Commissioner, never by a private plaintiff.
Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal informationsince 4 lines
K.S.A. 50-6,139b · Read the law's page
- This binds any holder of personal information: any individual, partnership, corporation, trust, estate, cooperative, association, government, governmental subdivision, agency, or other entity that in the ordinary course of business collects, maintains, or possesses another person's personal information.
- Implement and maintain reasonable procedures and practices appropriate to the nature of the information, and exercise reasonable care to protect it from unauthorized access, use, modification, or disclosure. Being subject to and compliant with another federal or state law or regulation governing the same procedures and practices is deemed compliance with this duty.
- Unless a federal law or regulation requires otherwise, destroy or arrange for the destruction of records containing personal information once you no longer intend to maintain or possess them, by shredding, erasing, or otherwise rendering the personal information unreadable or undecipherable.
- There is no private right of action. Only the Kansas Attorney General may enforce this section, as an unconscionable act or practice under the Kansas Consumer Protection Act, seeking a civil penalty of up to $10,000 per violation under K.S.A. 50-636.