Processes personal data, in Kentucky

KRS 216.2927 · Read the law's page

• If you are the Cabinet for Health and Family Services, a state agency, or its designee, once you assign a unique patient identifier to patient data collected under KRS 216.2920 to 216.2929, strip all direct identifying information from the data and do not retain it (KRS 216.2927(4)).when it serves a public body
• If you are the Cabinet for Health and Family Services, a state agency, make available to the public only aggregate data that does not allow disclosure of the identity of any individual patient, and do not release data that, because of small sample size, breaches the confidence of individual patients (KRS 216.2927(3)(a) and (6)).when it serves a public body
• If you request the aggregate health care data the Cabinet for Health and Family Services holds, agree to a public-use data agreement that prohibits the sale or further release of the data, and to the HIPAA privacy rules referenced in 45 C.F.R. Part 164 (KRS 216.2927(3)(b)).

KRS 304.12-085(2) to (4) · Read the law's page

• If you offer or administer a group or individual health benefit plan, do not deny, cancel or refuse to renew medical care benefits or coverage, or vary the premiums, terms or conditions, for a participant or beneficiary on the basis of a genetic test for which symptoms have not manifested, or because the participant or beneficiary requested or received genetic services (KRS 304.12-085(2)).
• If you offer a group or individual health benefit plan, health insurance in connection with a health benefit plan, or a disability income plan, do not request or require an applicant, participant or beneficiary to disclose any genetic test (KRS 304.12-085(3)).
• If you offer a group or individual health benefit plan, or health insurance in connection with a health benefit plan, do not disclose any genetic test about a participant or beneficiary without the participant's prior authorization, which you must obtain for each disclosure (KRS 304.12-085(4)).

Destruction of customer's records, KRS 365.725 · Read the law's page

• Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
• When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.

KRS 365.732 · Read the law's page

• Notify an affected Kentucky resident of a breach involving unencrypted personal information in the most expedient time possible and without unreasonable delay.
• Notify each nationwide consumer reporting agency if more than 1,000 persons are affected at one time.
• Do not rely on this statute alone to cover a breach of biometric data with no accompanying Social Security, driver's license, or financial account number. Biometric data alone is not within this statute's definition of personally identifiable information.

Genetic Information Privacy Act, 2022 Ky. Acts ch. 169, sec. 1 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available to a Kentucky consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (KRS 311.705(2)(a)).
• Obtain a consumer's initial express consent that clearly describes the uses of the genetic data collected through the product or service and says who has access to the results and how the data may be shared (KRS 311.705(2)(b)1.).
• Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or using it beyond the primary purpose of the testing and inherent contextual uses (KRS 311.705(2)(b)2.).
• Obtain separate express consent before retaining any biological sample after the initial testing service the consumer requested (KRS 311.705(2)(b)3.).
• Obtain informed consent in compliance with the Federal Policy for the Protection of Human Subjects before transferring or disclosing a consumer's genetic data to third parties for research, or using it in research under your control for publication or generalizable knowledge (KRS 311.705(2)(b)4.).
• Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to a consumer because the consumer ordered or bought a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (KRS 311.705(2)(b)5.).
• Require valid legal process before disclosing a consumer's genetic data to law enforcement or any other government agency, unless the consumer gives express written consent (KRS 311.705(2)(c)).
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use or disclosure (KRS 311.705(2)(d)).
• Let a consumer access their genetic data, delete their account and genetic data, and request and obtain destruction of their biological sample (KRS 311.705(2)(e)).
• Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (KRS 311.705(3)).

KRS 367.3611, 367.3613, 367.3617, 367.3619 · Read the law's page

• Determine whether you conduct business in Kentucky, or produce a product or service targeted to Kentucky residents, and control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data, before relying on any KCDPA exemption.
• Confirm whether a sector exemption applies. KCDPA excludes city and state government, GLBA-covered financial institutions, HIPAA covered entities and business associates, nonprofits, and higher-education institutions.
• Limit collection to the purposes disclosed to the consumer, and use a written contract to bind any processor to your instructions.

KRS 367.3615 · Read the law's page

• Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.

KRS 367.3621 · Read the law's page

• Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment available to the Attorney General when it is requested under an investigative demand as relevant to an investigation.
• Apply the assessment duty to processing activities created or generated on or after June 1, 2026, and not to earlier ones.

KRS 367.3623 · Read the law's page

• Take reasonable measures to ensure that de-identified data you hold cannot be associated with a natural person (KRS 367.3623(1)(a)).
• Publicly commit to maintaining and using de-identified data without attempting to re-identify it (KRS 367.3623(1)(b)).
• Contractually obligate every recipient of the de-identified data to comply with all provisions of KRS 367.3611 to 367.3629 (KRS 367.3623(1)(c)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of those commitments (KRS 367.3623(5)).

KRS 367.3627 · Read the law's page

• Expect KCDPA violations to be enforced exclusively by the Kentucky Attorney General, never by a private plaintiff.
• Cure a noticed violation and confirm the cure in writing within 30 days of Attorney General notice to avoid damages of up to $7,500 per continued violation.