Duty LXD-1426
Processes biometric data, in Kentucky
Destruction of customer's records containing personally identifiable informationsince 2 lines
Destruction of customer's records, KRS 365.725 · Read the law's page
- Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
- When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.
Kentucky Consumer Data Protection Act, sensitive data and biometric data definitionssince 2 lines
KRS 367.3611(28), 367.3611(3), 367.3617 · Read the law's page
- Obtain a Kentucky consumer's opt-in consent before processing sensitive data, including genetic or biometric data processed to uniquely identify the individual.
- Treat a voiceprint or faceprint you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data. Kentucky's exclusion for recording-derived data does not reach data generated for that purpose.