Makes employment decisions, in Kentucky

KRS 214.625, 214.995 · Read the law's page

• Do not perform a test designed to identify the human immunodeficiency virus, or its antigen or antibody, without first obtaining the informed consent of the person tested, except where a signed general consent form covers the test or in an emergency in which informed consent cannot reasonably be obtained (KRS 214.625(2), (3) and (5)(a)).
• Do not determine a test result to be positive, or reveal a positive result to any person, without corroborating or confirmatory tests (KRS 214.625(5)(b)).
• If you have obtained or have knowledge of a test result, do not disclose the identity of the person tested, or the results in a manner that permits identification of the subject, except to a person KRS 214.625(5)(c) lists.
• When you disclose test results under subsection (5), accompany the disclosure with the written statement the subsection prescribes (for an oral disclosure, an oral notice followed by a written notice within ten days), and if test results have been disclosed to you, do not disclose them to another person except as the subsection authorizes (KRS 214.625(5)).
• Do not use the result of a serologic test conducted under the auspices of the Cabinet for Health and Family Services to determine whether a person may be insured for disability, health or life insurance, or to screen or determine suitability for, or to discharge a person from, employment (KRS 214.625(6)(d)).

Destruction of customer's records, KRS 365.725 · Read the law's page

• Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
• When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.

KRS 367.3615 · Read the law's page

• Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.

KRS 367.3621 · Read the law's page

• Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment available to the Attorney General when it is requested under an investigative demand as relevant to an investigation.
• Apply the assessment duty to processing activities created or generated on or after June 1, 2026, and not to earlier ones.