Duty LXD-3308
Makes housing decisions, in Kentucky
Destruction of customer's records containing personally identifiable informationsince 2 lines
Destruction of customer's records, KRS 365.725 · Read the law's page
- Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
- When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.
Kentucky Consumer Data Protection Act, consumer rightssince 3 lines
KRS 367.3615 · Read the law's page
- Give a Kentucky consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Kentucky consumer an opt-out of targeted advertising, the sale of personal data, and significant-effect profiling.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal within 60 days of receipt.
Kentucky Consumer Data Protection Act, data protection impact assessmentssince 4 lines
KRS 367.3621 · Read the law's page
- Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment available to the Attorney General when it is requested under an investigative demand as relevant to an investigation.
- Apply the assessment duty to processing activities created or generated on or after , and not to earlier ones.