Law / United States / 
Kentucky
Destruction of customer's records containing personally identifiable information
Destruction of customer's records, KRS 365.725
In force since .
A security baseline statutes rule binding private bodies.
- Private right of action
- Yes
- Obligation class
- Security
As of .
What it requires
- Applies to a business: a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not operated for profit, including an entity that destroys records. It does not include a bank, credit union, savings association, or association as KRS 365.720 defines each by reference to federal banking law and KRS Chapter 286.
- When you dispose of, other than by storage, any customer's records that are not required to be retained, take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.
These lines are LexLint's reading of the law's text, as of .
What this law does
When a business disposes of, other than by storage, any customer's records that are not required to be retained, it must take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.
A business is a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not organized to operate at a profit, other than a bank, credit union, savings association, or association as the statute defines each by reference to federal banking law and Kentucky financial institutions law.
Any customer injured by a violation of KRS 365.725 may institute a civil action to recover damages, and a business that violates, proposes to violate, or has violated the section may be enjoined in a civil action. The section took effect on .
When LexLint raises it
When your app profile says your app reuses other publishers' content, sends automated outreach, crawls the web, deploys a chatbot, distributes a software product, generates content with AI, makes high-risk automated decisions, operates an app store, operates a social platform, processes biometric data, processes voice recordings, publishes adult content, records calls, records text chat, serves under-18s, ships a mobile app, tracks devices or trains models.