Law / United States / 
Kentucky
Notification to affected persons of computer security breach
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify an affected Kentucky resident of a breach involving unencrypted personal information in the most expedient time possible and without unreasonable delay.
- Notify each nationwide consumer reporting agency if more than 1,000 persons are affected at one time.
- Do not rely on this statute alone to cover a breach of biometric data with no accompanying Social Security, driver's license, or financial account number. Biometric data alone is not within this statute's definition of personally identifiable information.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- When an unauthorized person has acquired unencrypted names and Social Security numbers but the information holder has no evidence of misuse, does the holder 'reasonably believe' that identity theft or fraud 'will' result, so that the acquisition is a 'breach of the security of the system' under KRS 365.732(1)(a)?
What it makes you log
Logging duty
The section requires an information holder to notify affected Kentucky residents of a breach, to tell the owner or licensee of data it maintains, and to tell consumer reporting agencies when more than 1,000 persons are notified. It does not require the holder to document or keep a record of a breach, whether or not notified. The reach is any person or business that conducts business in this state, in subsection (1)(b), and the residents it protects.
- Kind
- None
- As of
What this law does
An information holder must disclose a breach of the security of the system involving unencrypted personal information to any affected Kentucky resident in the most expedient time possible and without unreasonable delay, with consumer-reporting-agency notice required once more than 1,000 persons are affected at one time.
"Personally identifiable information" is limited to a name plus a Social Security, driver's license, or financial account number with access credentials, and does not reach biometric identifiers. No provision in the eight subsections read requires notice to the Kentucky Attorney General, and none establishes a private right of action; the codified text's own history note dates it to 2014 Ky. Acts ch. 84, sec. 1, effective .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .