Law / United States / 
Kentucky
Kentucky Consumer Data Protection Act, publicly available information exclusion
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Personal data that is lawfully made available through a government record, or that you have a reasonable basis to believe is lawfully made available to the public through widely distributed media, by the consumer, or by someone the consumer disclosed it to, falls outside the KCDPA's definition of personal data, unless the consumer restricted it to a specific audience.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
KRS 367.3611 is the definitions section of the Consumer Data Protection Act. It defines consumer, personal data, publicly available information and the other terms, and imposes no duty to create, keep, produce or review a log or record. The controller duties, consumer rights and assessment provisions sit in other sections of KRS 367.3611 to 367.3629 that the row does not cite, and none is borrowed. The definition of consumer limits the Act to residents of the Commonwealth, which is the residence hook.
- Kind
- None
- As of
What this law does
The Kentucky Consumer Data Protection Act (KCDPA), in force since , defines personal data as information linked or reasonably linkable to an identified or identifiable natural person, and expressly excludes de-identified data and publicly available information from that definition.
Publicly available information means information lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it, unless the consumer has restricted it to a specific audience.
This places most scraped public personal data outside the KCDPA's coverage at the definitional level, the same approach Virginia's parallel statute takes.
The Act applies only to a person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that controls or processes the personal data of 100,000 or more consumers a year, or of 25,000 or more while deriving over half of gross revenue from selling personal data, and it expressly excludes a city, state agency, or other political subdivision.
The Act's consumer rights, controller and processor duties, and Attorney General enforcement are personal-data duties rather than scraping law.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .