LexLint.ioBeta

Know the law your code answers to.

Law / United States / Kentucky

Kentucky Consumer Data Protection Act, de-identified and pseudonymous data

KRS 367.3623

In force since .

A de-identification rule binding private bodies.

Obligation class
Disclosure, Prohibition
Audit expectation
none

What it requires

  • Take reasonable measures to ensure that de-identified data you hold cannot be associated with a natural person (KRS 367.3623(1)(a)).
  • Publicly commit to maintaining and using de-identified data without attempting to re-identify it (KRS 367.3623(1)(b)).
  • Contractually obligate every recipient of the de-identified data to comply with all provisions of KRS 367.3611 to 367.3629 (KRS 367.3623(1)(c)).
  • When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments it is subject to, and take appropriate steps to address any breach of those commitments (KRS 367.3623(5)).

These lines are LexLint's reading of the law's text.

What it makes you log

Logging duty

KRS 367.3623 sets conditions for holding de-identified data and a duty to oversee contractual commitments. It states no log or record duty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

KRS 367.3623(1) requires a controller in possession of de-identified data to take reasonable measures to ensure the data cannot be associated with a natural person, to publicly commit to maintaining and using the data without attempting to re-identify it, and to contractually obligate any recipients of the data to comply with all provisions of KRS 367.3611 to 367.3629.

KRS 367.3623(5) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which that data is subject, and to take appropriate steps to address any breach of those commitments. KRS 367.3623(2) provides that KRS 367.3611 to 367.3629 do not require a controller or processor to re-identify de-identified data or pseudonymous data.

KRS 367.3623(4) provides that the consumer rights in KRS 367.3615 do not apply to pseudonymous data where the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person. KRS 367.3623 is effective .

When LexLint raises it

When your app profile says your app processes personal data or processes de-identified data.

Back to the example  ·  Lint your app

Page updated .