Law / United States / 
Kentucky
Notification of a personal information security breach by public agencies to state officials
Public agency security breach notice to state officials, KRS 61.933(1)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds each agency that collects, maintains, or stores personal information: the executive branch of state government; every county, city, municipal corporation and other local government, and every unit, board, commission, authority or public corporation of or controlled by one; every public school district; and every public institution of postsecondary education.
- As soon as possible, and within seventy-two hours of determining or being notified of a security breach relating to personal information you collect, maintain, or store, or that a nonaffiliated third party holds on your behalf, notify in writing, on the form developed by the Commonwealth Office of Technology, the commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General.
- In the same notification, notify the secretary of the Finance and Administration Cabinet if you are an executive branch unit, the commissioner of the Department for Local Government if you are a local government unit, the commissioner of the Kentucky Department of Education if you are a public school district, or the president of the Council on Postsecondary Education if you are a public postsecondary institution.
- Begin a reasonable and prompt investigation, in accordance with your security and breach investigation procedures and practices, to determine whether the security breach has resulted in or is likely to result in the misuse of the personal information.
- If the investigation finds that a security breach occurred and that misuse of personal information has occurred or is reasonably likely to occur, notify in writing all of those officers and the commissioner of the Department for Libraries and Archives within forty-eight hours of completing the investigation, unless a law enforcement delay applies.
- If the investigation finds that misuse of personal information has not occurred and is not likely to occur, keep records of the basis for the decision and notify the listed entities that misuse has not occurred.
These lines are LexLint's reading of the law's text, as of .
What this law does
An agency that collects, maintains, or stores personal information and determines or is notified of a security breach relating to that information must, as soon as possible but within seventy-two hours of the determination or notification, notify the commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General.
An agency must also notify the secretary of the Finance and Administration Cabinet if it is an executive branch unit, the commissioner of the Department for Local Government if it is a local government unit, the commissioner of the Kentucky Department of Education if it is a public school district, or the president of the Council on Postsecondary Education if it is a public postsecondary educational entity.
The notification must be in writing on a form developed by the Commonwealth Office of Technology. The agency must begin conducting a reasonable and prompt investigation to determine whether the security breach has resulted in or is likely to result in the misuse of the personal information.
If the agency determines that a security breach has occurred and that misuse of personal information has occurred or is reasonably likely to occur, it must within forty-eight hours of completing the investigation notify in writing all of those officers and the commissioner of the Department for Libraries and Archives, unless a law enforcement delay applies.
If the agency determines that misuse of personal information has not occurred and is not likely to occur, it is not required to give notice, but must keep records of the basis for its decision and notify the listed entities that misuse has not occurred.
A nonaffiliated third party that is provided access to personal information by an agency, or that collects and maintains personal information on behalf of an agency, must notify the agency in the most expedient time possible and without unreasonable delay but within seventy-two hours of determination of a security breach relating to the personal information in its possession.
Within thirty-five days of providing the officer notifications, an agency whose investigation finds likely misuse must also notify the individuals impacted by the breach, unless the delay provisions of subsection (3) apply. The section took effect on .