Kentucky

House Bill 207, Kentucky Acts chapter 15 of 2024, adds a definition of computer-generated image to KRS 531.010: any visual depiction, including any photograph, film, video, or picture, that a computer has created, adapted, or modified to appear to be an identifiable person. An identifiable person is a person who is recognizable by the person's face, likeness, or other distinguishing characteristic.

A person is guilty of promoting a sexual performance by a minor when, knowing the character and content, the person produces, directs, or promotes any performance that includes sexual conduct by a minor or a computer-generated image of a minor.

A person is guilty of distribution of matter portraying a sexual performance by a minor when, knowing its content and character, the person sends or brings into Kentucky for sale or distribution, or in Kentucky exhibits for profit or gain, distributes, offers to distribute, or possesses with intent to distribute, any matter portraying a sexual performance by a minor or a computer-generated image of a minor.

A person is guilty of advertising material portraying a sexual performance by a minor when, knowing its content and character, the person writes or creates advertising, solicits anyone to publish such advertising, or otherwise promotes the sale or distribution of matter portraying a sexual performance by a minor or a computer-generated image of a minor.

The act also amends the possession or viewing offense in KRS 531.335 to reach any matter that visually depicts an actual sexual performance by a minor person or a computer-generated image of a minor person. In a prosecution under KRS 531.300 to 531.370 where the offense involves matter portraying a computer-generated image of a minor, the Commonwealth is not required to prove the actual identity or age of the minor, or that the minor actually exists.

KRS 531.335 was amended again by House Bill 366 of 2026, Kentucky Acts chapter 109. The Governor signed House Bill 207 on March 28, 2024. Legislation of the 2024 Regular Session took effect on July 15, 2024.

House Bill 366, Kentucky Acts chapter 109 of 2026, amends KRS 531.335 so that a person is guilty of possession or viewing of matter portraying a sexual performance by a minor when, having knowledge of its content and character, the person knowingly possesses or controls, or intentionally views, matter that visually depicts a sexual performance by a minor person or a computer-generated image of a minor person.

The viewing limb applies only to the deliberate, purposeful, and voluntary viewing of such matter and not to its accidental or inadvertent viewing. The viewing limb does not apply to a person viewing the matter in the course of a law enforcement investigation or criminal or civil litigation involving the matter.

Possession or viewing is a Class D felony if the person knows that the minor or computer-generated image of a minor portrayed is less than eighteen years old at the time of the sexual performance. Possession or viewing is a Class C felony if the person knows that the minor or computer-generated image of a minor portrayed is less than twelve years old at the time of the sexual performance.

A person convicted under the section shall not be released on probation or parole until the person has served at least eighty-five percent of the sentence imposed. KRS 531.010 defines a computer-generated image as any visual depiction, including any photograph, film, video, or picture, that a computer has created, adapted, or modified to appear to be an identifiable person. The Governor signed House Bill 366 on April 13, 2026. Legislation of the 2026 Regular Session took effect on July 15, 2026.

Created by 2025 Ky. Acts ch. 66 (Senate Bill 4) and effective March 24, 2025, the same emergency-clause Act that also directs Commonwealth-agency AI governance, KRS 117.322 lets a candidate for elected office whose appearance, action, or speech is altered through synthetic media in an electioneering communication seek an injunction or other equitable relief against the communication's sponsor requiring a disclosure that is clear and conspicuous and placed in or alongside the content so a user is likely to notice it, and lets a prevailing plaintiff recover attorney's fees and costs.

The medium disseminating the communication and its advertising sales representative are not liable except where they intentionally remove a required disclosure or, intending to deceive, alter content so that it becomes synthetic media, and an interactive computer service keeps its federal Communications Decency Act section 230 exemption. It is an affirmative defense that the communication already carries the required disclosure.

Failing to comply with a court's order to include the disclosure is punishable as a Class D felony under KRS 121.990(3). The section was amended again by 2026 Ky. Acts ch. 161, effective July 15, 2026.

A licensee that learns a cybersecurity event has or may have occurred must conduct, or have a designated outside vendor or service provider conduct, a prompt investigation that at a minimum determines whether an event has occurred, assesses its nature and scope, identifies the nonpublic information involved and performs or oversees reasonable measures to restore the security of the compromised systems.

Where the event occurred in a system maintained by a third-party service provider, the licensee must complete, or confirm and document that the provider has completed, those steps. Each licensee must maintain, and produce upon demand of the commissioner, records concerning all cybersecurity events for a period of at least five years from the date of the event.

Each licensee must notify the commissioner of a cybersecurity event involving nonpublic information in the licensee's possession as promptly as possible, but in no event later than three business days from a determination that a cybersecurity event has occurred, if the licensee is an insurer domiciled in Kentucky and the event has a reasonable likelihood of harming any material part of its normal operations, if the licensee is an insurance producer whose home state is Kentucky, or if the licensee reasonably believes that the nonpublic information relates to 250 or more consumers residing in Kentucky and the event requires notice to a governmental body, self-regulatory agency or other supervisory body or has a reasonable likelihood of materially harming a consumer residing in Kentucky or a material part of the licensee's normal operations.

The notification must be given in an electronic form the commissioner prescribes and must include the date of the event, how the information was exposed, how the event was discovered, the types of information acquired, the period during which the system was compromised, the results of any internal review, a description of the remediation efforts, a copy of the licensee's privacy policy and a contact person, and the licensee has a continuing obligation to update and supplement it.

A licensee must comply with KRS 365.732 as applicable. For an event in a system maintained by a third-party service provider, the licensee treats the event as it would its own, and its deadlines begin on the earlier of the day after the provider notifies it or the day it otherwise has actual knowledge.

An assuming insurer that has no direct contractual relationship with the affected consumers must notify its affected ceding insurers and the commissioner of its state of domicile within three business days. An insurer must notify the producers of record at the same time as affected consumers when it must notify consumers under KRS 365.732, unless it lacks current producer of record information for a consumer.

A licensee with fewer than fifty employees, including independent contractors, is exempt from KRS 304.3-750 to 304.3-768.

A licensee is deemed in compliance with KRS 304.3-750 to 304.3-768 if it is subject to, governed by and compliant with the federal health privacy, security and breach notification rules and maintains nonpublic information in the same manner as protected health information, or is a financial institution compliant with the federal financial privacy, security and breach notification standards, and in either case submits an annual written statement certifying compliance and a copy of the breach notification it gives. The section took effect on January 1, 2023.

An information holder must disclose a breach of the security of the system involving unencrypted personal information to any affected Kentucky resident in the most expedient time possible and without unreasonable delay, with consumer-reporting-agency notice required once more than 1,000 persons are affected at one time.

"Personally identifiable information" is limited to a name plus a Social Security, driver's license, or financial account number with access credentials, and does not reach biometric identifiers. No provision in the eight subsections read requires notice to the Kentucky Attorney General, and none establishes a private right of action; the codified text's own history note dates it to 2014 Ky. Acts ch. 84, sec. 1, effective July 15, 2014.

KCDPA applies to a person that conducts business in Kentucky, or produces a product or service targeted to Kentucky residents, and that during a calendar year controls or processes personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data.

It exempts city and state government, Gramm-Leach-Bliley Act (GLBA)-covered financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, higher-education institutions, certain insurance-fraud investigative organizations, and small telephone, CMRS, or municipal utilities that do not sell personal data. Controllers must limit collection to disclosed purposes and processors act on the controller's instructions under a written contract. The enacting session law is 2024 Ky. Acts ch. 72, sec. 1, not ch. 89.

KCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, selling personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.

Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards.

The Attorney General may request, pursuant to an investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with KRS 367.3611 to 367.3629.

Assessments are confidential and exempt from disclosure, public inspection and copying under KRS 61.870 to 61.884, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The assessment requirements apply to processing activities created or generated on or after June 1, 2026.

A consumer may elect to place a security freeze on the consumer's consumer report by a written request sent by certified mail, or by a telephone, fax, web-based or other electronic method the consumer reporting agency has established. A consumer reporting agency must place the freeze no later than ten business days after receiving the request.

While a freeze is in place, information from the consumer report may not be released to a third party without the consumer's prior express authorization, although the agency may tell a third party that a freeze is in effect. The agency must comply with a request to temporarily lift a freeze no later than three business days after receiving it.

The agency must remove a freeze within three business days of receiving the consumer's request with clear and proper identification and the personal identification number or password. The agency may charge a reasonable fee for placing, temporarily lifting or removing a freeze, and the fee may not exceed ten dollars, adjusted each January 1 under the consumer price index.

A person who willfully fails to comply is liable to the consumer for actual damages, liquidated damages of not less than $100 and not more than $1,000, any punitive damages the court allows, and costs and reasonable attorney's fees.

Kentucky defines a security freeze as a notice placed on a consumer file, at the request of the consumer and subject to certain exceptions, that prohibits a consumer reporting agency from releasing the consumer's consumer report or credit score relating to the extension of credit without the consumer's express authorization.

KCDPA gives a Kentucky consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling.

A controller must respond without undue delay and in all cases within 45 days of receipt, with one 45-day extension available when reasonably necessary, and must decide an appeal of a denial within 60 days, after which the consumer may complain to the Attorney General.

Upon a patient's written request, a hospital licensed under KRS Chapter 216B or a health care provider must provide, without charge to the patient, a copy of the patient's medical record. A copying fee, not to exceed one dollar per page, may be charged by the health care provider for furnishing a second copy of the patient's medical record upon request either by the patient or the patient's attorney or the patient's authorized representative.

The Department of Corrections is not considered a health care provider under the section, although it may make the medical records of an individual inmate available to that inmate unless it determines that KRS 197.025 applies. The section was created by chapter 512 of the 1994 Acts, effective July 15, 1994, and was amended by chapter 334 of the 1996 Acts, effective July 15, 1996.

The administrative regulation governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees.

A licensee must give a customer a clear and conspicuous notice of its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses nonpublic personal financial information about the consumer to a nonaffiliated third party other than as the regulation authorizes.

A licensee must give a customer such a notice not less than annually during the continuation of the customer relationship, except where the regulation excepts it. A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.

A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the regulation lists. A licensee may not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure or has not granted authorization for the disclosure of nonpublic personal financial information.

A violation of the regulation is an unfair trade practice in the business of insurance and subjects the licensee to a civil penalty authorized by KRS 304.99-020. The regulation does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The history line gives an effective date of February 11, 2002, an amended version effective December 1, 2017, and certification effective March 21, 2023.

The Kentucky Attorney General has exclusive authority to enforce KCDPA. Before suing, the Attorney General must give a controller or processor 30 days' written notice; curing the violation and confirming the cure in writing bars an action, and this 30-day cure period is permanent, unlike New Hampshire's and Rhode Island's time-limited or absent versions. An uncured, continuing violation is subject to damages of up to $7,500 per violation, and the statute creates no private right of action.

Binds a direct-to-consumer genetic testing company, an entity that offers genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data that resulted from such a product or service and was provided to the company by a consumer. A company must make a high-level privacy policy overview and a prominent, publicly available privacy notice available to a consumer.

A company must obtain initial express consent to the collection, use or disclosure of a consumer's genetic data, separate express consent for transferring or disclosing it to any person other than the company's vendors and service providers or for using it beyond the primary purpose of the testing, separate express consent for retaining a biological sample after the initial testing, informed consent under the Federal Policy for the Protection of Human Subjects for disclosure to third parties for research, and express consent for marketing based on the data.

A company must require valid legal process before disclosing genetic data to law enforcement or another government agency without the consumer's express written consent, and must develop, implement and maintain a comprehensive security program to protect the data. A company may not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent.

The Attorney General may bring an action in the name of the Commonwealth, or as parens patriae on behalf of consumers, and a violation is subject to a civil penalty of $2,500 for each violation, the recovery of actual damages incurred by the consumers, and the costs and expenses of the Attorney General. The section does not apply to protected health information collected by a covered entity or business associate governed by the federal health privacy rules.

An entity is not a direct-to-consumer genetic testing company only when it is engaged in collecting, using or analyzing genetic data or biological samples in the context of the research the definition names. The section took effect on July 14, 2022.

The section applies to all life and health insurance contracts which are delivered or issued for delivery in Kentucky on or after July 13, 1990. For the section, "insurer" means an insurer, a nonprofit hospital, medical-surgical, dental, and health service corporation, a health maintenance organization, or a prepaid dental plan organization.

An insurer must disclose in writing its intent to test an applicant for the human immunodeficiency virus infection or for a specific health condition derived from it before testing, and must obtain the applicant's written informed consent to administer the test.

Insurers must maintain strict confidentiality of the results of tests for human immunodeficiency virus infection or a specific health condition derived from it, and specific test results may be disclosed only as required by law or pursuant to a written request or authorization by the applicant. Insurers may disclose results pursuant to a specific written request only to the persons subsection (4)(f) lists.

Insurers may not inquire whether an applicant has been tested for or has received a negative result from a specific test for human immunodeficiency virus infection. A medical test for human immunodeficiency virus infection may only be required or given to an applicant on the basis of the applicant's health condition or health history, the amount of insurance applied for, or if the test is required of all applicants.

The section was created by chapter 443 of the 1990 Acts and its current text is as most recently amended by chapter 24 of the 2010 Acts, effective July 15, 2010.

No person in Kentucky may perform a test designed to identify the human immunodeficiency virus, or its antigen or antibody, without first obtaining the informed consent of the person upon whom the test is performed, except as the general consent form and emergency provisions of subsections (2) and (3) specify. No test result may be determined as positive, and no positive test result revealed to any person, without corroborating or confirmatory tests.

No person who has obtained or has knowledge of a test result may disclose or be compelled to disclose the identity of any person upon whom a test is performed, or the results of the test in a manner which permits identification of the subject of the test, except to the persons subsection (5)(c) lists, which include the subject of the test, any person the subject designates in a legally effective release, health care personnel with a legitimate need to know, the Cabinet for Health and Family Services, and a person allowed access by a court order that meets the subsection's conditions.

No person to whom the results of a test have been disclosed under the court-order provision may disclose them to another person except as the subsection authorizes, and the disclosure must be accompanied by a written statement that state law prohibits further disclosure without the written consent of the person to whom the information pertains.

The result of a serologic test conducted under the auspices of the cabinet may not be used to determine if a person may be insured for disability, health, or life insurance or to screen or determine suitability for, or to discharge a person from, employment, and a person who violates that provision is guilty of a Class A misdemeanor. A violation of the section by a licensed health care provider is a ground for disciplinary action under the provider's licensing chapter.

Except as provided in subsection (6)(d) and KRS 304.12-013, insurers and others participating in activities related to the insurance application and underwriting process are exempt from the section. The section was created by chapter 443 of the 1990 Acts, effective July 13, 1990, and its current text is as amended by chapter 134 of the 2019 Acts, effective June 27, 2019.

In the case of benefits consisting of medical care provided under, offered by, or in connection with a group or individual health benefit plan, the plan or insurer may not deny, cancel, or refuse to renew the benefits or coverage, or vary the premiums, terms, or conditions, for any participant or beneficiary on the basis of a genetic test for which symptoms have not manifested, or on the basis that the participant or beneficiary has requested or received genetic services.

A group or individual health benefit plan, an insurer offering health insurance in connection with a health benefit plan, or an insurer offering a disability income plan may not request or require an applicant, participant, or beneficiary to disclose any genetic test.

A group or individual health benefit plan or an insurer offering health insurance in connection with a health benefit plan may not disclose any genetic test about a participant or beneficiary without the participant's prior authorization, and the authorization is required for each disclosure. The section was created in 1974 and was amended by chapter 496 of the 1998 Acts, effective April 10, 1998.

A controller must not collect automatic content recognition data without a consumer's consent. The duty was added to the statute by chapter 118 of the 2026 Kentucky Acts, effective July 1, 2027. Automatic content recognition data is data about a consumer's content viewing history collected through technology embedded or operated through a smart television or smart monitor that identifies in real time the specific content displayed by analyzing audio or video fingerprints.

KCDPA classifies genetic or biometric data processed to uniquely identify a person as sensitive data, requiring opt-in consent under KRS 367.3617.

"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; a photograph, video, or audio recording, or data generated from one, is excluded only until that data is generated to identify a specific individual or is health care information governed by Health Insurance Portability and Accountability Act (HIPAA), at which point the general exclusion lifts. A 2026 amendment effective July 1, 2027 leaves this definition's operative text unchanged.

The statute recognizes a patient's right of privacy in the content of a patient's record and communications between a patient and a health care provider with regard to mental health or chemical dependency.

An insurer may request the provider to furnish the insurer only such limited information concerning the patient from a patient's record as is necessary for determining covered services and benefits, medical necessity, appropriateness, and quality of care for authorization or continuation of mental health and chemical dependency health services, or for payment for those services.

No third party to whom disclosure of patient records is made by a provider may redisclose or otherwise reveal the mental health and chemical dependency records of a patient, beyond the purpose for which the disclosure was made, without first obtaining the patient's specific written consent to the redisclosure. The statute was created by chapter 496 of the 1998 Acts, effective April 10, 1998.

A cloud computing service provider, any person other than an educational institution that operates a service marketed and designed to give an educational institution serving students in kindergarten to grade twelve account-based access to online computing resources, may not process student data for any purpose other than providing, improving, developing, or maintaining the integrity of its cloud computing services, unless the provider receives express permission from the student's parent.

A provider may assist an educational institution to conduct educational research as the Family Educational Rights and Privacy Act of 1974 permits. A provider may not in any case process student data to advertise or facilitate advertising or to create or correct an individual or household profile for any advertisement purpose, and may not sell, disclose, or otherwise process student data for any commercial purpose.

A provider that enters into an agreement to provide cloud computing services to an educational institution must certify in writing to the institution that it will comply. The Kentucky Board of Education may promulgate administrative regulations to carry out the section. The section took effect on July 15, 2014.

Kentucky makes it unlawful to access, cause to be accessed, or attempt to access a computer, computer system, computer network, or any data or software on one, without the effective consent of the owner, and grades the offense in four degrees. Access made to defraud or to obtain money, property, or services is a Class C felony (first degree). Access without that purpose that causes loss or damage of $300 or more is a Class D felony (second degree).

Access causing loss or damage of less than $300 is a Class A misdemeanor (third degree). Access causing no loss or damage at all is still a Class B misdemeanor (fourth degree), so the statute does not require any resulting harm to establish criminal liability, only the absence of effective consent. Separately, knowingly receiving, concealing, or using data or property obtained through a first-degree violation is its own Class C felony (misuse of computer information).

Effective consent is defined at KRS 434.840 and is not effective when induced by deception or coercion or given by a person not authorized to act for the owner, so deceptively circumventing a login, paywall, or other access control falls within the statute regardless of which degree applies.

The statute's text does not expressly except ordinary, unauthenticated access to a publicly available page, and no Kentucky court decision construing the without-effective-consent standard as applied to automated collection of public web content has been located.

The Kentucky Consumer Data Protection Act (KCDPA), in force since January 1, 2026, defines personal data as information linked or reasonably linkable to an identified or identifiable natural person, and expressly excludes de-identified data and publicly available information from that definition.

Publicly available information means information lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it, unless the consumer has restricted it to a specific audience.

This places most scraped public personal data outside the KCDPA's coverage at the definitional level, the same approach Virginia's parallel statute takes.

The Act applies only to a person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that controls or processes the personal data of 100,000 or more consumers a year, or of 25,000 or more while deriving over half of gross revenue from selling personal data, and it expressly excludes a city, state agency, or other political subdivision.

The Act's consumer rights, controller and processor duties, and Attorney General enforcement are personal-data duties rather than scraping law.

Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is any person who is, or is required to be, licensed, authorized to operate, or registered under the insurance laws of Kentucky, other than a purchasing group or a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.

A licensee must implement, as appropriate, protection by encryption or other appropriate means of all nonpublic information while being transmitted over an external network and stored on a laptop computer or other portable computing or storage device or media. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.

A licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Each insurer domiciled in Kentucky must submit to the commissioner by February 15 of each year a written statement certifying that the insurer is in compliance with the section.

A licensee is deemed in compliance if it is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules, maintains nonpublic information in the same manner as protected health information, and submits to the commissioner an annual written statement certifying its compliance.

A licensee that is a financial institution subject to, governed by, and compliant with the privacy, security, and breach notification standards issued under the Gramm-Leach-Bliley Act is also deemed in compliance if it submits an annual written statement certifying its compliance and a copy of any breach notification at the same time and in the same manner as notifications provided to its federal regulatory authorities.

The commissioner may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the relevant provisions. The section took effect on January 1, 2023.

An agency or nonaffiliated third party that maintains or otherwise possesses personal information must implement, maintain, and update security procedures and practices, including taking any appropriate corrective action, to protect and safeguard against security breaches.

An agency is the executive branch of state government, every county, city, municipal corporation, urban-county government, charter county government, consolidated local government, and unified local government, every public school district, and every public institution of postsecondary education, together with the units and bodies of the first two groups.

Reasonable security and breach investigation procedures and practices are data security procedures and practices developed in good faith and set forth in a written security information policy. Procedures of executive branch organizational units must be in accordance with relevant enterprise policies established by the Commonwealth Office of Technology. Procedures of local governments must be in accordance with policies established by the Department for Local Government.

Procedures of public school districts must be in accordance with administrative regulations promulgated by the Kentucky Board of Education. Procedures of public postsecondary educational entities must be in accordance with policies established by the Council on Postsecondary Education.

An agency that discloses personal information to a nonaffiliated third party under an agreement executed or amended on or after January 1, 2015 must require the third party to implement, maintain, and update security and breach investigation procedures that are appropriate to the information and at least as stringent as the procedures and practices referenced in subsection (1)(b) of the section.

The legislative and judicial branches of state government must implement, maintain, and update reasonable security and breach investigation procedures and practices, including taking any appropriate corrective action, consistent with KRS 61.931 to 61.934. The sections took effect on January 1, 2015.

When a business disposes of, other than by storage, any customer's records that are not required to be retained, it must take reasonable steps to destroy, or arrange for the destruction of, the portion of the records containing personally identifiable information by shredding, erasing, or otherwise modifying the personal information to make it unreadable or indecipherable through any means.

A business is a sole proprietorship, partnership, corporation, limited liability company, association, or other entity, whether or not organized to operate at a profit, other than a bank, credit union, savings association, or association as the statute defines each by reference to federal banking law and Kentucky financial institutions law.

Any customer injured by a violation of KRS 365.725 may institute a civil action to recover damages, and a business that violates, proposes to violate, or has violated the section may be enjoined in a civil action. The section took effect on July 12, 2006.

An agency that collects, maintains, or stores personal information and determines or is notified of a security breach relating to that information must, as soon as possible but within seventy-two hours of the determination or notification, notify the commissioner of the Kentucky State Police, the Auditor of Public Accounts, and the Attorney General.

An agency must also notify the secretary of the Finance and Administration Cabinet if it is an executive branch unit, the commissioner of the Department for Local Government if it is a local government unit, the commissioner of the Kentucky Department of Education if it is a public school district, or the president of the Council on Postsecondary Education if it is a public postsecondary educational entity.

The notification must be in writing on a form developed by the Commonwealth Office of Technology. The agency must begin conducting a reasonable and prompt investigation to determine whether the security breach has resulted in or is likely to result in the misuse of the personal information.

If the agency determines that a security breach has occurred and that misuse of personal information has occurred or is reasonably likely to occur, it must within forty-eight hours of completing the investigation notify in writing all of those officers and the commissioner of the Department for Libraries and Archives, unless a law enforcement delay applies.

If the agency determines that misuse of personal information has not occurred and is not likely to occur, it is not required to give notice, but must keep records of the basis for its decision and notify the listed entities that misuse has not occurred.

A nonaffiliated third party that is provided access to personal information by an agency, or that collects and maintains personal information on behalf of an agency, must notify the agency in the most expedient time possible and without unreasonable delay but within seventy-two hours of determination of a security breach relating to the personal information in its possession.

Within thirty-five days of providing the officer notifications, an agency whose investigation finds likely misuse must also notify the individuals impacted by the breach, unless the delay provisions of subsection (3) apply. The section took effect on January 1, 2015.

Commercial entities that knowingly publish or distribute matter harmful to minors on a website containing a substantial portion of such material must perform reasonable age verification of Kentucky users.