Kentucky 2023 Regular Session Status: Passed Senate

SB 15 — AN ACT relating to consumer data privacy.

Last action — returned to Committee on Committees (H)

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill died with 2023 Regular Session. It reached “Passed Senate” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.

This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.

Summary

Create new sections of KRS Chapter 367 to define terms; set the parameters for applicability of this Act; define various consumer rights related to data collection; require a data controller to comply with a consumer request to exercise those rights, including confirming whether or not a controller is processing the consumer's data and providing the consumer access to his or her data, deleting his or her personal data, providing a copy of the consumer's data that he or she previously provided in a portable and usable format, opting out of targeted advertising, opting out of tracking, and opting out of the sale or sharing of his or her personal data; require controllers to establish a process for consumers to appeal a controller's refusal to act on a consumer's request to exercise a right; set forth requirements for persons or entities that control or process personal data; require persons who control data to conduct data protection impact assessments; establish that the Attorney General has exclusive authority to enforce, with the exception of a private right of action by which consumers can seek injunctive relief for specific violations if the data controller or processor received an written notice of violation from the Attorney General and failed to cure the violation within 30 days; create a consumer privacy fund in the State Treasury to be administered by the Office of the Attorney General and direct that all civil penalties collected with regard to enforcement actions be deposited in the fund; set forth that this Act supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, charter county, urban-county government, consolidated local government, unified local government, or local agency regarding the processing of personal data; amend KRS 367.240 to conform; allow the Act to be cited as the Kentucky Consumer Protection Data Act; EFFECTIVE January 1, 2025.

Bill Text

What changed in the latest version

685 added · 772 removed

685 line(s) added, 772 removed.

→
Previous
Latest
UNOFFICIAL COPY 23 RS BR 2 AN ACT relating to consumer data privacy.
UNOFFICIAL COPY 23 RS SB 15/GA AN ACT relating to consumer data privacy.
As used in Sections 1 to 12 of this Act:
As used in Sections 1 to 11 of this Act:
Page 1 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 160.103 pursuant to the federal Health Insurance Portability and Accountability Act of 1996, Pub.
Page 1 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA 160.103 pursuant to the federal Health Insurance Portability and Accountability Act of 1996, Pub.
(11) "De-identified data" means data that cannot reasonably be used to infer information about, or otherwise be associated with, an identified or identifiable natural person, or a device linked to such person, provided that the controller that Page 2 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 possesses the data:
(11) "De-identified data" means data that cannot reasonably be used to infer information about, or otherwise be associated with, an identified or identifiable natural person, or a device linked to such person, provided that the controller that Page 2 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA possesses the data:
and (c) Contractually obligates any recipients of the de-identified data to comply with Sections 1 to 12 of this Act;
and (c) Contractually obligates any recipients of the de-identified data to comply with Sections 1 to 11 of this Act;
(12) "Fund" means the consumer privacy fund established in Section 11 of this Act;
(12) "Fund" means the consumer privacy fund established in Section 10 of this Act;
Page 3 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (16) "Identified or identifiable natural person" means a person who can be readily identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one (1) or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
Page 3 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA (16) "Identified or identifiable natural person" means a person who can be readily identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one (1) or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;
(20) "Precise geolocation data" means information derived from technology, Page 4 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of one thousand seven hundred fifty (1,750) feet, but does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility;
(20) "Precise geolocation data" means information derived from technology, Page 4 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of one thousand seven hundred fifty (1,750) feet, but does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility;
(26) "Publicly available information" means information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person Page 5 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience;
(26) "Publicly available information" means information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person Page 5 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience;
(b) Genetic or biometric data that is processed for the purpose of uniquely Page 6 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 identifying a specific natural person;
(b) Genetic or biometric data that is processed for the purpose of uniquely Page 6 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA identifying a specific natural person;
(31) "Targeted advertising" means displaying advertisements to a consumer where the Page 7 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 advertisement is selected based on personal data obtained from that consumer's activities over time and across one (1) or more distinctly branded websites or online applications to predict the consumer's preferences or interests.
(31) "Targeted advertising" means displaying advertisements to a consumer where the Page 7 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA advertisement is selected based on personal data obtained from that consumer's activities over time and across one (1) or more distinctly branded websites or online applications to predict the consumer's preferences or interests.
Page 8 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 and (b) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
Page 8 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA and (b) Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
(1) Sections 1 to 12 of this Act apply to persons that conduct business in this state or produce products or services that are targeted to residents of this state and that during a calendar year:
(1) Sections 1 to 11 of this Act apply to persons that conduct business in this state or produce products or services that are targeted to residents of this state and that during a calendar year:
(2) Sections 1 to 12 of this Act shall not apply to any:
(2) Sections 1 to 11 of this Act shall not apply to any:
Only make a request or demand for individualized data identifying individual consumers from any controller, processor, or other third party in possession of such data upon a showing of probable cause that the individual identified by the data has committed a criminal Page 9 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 offense;
Only make a request or demand for individualized data identifying individual consumers from any controller, processor, or other third party in possession of such data upon a showing of probable cause that the individual identified by the data has committed a criminal Page 9 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA offense or if a state agency has authority under state or federal law to request or share individualized data;
46, the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, or the United States Food and Drug Administration protection of Page 10 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 human subjects under 21 C.F.R.
46, the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Page 10 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA Use, or the United States Food and Drug Administration protection of human subjects under 21 C.F.R.
or (h) National securities association, registered under Section 15A of the Securities Exchange Act of 1934, 15 U.S.C.
(h) National securities association, registered under Section 15A of the Securities Exchange Act of 1934, 15 U.S.C.
78o-3, as amended, or regulations adopted thereunder.
78o-3, as amended, or regulations adopted thereunder;
(3) The following information and data are exempt from Sections 1 to 12 of this Act:
or (i) Small telephone utility as defined in KRS 278.516, a Tier III CMRS provider as defined in KRS 65.7621, or a municipally owned utility that does not sell or share personal data with any third-party processor.
(3) The following information and data are exempt from Sections 1 to 11 of this Act:
50 and 56, or personal data used or shared in research conducted in accordance with the requirements set forth in Sections 1 to 12 of this Act, or other research conducted in accordance with applicable law;
50 and 56, or personal data used or shared in research conducted in accordance with the requirements set forth in Sections 1 to 11 of this Act, or other research conducted in accordance with applicable law;
(g) Information derived from any of the health care-related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA;
(g) Information derived from any of the health care-related information listed in this subsection that is de-identified in accordance with the requirements Page 11 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA for de-identification pursuant to HIPAA;
(h) Information originating from, and intermingled to be indistinguishable from, or information treated in the same manner as information exempt under this subsection that is maintained by a covered entity or business Page 11 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 associate as defined by HIPAA or a program or a qualified service organization as defined by 42 C.F.R.
(h) Information originating from, and intermingled to be indistinguishable from, or information treated in the same manner as information exempt under this subsection that is maintained by a covered entity or business associate as defined by HIPAA or a program or a qualified service organization as defined by 42 C.F.R.
of this paragraph and used for the purposes of administering those benefits;
of this Page 12 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA paragraph and used for the purposes of administering those benefits;
In the course of an individual applying to, employed by, or acting as an agent of a controller, processor, or a third party, to the extent that Page 12 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 the data is collected and used within the context of that role;
In the course of an individual applying to, employed by, or acting as an agent of a controller, processor, or a third party, to the extent that the data is collected and used within the context of that role;
and (o) Data processed by a utility as defined by KRS 278.010(3).
(o) Data processed by a utility as defined by KRS 278.010(3);
and (p) Information held by a prescription drug monitoring program.
6501 et seq., shall be deemed compliant with any obligation to obtain parental consent under Sections 1 to 12 of this Act.
6501 et seq., shall be deemed compliant with any obligation to obtain parental consent under Sections 1 to 11 of this Act.
(c) Obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically practicable, readily usable format that allows the consumer to read or transmit the data to another controller without hindrance, where the processing is carried out by automated means;
(c) Obtain a copy of the consumer's personal data that the consumer previously Page 13 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA provided to the controller in a portable and, to the extent technically practicable, readily usable format that allows the consumer to read or transmit the data to another controller without hindrance, where the processing is carried out by automated means;
Page 13 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (e) Opt out of tracking;
(e) Opt out of tracking;
The response period may be extended once by fifteen (15) additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within the initial forty-five (45) day response period, together with the reason for the extension;
The response period may be extended once by fifteen (15) additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of any such extension within Page 14 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA the initial forty-five (45) day response period, together with the reason for the extension;
(b) If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but in all cases and at the latest within forty-five (45) days of receipt of the request, of the Page 14 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 justification for declining to take action;
(b) If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but in all cases and at the latest within forty-five (45) days of receipt of the request, of the justification for declining to take action;
(b) Ensure that the appeal process is conspicuously available and as easy to use as the process for submitting a request to exercise a right under this section;
(b) Ensure that the appeal process is conspicuously available and as easy to use Page 15 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA as the process for submitting a request to exercise a right under this section;
That period may be extended by sixty (60) additional days where reasonably necessary, taking into Page 15 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 account the complexity and number of the requests serving as the basis for the appeal.
That period may be extended by sixty (60) additional days where reasonably necessary, taking into account the complexity and number of the requests serving as the basis for the appeal.
(b) Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers.
Page 16 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA (b) Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers.
A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in Section 3 of this Act, including denying goods or services, charging different prices or rates for goods or services, or providing a Page 16 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 different level of quality of goods and services to the consumer.
A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in Section 3 of this Act, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to the consumer.
(c) Upon a request made by the Office of the Attorney General pursuant to any investigation or action taken under Section 9 of this Act, provide the Attorney General with the specific third parties, if any, with whom the controller shares or sells personal data relevant to the Attorney General's investigation or action, including:
(c) Upon a request made by the Office of the Attorney General pursuant to any investigation or action taken under Section 8 of this Act, provide the Attorney General with the specific third parties, if any, with whom the controller shares or sells personal data relevant to the Attorney General's investigation or action, including:
and (d) Provide a quarterly report to both the Attorney General and the Legislative Research Commission.
and (d) Provide an annual report to the Attorney General.
The number of identifiable consumers whose personal data the controller processed in the preceding quarter.
The number of identifiable consumers whose personal data the Page 17 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA controller processed in the preceding quarter.
Page 17 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (3) At or before the time that a controller collects personal data, the controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:
(3) At or before the time that a controller collects personal data, the controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:
Show all 139 changed rows (99 more)
Previous
Latest
(f) The name and contact information of the controller;
Page 18 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA (f) The name and contact information of the controller;
and (h) The estimated period of time for which the controller will retain the Page 18 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 consumer's personal data or, if this is not known, the criteria that the controller will use in determining that period of time.
and (h) The estimated period of time for which the controller will retain the consumer's personal data or, if this is not known, the criteria that the controller will use in determining that period of time.
and (c) Are understandable to the least sophisticated consumer.
(c) Are understandable to the least sophisticated consumer;
and (d) Provide an explanation of how the consumer's data will be used by the controller.
(a) The controller is able to demonstrate that all of the following apply:
(a) The controller is able to demonstrate that the consumer's personal data is being processed for:
The consumer has provided consent to process his or her personal data for one (1) or more specific purposes or, in the case of processing the personal data of a child, the parent or legal guardian of the child has provided such consent;
One (1) or more specific purposes;
2.
and 2.
The consumer is informed prior to providing consent under this subsection that he or she may withdraw such consent at any time and how such consent may be withdrawn;
The controller does not require the consumer to provide consent as a condition of using the controller's product or service, unless processing the consumer's personal data is required to provide the product or service to the consumer;
3.
Page 19 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA (b) The processing is necessary to perform a contract to which the consumer is a party or in order to take steps at the request of the consumer prior to entering into a contract;
The consent provided under this subsection is as easy for the consumer to withdraw as it is to give;
4.
The controller does not require the consumer to provide consent as a condition of using the controller's product or service, unless processing the consumer's personal data is required to provide the Page 19 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 product or service to the consumer;
and 5.
If the consumer grants consent as part of a written declaration that also concerns other matters, the request for consent is clearly distinguishable from the other matters in an intelligible and easily accessible form using clear and plain language;
(b) The processing is necessary to perform a contract to which the consumer is a party or in order to take steps at the request of the consumer prior to entering into a contract;
(9) Except as provided in Sections 1 to 12 of this Act, a controller shall collect and process personal data only for specified and legitimate purposes, and a controller may not further process personal data in a manner that is not reasonably Page 20 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 necessary to or compatible with those purposes, unless the controller obtains the consumer's consent and such consent meets the conditions set forth in subsection (6)(a) of this section.
(9) Except as provided in Sections 1 to 11 of this Act, a controller shall collect and process personal data only for specified and legitimate purposes, and a controller may not further process personal data in a manner that is not reasonably necessary to or compatible with those purposes, unless the controller obtains the consumer's consent and such consent meets the conditions set forth in subsection (6)(a) of this section.
(10) A controller shall not process personal data on the basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, family status, lawful source of income, or disability, in a manner that unlawfully discriminates against the consumer or class of consumers with respect to the offering or provision of:
(10) A controller shall not process personal data on the basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, religion, national Page 20 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA origin, sex, gender, gender identity, sexual orientation, family status, lawful source of income, or disability, in a manner that unlawfully discriminates against the consumer or class of consumers with respect to the offering or provision of:
Page 21 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (12) Except as otherwise provided in Sections 1 to 12 of this Act, a controller shall not process sensitive data concerning a consumer without obtaining the consumer's consent pursuant to subsection (6)(a) of this section or, in the case of the processing of sensitive data of a child, without obtaining consent from the child's parent or lawful guardian, in accordance with the requirements set forth in the federal Children's Online Privacy Protection Act, 15 U.S.C.
(12) Except as otherwise provided in Sections 1 to 11 of this Act, a controller shall not process sensitive data concerning a consumer without allowing the consumer to opt out pursuant to Sections 1 to 11 of this Act, or in the case of the processing of sensitive data of a child, without obtaining consent from the child's parent or lawful guardian, in accordance with the requirements set forth in the federal Page 21 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA Children's Online Privacy Protection Act, 15 U.S.C.
(13) Except as otherwise provided in Sections 1 to 12 of this Act, a controller shall not process the personal data of a child for the purposes of targeted advertising or tracking.
(13) Except as otherwise provided in Sections 1 to 11 of this Act, a controller shall not process the personal data of a child for the purposes of targeted advertising or tracking.
(14) Except as otherwise provided in Sections 1 to 12 of this Act, a controller shall not process the personal data of a consumer that is not a child and is younger than eighteen (18) years old for the purposes of targeted advertising or tracking or the sale or sharing of personal data without obtaining consent from such consumer pursuant to subsection (6)(a) of this section.
(14) Except as otherwise provided in Sections 1 to 11 of this Act, a controller shall not process the personal data of a consumer that is not a child and is younger than eighteen (18) years old for the purposes of targeted advertising or tracking or the sale or sharing of personal data without obtaining consent from such consumer pursuant to subsection (6)(a) of this section.
(1) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting its obligations under Sections 1 to 12 of this Act.
(1) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting its obligations under Sections 1 to 11 of this Act.
and (b) Assisting the controller in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system of the processor pursuant to KRS 365.732, or any other applicable state and federal law, in Page 22 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 order to meet the controller's obligations.
and (b) Assisting the controller in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system of the processor pursuant to KRS 365.732, or any other applicable state and federal law, in order to meet the controller's obligations.
The contract shall be binding and shall clearly set forth instructions for processing personal data, the nature and purpose of processing, the type of data subject to processing, the specific, fixed duration of processing for each type of data to be processed, and the rights and obligations of both parties.
The contract shall be binding and shall clearly set forth instructions for processing personal data, the nature and purpose of processing, the type of Page 22 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA data subject to processing, the specific, fixed duration of processing for each type of data to be processed, and the rights and obligations of both parties.
(1) Nothing in Sections 1 to 12 of this Act shall be construed to require a controller Page 23 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 or processor to:
(1) Nothing in Sections 1 to 11 of this Act shall be construed to require a controller or processor to:
(2) Nothing in Sections 1 to 12 of this Act shall be construed to require a controller or processor to comply with an authenticated consumer rights request, pursuant to Section 3 of this Act, if all of the following are true:
(2) Nothing in Sections 1 to 11 of this Act shall be construed to require a controller or processor to comply with an authenticated consumer rights request, pursuant Page 23 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA to Section 3 of this Act, if all of the following are true:
(1) Nothing in Sections 1 to 12 of this Act shall be construed to restrict a controller's or processor's ability to:
(1) Nothing in Sections 1 to 11 of this Act shall be construed to restrict a controller's or processor's ability to:
Page 24 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;
(c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;
(e) Provide a product or service specifically requested by a consumer or a parent or guardian of a child, perform a contract to which the consumer or parent or guardian of a child is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent or guardian of a child prior to entering into a contract;
(e) Provide a product or service specifically requested by a consumer or a Page 24 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA parent or guardian of a child, perform a contract to which the consumer or parent or guardian of a child is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent or guardian of a child prior to entering into a contract;
or (i) Assist another controller, processor, or third party with any of the Page 25 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 obligations under this subsection.
or (i) Assist another controller, processor, or third party with any of the obligations under this subsection.
(2) The obligations imposed on controllers or processors under Sections 1 to 12 of this Act shall not restrict a controller's or processor's ability to collect, use, or retain data to:
(2) The obligations imposed on controllers or processors under Sections 1 to 11 of this Act shall not restrict a controller's or processor's ability to collect, use, or retain data to:
(a) Conduct internal research to develop, improve, or repair products, services, or technology;
(a) Conduct internal research to develop, improve, or repair products, services, Page 25 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA or technology;
(3) The obligations imposed on controllers or processors under Sections 1 to 12 of this Act shall not apply where compliance by the controller or processor with Sections 1 to 12 of this Act would violate an evidentiary privilege under the laws of this Commonwealth.
(3) The obligations imposed on controllers or processors under Sections 1 to 11 of this Act shall not apply where compliance by the controller or processor with Sections 1 to 11 of this Act would violate an evidentiary privilege under the laws of this Commonwealth.
Nothing in Sections 1 to 12 of this Act shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this Commonwealth as part of a privileged communication.
Nothing in Sections 1 to 11 of this Act shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this Commonwealth as part of a privileged communication.
(4) Nothing in Sections 1 to 12 of this Act shall be construed as an obligation imposed on controllers and processors that:
(4) Nothing in Sections 1 to 11 of this Act shall be construed as an obligation imposed on controllers and processors that:
Page 26 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (a) Adversely affects the privacy or other rights or freedoms of any persons, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution;
(a) Adversely affects the privacy or other rights or freedoms of any persons, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution;
(5) Personal data processed by a controller pursuant to this section shall not be processed for any purpose other than those expressly listed in this section unless otherwise allowed by Sections 1 to 12 of this Act.
Page 26 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA (5) Personal data processed by a controller pursuant to this section shall not be processed for any purpose other than those expressly listed in this section unless otherwise allowed by Sections 1 to 11 of this Act.
(9) Nothing in Sections 1 to 12 of this Act shall require a controller, processor, third party, or consumer to disclose trade secrets.
(9) Nothing in Sections 1 to 11 of this Act shall require a controller, processor, third party, or consumer to disclose trade secrets.
Page 27 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 (10) A controller or processor that discloses personal data to a third party controller or processor, in compliance with the requirements of Sections 1 to 12 of Act, shall not be in violation of Sections 1 to 12 of this Act if the third party controller or processor that receives and processes such personal data is in violation of Sections 1 to 12 of this Act, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation.
(10) A controller or processor that discloses personal data to a third party controller or processor, in compliance with the requirements of Sections 1 to 11 of this Act, shall not be in violation of Sections 1 to 11 of this Act if the third party controller or processor that receives and processes such personal data is in violation of Sections 1 to 11 of this Act, provided that, at the time of disclosing the personal Page 27 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation.
(11) A third party controller or processor that receives personal data from a controller or processor, in compliance with the requirements of Sections 1 to 12 of this Act, is not in violation of Sections 1 to 12 of this Act if the controller or processor that discloses such personal data is in violation of Sections 1 to 12 of this Act, provided that, at the time of receiving the personal data, the receiving controller or processor did not have actual knowledge that the disclosing controller or processor intended to commit a violation.
(11) A third party controller or processor that receives personal data from a controller or processor, in compliance with the requirements of Sections 1 to 11 of this Act, is not in violation of Sections 1 to 11 of this Act if the controller or processor that discloses such personal data is in violation of Sections 1 to 11 of this Act, provided that, at the time of receiving the personal data, the receiving controller or processor did not have actual knowledge that the disclosing controller or processor intended to commit a violation.
(12) Nothing in Sections 1 to 12 of this Act shall be construed as requiring a controller or processor to identify de-identified data in response to a consumer request made under Section 3 of this Act.
(12) Nothing in Sections 1 to 11 of this Act shall be construed as requiring a controller or processor to identify de-identified data in response to a consumer request made under Section 3 of this Act.
(1) Within thirty (30) days of becoming a controller by beginning to process personal data, controllers shall conduct and document a data protection impact assessment of each of the following processing activities involving personal data:
(1) The Attorney General shall have exclusive authority to enforce the provisions of Sections 1 to 11 of this Act.
(a) The processing of personal data for the purposes of targeted advertising or tracking;
(2) The Attorney General may enforce Sections 1 to 11 of this Act by bringing an action in the name of the Commonwealth, or on behalf of persons residing in the Commonwealth.
(b) The processing of personal data for the purposes of selling or sharing the personal data;
The Attorney General may issue a civil investigative demand to any controller or processor believed to be engaged in, or about to engage in, any violation of Sections 1 to 11 of this Act.
(c) The processing of personal data for the purposes of profiling, where such Page 28 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 profiling presents a reasonably foreseeable risk of:
The provisions of KRS 367.240 shall apply to civil investigative demands issued under this section.
1.
(3) Prior to initiating any action under Sections 1 to 11 of this Act, the Attorney General shall provide a controller or processor thirty (30) days' written notice identifying the specific provisions of Sections 1 to 11 of this Act the Attorney General, on behalf of a consumer, alleges have been or are being violated.
Unfair or deceptive treatment of consumers or disparate impact on consumers;
If within the thirty (30) days the controller or processor cures the noticed violation Page 28 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action for damages shall be initiated against the controller or processor.
2.
(4) If a controller or processor does not cure a violation under subsection (3) of this section or violates Sections 1 to 11 of this Act in breach of an express written statement provided to the Attorney General under this section, the Attorney General may initiate an action and seek damages for up to seven thousand five hundred dollars ($7,500) for each violation under Sections 1 to 11 of this Act.
Financial, physical, or reputational injury to consumers;
(5) The Attorney General may recover reasonable expenses incurred in investigating and preparing the case, including attorneys’ fees, of any action initiated under Sections 1 to 11 of this Act.
3.
(6) In determining a civil penalty under this section, the court shall consider a controller’s or processor’s good-faith efforts to comply with the requirements of Sections 1 to 11 of this Act.
A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person;
(7) Proceeds from the civil penalties imposed under this section shall be deposited into the consumer privacy fund created in Section 10 of this Act.
or 4.
Any other substantial injury to consumers;
(d) The processing of sensitive data;
and (e) Any processing of personal data that presents a heightened risk of harm to consumers.
(2) Data protection impact assessments conducted under this section shall take into account the type of personal data to be processed by the controller, including the extent to which the personal data are sensitive data, and the context in which the processing is to occur.
(3) Data protection impact assessments conducted under this section shall identify and weigh the benefits that may flow directly and indirectly from the processing of personal data to the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risk.
The use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing of personal data and the relationship between the controller and the consumer whose personal data will be processed, shall be factored into this assessment by the controller.
(4) The Attorney General may request, in writing, that a controller disclose any data protection impact assessment that is relevant to an investigation conducted by the Attorney General, and the controller shall make the requested data protection Page 29 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 impact assessment available to the Attorney General upon such request.
The Attorney General may evaluate the data protection impact assessments for compliance with the requirements of Sections 1 to 12 of this Act.
(5) Data protection impact assessments are confidential and exempt from public inspection and copying under KRS 61.870 to 61.884.
(6) The disclosure of a data protection impact assessment pursuant to a request from the Attorney General under subsection (4) of this section does not constitute a waiver of the attorney-client privilege or work product protection with respect to the assessment and any information contained in the assessment, unless otherwise subject to case law regarding the applicability of the attorney-client privilege or work product protections.
(7) Data protection assessments conducted by a controller for the purpose of compliance with other laws or regulations may fulfill a controller's obligations under this section if they have a similar scope and effect.
(8) Data protection assessments conducted by a controller under this section shall be updated immediately upon any material change in the nature or volume of data controlled, processed, sold, traded, or shared by the controller or, if there is no material change, annually.
(1) Except as provided in Section 10 of this Act, the Attorney General shall have exclusive authority to enforce the provisions of Sections 1 to 12 of this Act.
(1) Except for those actions brought by the Attorney General to enforce Sections 1 to 11 of this Act, nothing in Sections 1 to 11 of this Act creates an independent cause of action.
(2) The Attorney General may enforce Sections 1 to 12 of this Act by bringing an action in the name of the Commonwealth, or on behalf of persons residing in the Commonwealth.
(2) No person, except for the Attorney General, may enforce the rights and protections created by Sections 1 to 11 of this Act in any action.
The Attorney General may issue a civil investigative demand to any controller or processor believed to be engaged in, or about to engage in, any violation of Sections 1 to 12 of this Act.
However, nothing in Sections 1 to 11 of this Act shall limit any other independent causes of action enjoyed by any person, including any constitutional, statutory, administrative, or common law rights or causes of action.
The provisions of KRS 367.240 shall Page 30 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 apply to civil investigative demands issued under this section.
The rights and protections in Sections 1 to 11 of this Act are not exclusive, and to the extent that Page 29 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA a person has the rights and protections in this chapter because of another law other than Sections 1 to 11 of this Act, the person continues to have those rights and protections notwithstanding the existence of Sections 1 to 11 of this Act.
(3) Prior to initiating any action under Sections 1 to 12 of this Act, the Attorney General shall provide a controller or processor thirty (30) days' written notice identifying the specific provisions of Sections 1 to 12 of this Act the Attorney General, on behalf of a consumer, alleges have been or are being violated.
If within the thirty (30) days the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured and that no further violations shall occur, no action for damages shall be initiated against the controller or processor.
(4) If a controller or processor does not cure a violation under subsection (3) of this section or violates Sections 1 to 12 of this Act in breach of an express written statement provided to the Attorney General under this section, the Attorney General may initiate an action and seek damages for up to seven thousand five hundred dollars ($7,500) for each violation under Sections 1 to 12 of this Act.
(5) The Attorney General may recover reasonable expenses incurred in investigating and preparing the case, including attorneys’ fees, of any action initiated under Sections 1 to 12 of this Act.
(6) In determining a civil penalty under this section, the court:
(a) Shall consider:
1.
A controller's or processor's good-faith efforts to comply with the requirements of Sections 1 to 12 of this Act;
and 2.
Whether a controller made willful or reckless omissions on the data protection impact assessment required by Section 8 of this Act, the nature of the omissions, and the nature and volume of data;
and (b) May, notwithstanding any other provision in this section, increase any penalty imposed by a percentage to be selected by the court if it is determined that the controller made willful or reckless omissions on the Page 31 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 data protection impact assessment required by Section 8 of this Act.
(7) Proceeds from the civil penalties imposed under this section shall be deposited into the consumer privacy fund created in Section 11 of this Act.
(1) Except as provided in subsection (3) of this section or for those actions brought by the Attorney General to enforce Sections 1 to 12 of this Act, nothing in Sections 1 to 12 of this Act creates an independent cause of action.
(2) Except as provided in subsection (3) of this section, no person, except for the Attorney General, may enforce the rights and protections created by Sections 1 to 12 of this Act in any action.
However, nothing in Sections 1 to 12 of this Act shall limit any other independent causes of action enjoyed by any person, including any constitutional, statutory, administrative, or common law rights or causes of action.
The rights and protections in Sections 1 to 12 of this Act are not exclusive, and to the extent that a person has the rights and protections in this chapter because of another law other than Sections 1 to 12 of this Act, the person continues to have those rights and protections notwithstanding the existence of Sections 1 to 12 of this Act.
(3) A consumer alleging a violation of any of the rights identified in subsection (2) of Section 3 of this Act may bring a civil action in any court of competent jurisdiction against any controller or processor that received a written notice of violation from the Attorney General and failed to cure the violation within thirty (30) days as provided in Section 9 of this Act.
Remedies shall be limited to appropriate injunctive relief and shall not include economic, noneconomic, or punitive damages.
The court shall also award reasonable attorneys' fees and costs to any prevailing party.
SECTION 11.
A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO Page 32 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 READ AS FOLLOWS:
All civil penalties collected under Section 9 of this Act shall be deposited into the fund.
All civil penalties collected under Section 8 of this Act shall be deposited into the fund.
Moneys in the fund shall be used by the Office of the Attorney General to enforce the provisions of Sections 1 to 12 of this Act.
Moneys in the fund shall be used by the Office of the Attorney General to enforce the provisions of Sections 1 to 11 of this Act.
Notwithstanding KRS 45.229, any moneys remaining in the fund at the close of the fiscal year shall not lapse but shall be carried forward into the succeeding fiscal year to be used by the Office of the Attorney General for the purposes set forth in Sections 1 to 12 of this Act.
Notwithstanding KRS 45.229, any moneys remaining in the fund at the close of the fiscal year shall not lapse but shall be carried forward into the succeeding fiscal year to be used by the Office of the Attorney General for the purposes set forth in Sections 1 to 11 of this Act.
SECTION 12.
SECTION 11.
(1) Sections 1 to 12 of this Act is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, charter county, urban-county government, consolidated local government, unified local government, municipality, or local agency regarding the processing of personal data by controllers or processors.
(1) Sections 1 to 11 of this Act is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, charter county, urban-county government, consolidated local government, unified local government, municipality, or local agency regarding the processing of personal data by controllers or processors.
(2) Any reference to federal, state, or local law or statute in Sections 1 to 12 of this Act shall be deemed to include any accompanying rules or regulations or exemptions thereto.
(2) Any reference to federal, state, or local law or statute in Sections 1 to 11 of this Act shall be deemed to include any accompanying rules or regulations or exemptions thereto.
Section 13.
Section 12.
(1) When the Attorney General has reason to believe that a person has engaged in, is engaging in, or is about to engage in any act or practice declared to be unlawful by KRS 367.110 to 367.300 or Sections 1 to 12 of this Act, or when he or she believes it to be in the public interest that an investigation should be made to ascertain whether a person in fact has engaged in, is engaging in or is about to engage in, any act or practice declared to be unlawful by KRS 367.110 to 367.300 or Sections 1 to Page 33 of 34 XXXX 12/21/2022 11:23 AM Jacketed UNOFFICIAL COPY 23 RS BR 2 12 of this Act, he or she may execute in writing and cause to be served upon any person who is believed to have information, documentary material or physical evidence relevant to the alleged or suspected violation, an investigative demand requiring such person to furnish, under oath or otherwise, a report in writing setting forth the relevant facts and circumstances of which he or she has knowledge, or to appear and testify or to produce relevant documentary material or physical evidence for examination, at such reasonable time and place as may be stated in the investigative demand, concerning the advertisement, sale or offering for sale of any goods or services or the conduct of any trade or commerce that is the subject matter of the investigation.
(1) When the Attorney General has reason to believe that a person has engaged in, is engaging in, or is about to engage in any act or practice declared to be unlawful by Page 30 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA UNOFFICIAL COPY 23 RS SB 15/GA KRS 367.110 to 367.300 or Sections 1 to 11 of this Act, or when he or she believes it to be in the public interest that an investigation should be made to ascertain whether a person in fact has engaged in, is engaging in or is about to engage in, any act or practice declared to be unlawful by KRS 367.110 to 367.300 or Sections 1 to 11 of this Act, he or she may execute in writing and cause to be served upon any person who is believed to have information, documentary material or physical evidence relevant to the alleged or suspected violation, an investigative demand requiring such person to furnish, under oath or otherwise, a report in writing setting forth the relevant facts and circumstances of which he or she has knowledge, or to appear and testify or to produce relevant documentary material or physical evidence for examination, at such reasonable time and place as may be stated in the investigative demand, concerning the advertisement, sale or offering for sale of any goods or services or the conduct of any trade or commerce that is the subject matter of the investigation.
Section 14.
Section 13.
Section 15.
Section 14.
Page 34 of 34 XXXX 12/21/2022 11:23 AM Jacketed
Page 31 of 31 SB001510.100 - 2 - XXXX 3/15/2023 6:00 PM GA
⬇ Download PDF
View plain text versions (2)

Action History

  1. returned to Committee on Committees (H)

  2. 1st reading

  3. taken from Committee on Committees (H)

  4. to Committee on Committees (H)

  5. received in House

  6. passed 32 -2 with Committee Substitute (1) and Floor Amendment (3)

  7. floor amendments (1) and (2) withdrawn

  8. 3rd reading

  9. posted for passage in the Regular Orders of the Day for Wednesday, March 15, 2023

  10. floor amendment (3) filed to Committee Substitute

  11. floor amendment (1) filed to Committee Substitute, floor amendment (2) filed to bill

  12. 2nd reading, to Rules

  13. reported favorably, 1st reading, to Calendar with Committee Substitute (1)

  14. to Economic Development, Tourism, & Labor (S)

  15. to Committee on Committees (S)

  16. introduced in Senate

Sponsorship breakdown

Export CSV (upgrade) →

0 sponsors · 0 co-sponsors · 138 not signed on · 1 voted No

Sponsors (0)

None.

Co-sponsors (0)

None.

Not signed on (138)

138 members have not signed on to this bill.

Show all 138 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Votes

PASS SB 15 W/ scs1 sfa3

Passed 32 Yea · 2 Nay · 3 Other
Party YeaNayPresentNot Voting
Democrat 2000
Republican 17103
Unaffiliated 13100
Total 32203
% of votes cast 86%5%0%8%
How each member voted (37)
Member Party Vote
Nemes — Yea
Schickel — Yea
Westerfield — Yea
Smith — Yea
ChambersArmstrong — Yea
Southworth — Yea
Williams — Yea
Thomas — Yea
Wilson — Yea
Meredith — Yea
Turner — Yea
Yates — Yea
Thayer — Nay
Harper Angel — Yea
Gerald A. Neal Democrat Yea
Karen Berg Democrat Yea
Amanda Mays Bledsoe Republican Yea
Brandon J. Storm Republican Nay
Christian McDaniel Republican Yea
Danny Carroll Republican Yea
David P. Givens Republican Yea
Donald Douglas Republican Yea
Gary Boswell Republican Yea
Jared Carpenter Republican Yea
Jason Howell Republican Yea
Jimmy Higdon Republican Not Voting
Julie Raque Adams Republican Not Voting
Lindsey Tichenor Republican Yea
Matthew Deneen Republican Yea
Max Wise Republican Yea
Phillip Wheeler Republican Yea
Rick Girdler Republican Yea
Robby Mills Republican Yea
Robert Stivers Republican Not Voting
Robin L. Webb Republican Yea
Shelley Funke Frommeyer Republican Yea
Stephen West Republican Yea

Official roll call →

Subjects

civil-rights technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

What does SB 15 do?
Create new sections of KRS Chapter 367 to define terms; set the parameters for applicability of this Act; define various consumer rights related to data collection; require a data controller to comply with a consumer request to exercise those rights, including confirming whether or not a controller is processing the consumer's data and providing the consumer access to his or her data, deleting his or her personal data, providing a copy of the consumer's data that he or she previously provided in a portable and usable format, opting out of targeted advertising, opting out of tracking, and opting out of the sale or sharing of his or her personal data; require controllers to establish a process for consumers to appeal a controller's refusal to act on a consumer's request to exercise a right; set forth requirements for persons or entities that control or process personal data; require persons who control data to conduct data protection impact assessments; establish that the Attorney General has exclusive authority to enforce, with the exception of a private right of action by which consumers can seek injunctive relief for specific violations if the data controller or processor received an written notice of violation from the Attorney General and failed to cure the violation within 30 days; create a consumer privacy fund in the State Treasury to be administered by the Office of the Attorney General and direct that all civil penalties collected with regard to enforcement actions be deposited in the fund; set forth that this Act supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, charter county, urban-county government, consolidated local government, unified local government, or local agency regarding the processing of personal data; amend KRS 367.240 to conform; allow the Act to be cited as the Kentucky Consumer Protection Data Act; EFFECTIVE January 1, 2025.
What is the current status of SB 15?
This bill died with 2023 Regular Session. It reached “Passed Senate” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
Where can I track SB 15?
Track SB 15 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 15

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 15

Last checked for changes 2 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →