On April 4, 2024, Governor Andy Beshear signed Kentucky's comprehensive privacy legislation into law, HB 15 (the Act), officially making Kentucky the 16th state in the country to join the race for privacy legislation. The law, which mirrors Virginia's comprehensive privacy law, will take effect on January 1, 2026.
The Act applies to entities that conduct business in Kentucky or produce products/services directed to Kentucky residents and that annually (1) control or process personal data of 100,000 consumers or, (2) control or process personal data of 25,000 consumers, if more than 50% of gross revenue is derived from the sale of personal data. In particular, there are exemptions for government entities, certain financial institutions, HIPAA covered entities and non-profit organizations, higher education institutions, to name a few.
Following in the footsteps of other states, the Act grants consumers the rights to access, delete, port, correct, and opt-out of targeted advertising, data sales, and profiling. It also required processors to obtain consent for the processing of sensitive personal data. Like Virginia, Kentucky requires Data Protection Impact Assessments (DPIA) for the processing of activities that involve targeted advertising, the sale of personal data, profiling in specific circumstances, processing of sensitive data or that would present greater risk to consumers. The Kentucky Attorney General is tasked with enforcing the law and controllers and processors have a 30-day cure period.
Kentucky's new law adds to the growing complexity of compliance with U.S. privacy laws. For more information about the Act or privacy laws generally, please contact John Landolfi, Chris Ingram, Chris LaRocco, Gretchen Rutz Leist, Nikkia Knudsen, or your Vorys attorney.
