Kentucky Legislature Passes Comprehensive Data Privacy Bill, H.B. 15: What You Need to Know

Kentucky Legislature Passes Comprehensive Data Privacy Bill, Governor Signs Into Law

In a significant move towards protecting consumer data privacy, the Kentucky legislature passed a comprehensive data privacy bill, H.B. 15, on March 27, 2024. The bill, which was delivered to Governor Andy Beshear for signature, aims to regulate the collection and processing of personal data by entities conducting business in Kentucky or targeting Kentucky residents.

If enacted, H.B. 15 will bring Kentucky in line with other states that have implemented comprehensive data privacy laws. The bill sets out clear guidelines for controllers regarding the collection, processing, and protection of personal data, as well as outlining consumer rights and enforcement mechanisms.

Under H.B. 15, controllers will be required to limit the collection of personal data to what is necessary for the disclosed purposes, implement data security practices, and obtain consumer consent for processing sensitive data. Controllers must also conduct data protection impact assessments for certain types of data processing and provide consumers with clear privacy notices.

Consumers will have the right to access, correct, and delete their personal data, as well as opt-out of certain types of data processing. Controllers will have 45 days to respond to consumer rights requests, with a possible 45-day extension if necessary.

Enforcement of the law will be overseen by Kentucky’s Attorney General, with a 30-day cure period for alleged violations. H.B. 15 does not include a private right of action, meaning that enforcement will be carried out exclusively by the state.

Governor Beshear signed H.B. 15 into law on April 4, 2024, making Kentucky the 16th state to enact a comprehensive data privacy law. The law is set to take effect on January 1, 2026, giving businesses time to prepare for compliance with the new regulations.