Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On March 27, the Kentucky Legislature sent House Bill 15 to Governor Andy Beshear for his signature and concurrence. Once HB 15 is enacted into law, Kentucky will join the growing number of states that have created comprehensive data privacy laws. HB 15 grants Kentucky residents a broad range of data protection rights and requires covered businesses to comply with new data privacy and information security requirements. While it imposes new compliance obligations on covered businesses, HB 15 notably does not create a private right of action. Rather, the law, which enters into force on January 1, 2026, assigns enforcement authority to the Kentucky attorney general.

contentpilot/introduction

core/heading

<a>HB 15</a> applies to organizations that conduct business in Kentucky or produce products or services targeted to Kentucky residents and during a calendar year <a>control or process the personal data </a>of at least 100,000 consumers or control or process the personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.

core/paragraph

<a>HB 15 </a>includes several exemptions that are standard in data privacy frameworks, including exemptions for state and local governments, organizations governed by federal law (e.g., HIPAA, GLBA), and certain nonprofit and educational institutions.

<a>HB 15 </a>primarily regulates how a data “controller,” which it defines as “the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal data,” can use and process a consumer’s personal data. The term “consumer” means a Kentucky resident acting only in an individual context and excludes individuals “acting in a commercial or employment context.” As in other state privacy laws, “personal data” is defined as “any information that is linked or reasonably linkable to an identified or identifiable natural person.” It does not, however, include within its scope either “de-identified data” or “publicly available information,” which each have their own unique definitions.

In addition, HB 15 creates additional requirements when an entity processes “sensitive data,” which is defined as a subset of personal data that includes any of the following:

core/list

As with other state privacy laws, HB 15 grants consumers the following data privacy rights:

The law emphasizes that with respect to both the Know and Access Right and the Data Portability Right, a controller is not required to respond to a request if doing so would cause it to reveal a trade secret. HB 15 creates a framework for how controllers must receive, authenticate, and respond to consumer data privacy requests. It also mandates that organizations establish a process to allow a consumer to appeal a controller’s denial of a request.

<a>In addition, HB 15 </a>grants consumers the right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

HB 15 takes a narrower view of the term “sale of personal data” than other privacy regulations, defining it as “the exchange of personal data for monetary consideration by the controller to a third party” and specifically exempting from its definition the disclosure of personal data to a processor that processes the personal data on behalf of the controller, to a third party for purposes of providing a product or service requested by the consumer, or to an affiliate of the controller. It also exempts the disclosure of information the consumer intentionally made available to the general public via a mass media channel and did not restrict to a specific audience. Certain corporate restructuring and bankruptcy-related transactions are also exempted from the definition.

The term “targeted advertising” means “displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict that consumer’s preferences or interests” and includes common exemptions related to online marketing.

HB 15 limits how a controller can use personal data without a consumer’s consent. For example, a controller is prohibited from processing a consumer’s sensitive data without obtaining the consumer’s consent. If processing sensitive data collected from a known child under 13 years of age, the controller must process the data in accordance with the Children’s Online Privacy Protection Act. Further, HB 15 provides that controllers cannot process personal data for “purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which the personal data is processed as disclosed to the consumer,” unless the controller obtains the consumer’s consent.

HB 15 also adopts more general restrictions, such as requiring controllers to limit the collection of personal data to “what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed as disclosed to the consumer.”

Like other privacy laws, HB 15 requires a controller to conduct and document a data processing assessment for its processing activities that involve targeted advertising, selling personal data, processing sensitive data, profiling that presents certain risks, and any processing activities that present a “heightened risk of harm to consumers.”

This data protection impact assessment must identify and “weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risk.” The law provides that the controller shall factor into this assessment the use of de-identified data, the reasonable expectations of consumers, the context of the processing of personal data, and the relationship between the controller and the consumer whose personal data will be processed. The assessment must be made available to the Kentucky attorney general upon request.

Controllers are required to provide consumers with “a reasonably accessible, clear, and meaningful privacy notice” that addresses:

If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose these activities, as well as the manner in which a consumer may exercise the right to opt out of processing.

HB 15 places affirmative data security obligations on controllers. Specifically, it requires them to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue.

Processor Obligations and Data Processing Agreements

HB 15 also places affirmative obligations on processors, such as those related to compliance with a controller’s instructions and assistance in responding to consumer rights requests. Moreover, the law requires processors to help meet a controller’s obligations related to the security of processing personal data and providing notification of a <a href="https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=43326" target="_blank" rel="noreferrer noopener">data breach</a> occurring within the processor’s system.

The law also requires controllers and processors to execute written agreements that contain certain data protection clauses, which must address, among other things, the nature and purpose of data processing, the duration of the processing, the types of data subject to processing, parties’ rights and obligations, confidentiality duties, compliance disclosures, and subprocessing.

The law emphasizes that “[d]etermining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data is to be processed” and a processor that adheres to a controller’s data processing instructions remains a processor.

<a></a><a>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</a>

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/04/Privacy-Cybersecurity-Update-Kentucky-Poised-to-Enact-Consumer-Data-Protection-Law.pdf

Kentucky Poised to Enact Consumer Data Protection Law

Services