What does Kentucky's data breach law ask a business to do?

Who does this law apply to?

The law says an information holder, meaning any person or business entity that conducts business in Kentucky, must tell any Kentucky resident whose unencrypted personal information was, or is reasonably believed to have been, taken by an unauthorized person.

Any information holder shall disclose any breach of the security of the system, following discovery or notification of the breach in the security of the data, to any resident of Kentucky whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

"Information holder" means any person or business entity that conducts business in this state;

What counts as personal information?

Personally identifiable information is a first name or first initial and last name together with a Social Security number, a driver's licence number, or a financial account or card number with the code or password that opens the account.

"Personally identifiable information" means an individual's first name or first initial and last name in combination with any one (1) or more of the following data elements, when the name or data element is not redacted:

How fast must people be told?

The text sets no number of days. The disclosure must be made in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and the time needed to find the scope of the breach.

The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (4) of this section, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

Who else must be told?

When more than one thousand people must be notified at one time, the person must also tell the nationwide consumer reporting agencies and credit bureaus about the timing, distribution and content of the notices.

If a person discovers circumstances requiring notification pursuant to this section of more than one thousand (1,000) persons at one (1) time, the person shall also notify, without unreasonable delay, all consumer reporting agencies and credit bureaus that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. sec. 1681a, of the timing, distribution, and content of the notices.

Is encrypted information treated differently?

A breach under this law is the unauthorized acquisition of unencrypted and unredacted data that causes, or is reasonably believed to cause, identity theft or fraud against a Kentucky resident. Encrypted data falls outside that definition.

"Breach of the security of the system" means unauthorized acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of personally identifiable information maintained by the information holder as part of a database regarding multiple individuals that actually causes, or leads the information holder to reasonably believe has caused or will cause, identity theft or fraud against any resident of the Commonwealth of Kentucky.

What if a vendor holds the data?

An information holder that keeps personally identifiable information it does not own must tell the owner or licensee of a breach as soon as reasonably practicable after finding it.

Any information holder that maintains computerized data that includes personally identifiable information that the information holder does not own shall notify the owner or licensee of the information of any breach of the security of the data as soon as reasonably practicable following discovery, if the personally identifiable information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.