AN ACT relating to consumer data privacy.

Amend KRS 367.3613 to exempt information collected by a health care provider that maintains protected health information in accordance with HIPAA and information included in a limited data set as described in 45 C.F.R. sec.164.514(e); amend KRS 367.3621 to make a technical change to include a data protection impact assessment of processing of personal data for the purposes of profiling where the profiling presents a foreseeable risk of an unlawful disparate impact on consumers.

Data Processing Trade Practices and Retailing Consumer Affairs

Introduced: February 12, 2025

Last action: March 15, 2025

(Acts Ch. 13)

Read the full text Kentucky Legislature LegiScan

AI-generated — always verify with primary sources

Plain-language summary

Beta

This bill updates Kentucky's consumer data privacy law in two ways: it creates an exemption for certain health information already protected under the federal HIPAA law, and it requires businesses to conduct a safety review when processing personal data for profiling that could unfairly impact consumers. These changes adjust how existing privacy rules apply to health data and add a step to protect people from potentially discriminatory data profiling. Who it may affect: patients whose health information is held by providers, and consumers whose personal data may be used for profiling purposes.

Open official bill text (PDF)·Report a problem with the summary