{"data":{"id":"us-ky/krs-367.3611","jurisdiction":"us-ky","citation":"KRS 367.3611","heading":"Definitions for KRS 367.3611 to 367.3629.            (Effective until July 1,","body":"2027)\nAs used in KRS 367.3611 to 367.3629:\n(1) \"Affiliate\" means a legal entity that controls, is controlled by, or is under common\ncontrol with another legal entity o r shares common branding with another legal\nentity. For the purposes of this definition, \"control\" or \"controlled\" means:\n(a) Ownership of, or the power to vote, more than fifty percent (50%) of the\noutstanding shares of any class of voting security of a company;\n(b) Control in any manner over the election of a majority of the directors or of\nindividuals exercising similar functions; or\n(c) The power to exercise controlling influence over the management of a\ncompany;\n(2) \"Authenticate\" means verifying throu gh reasonable means that the consumer\nentitled to exercise his or her consumer rights in KRS 367.3615 is the same\nconsumer exercising such consumer rights with respect to the personal data at issue;\n(3) \"Biometric data\" means data generated by automatic me asurements of an\nindividual's biological characteristics, such as a fingerprint, voiceprint, eye retinas,\nirises, or other unique biological patterns or characteristics that are used to identify\na specific individual. Biometric data does not include a phys ical or digital\nphotograph, a video or audio recording, or data generated therefrom, unless that\ndata is generated to identify a specific individual or information collected, used, or\nstored for health care treatment, payment, or operations under HIPAA;\n(4) \"Business associate\" has the same meaning as established in 45 C.F.R. sec. 160.103\npursuant to HIPAA;\n(5) \"Child\" has the same meaning as in 15 U.S.C. sec. 6501;\n(6) \"Consent\" means a clear affirmative act signifying a consumer's freely given,\nspecific, informed, and unambiguous agreement to process personal data relating to\nthe consumer. Consent may include a written statement, written by electronic\nmeans or any other unambiguous affirmative action;\n(7) \"Consumer\" means a natural person who is a resident of the Commonwealth of\nKentucky acting only in an individual context. Consumer does not include a natural\nperson acting in a commercial or employment context;\n(8) \"Controller\" means the natural or legal person that, alone or jointly with others,\ndetermines the purpose and means of processing personal data;\n(9) \"Covered entity\" has the same meaning as established in 45 C.F.R. sec. 160.103\npursuant to HIPAA;\n(10) \"Decisions that produce legal or similarly significant effects concerning a\nconsumer\" means a decision made by a controller that results in the provision or\ndenial by the controller of financial and lending services, housing, insurance,\neducation enrollment, crimi nal justice, employment opportunities, health care\nservices, or access to basic necessities like food and water;\n(11) \"De-identified data\" means data that cannot reasonably be linked to an identified or\nidentifiable natural person or a device linked to a person;\n(12) \"Fund\" means the consumer privacy fund established in KRS 367.3629;\n(13) \"Health care provider\" means:\n(a) Any health facility as defined in KRS 216B.015;\n(b) Any person or entity providing health care or health services, including those\nlicensed, certified, or registered under, or subject to, KRS 194A.700 to\n194A.729 or KRS Chapter 310, 311, 311A, 311B, 312, 313, 314, 314A, 315,\n319, 319A, 319B, 319C, 320, 327, 333, 334A, or 335;\n(c) The current and former employers, officers, directors, admin istrators, agents,\nor employees of those entities listed in paragraphs (a) and (b) of this\nsubsection; or\n(d) Any person acting within the course and scope of his or her office,\nemployment, or agency relating to a health care provider;\n(14) \"Health record\" means a record, other than for financial or billing purposes, relating\nto an individual, kept by a health care provider as a result of the professional\nrelationship established between the health care provider and the individual;\n(15) \"HIPAA\" means the federal Health Insurance Portability and Accountability Act of\n1996, Pub. L. No. 104-191;\n(16) \"Identified or identifiable natural person\" means a person who can be readily\nidentified directly or indirectly;\n(17) \"Institution of higher education\" means an educational institution which:\n(a) Admits as regular students only individuals having a certificate of graduation\nfrom a high school or the recognized equivalent of such a certificate;\n(b) Is legally authorized in this state to provide a program of educatio n beyond\nhigh school;\n(c) Provides an educational program for which it awards a bachelor's or higher\ndegree, or provides a program which is acceptable for full credit toward such\na degree, a program of postgraduate or postdoctoral studies, or a program of\ntraining to prepare students for gainful employment in a recognized\noccupation; and\n(d) Is a public or other nonprofit institution;\n(18) \"Nonprofit organization\" means any incorporated or unincorporated entity that:\n(a) Is operating for religious, charitable, or educational purposes; and\n(b) Does not provide net earnings to, or operate in any manner that inures to the\nbenefit of, any officer, employee, or shareholder of the entity;\n(19) \"Personal data\" means any information that is linked or reasonably link able to an\nidentified or identifiable natural person. Personal data does not include de-identified\ndata or publicly available information;\n(20) \"Precise geolocation data\" means information derived from technology, including\nbut not limited to global positioning system level latitude and longitude coordinates\nor other mechanisms, that directly identifies the specific location of a natural person\nwith precision and accuracy within a radius of one thousand seven hundred fifty\n(1,750) feet. Precise geolocation data does not include the content of\ncommunications or any data generated by or connected to advanced utility metering\ninfrastructure systems or equipment for use by a utility;\n(21) \"Process\" or \"processing\" means any operation or set of operations perform ed,\nwhether by manual or automated means, on personal data or on sets of personal\ndata, including but not limited to the collection, use, storage, disclosure, analysis,\ndeletion, or modification of personal data;\n(22) \"Processor\" means a natural or legal entity that processes personal data on behalf of\na controller;\n(23) \"Profiling\" means any form of automated processing performed on personal data to\nevaluate, analyze, or predict personal aspects related to an identified or identifiable\nnatural person's eco nomic situation, health, personal preferences, interests,\nreliability, behavior, location, or movements;\n(24) \"Protected health information\" means the same as established in 45 C.F.R. sec.\n160.103 pursuant to HIPAA;\n(25) \"Pseudonymous data\" means personal data that cannot be attributed to a specific\nnatural person without the use of additional information, provide d that the\nadditional information is kept separately and is subject to appropriate technical and\norganizational measures to ensure that the personal data is not attributed to an\nidentified or identifiable natural person;\n(26) \"Publicly available information\" means information that is lawfully made available\nthrough federal, state, or local government records, or information that a business\nhas a reasonable basis to believe is lawfully made available to the general public\nthrough widely distributed media, by  the consumer, or by a person to whom the\nconsumer has disclosed the information, unless the consumer has restricted the\ninformation to a specific audience;\n(27) \"Sale of personal data\" means the exchange of personal data for monetary\nconsideration by the controller to a third party. Sale of personal data does not\ninclude:\n(a) The disclosure of personal data to a processor that processes the personal data\non behalf of the controller;\n(b) The disclosure of personal data to a third party for purposes of provi ding a\nproduct or service requested by the consumer;\n(c) The disclosure or transfer of personal data to an affiliate of the controller;\n(d) The disclosure of information that the consumer:\n1. Intentionally made available to the general public via a channel  of mass\nmedia; and\n2. Did not restrict to a specific audience; or\n(e) The disclosure or transfer of personal data to a third party as an asset that is\npart of a proposed or actual merger, acquisition, bankruptcy, or other\ntransaction in which the third pa rty assumes control of all or part of the\ncontroller's assets;\n(28) \"Sensitive data\" means a category of personal data that includes:\n(a) Personal data indicating racial or ethnic origin, religious beliefs, mental or\nphysical health diagnosis, sexual orien tation, or citizenship or immigration\nstatus;\n(b) The processing of genetic or biometric data that is processed for the purpose\nof uniquely identifying a specific natural person;\n(c) The personal data collected from a known child; or\n(d) Precise geolocation data;\n(29) \"State agency\" means all departments, offices, commissions, boards, institutions,\nand political and corporate bodies of the state, including the offices of the clerk of\nthe Supreme Court, clerks of the appellate courts, the several courts of the state, and\nthe legislature, its committees, or commissions;\n(30) \"Targeted advertising\" means displaying advertisements to a consumer where the\nadvertisement is selected based on personal data obtained or inferred from that\nconsumer's activities over ti me and across nonaffiliated websites or online\napplications to predict that consumer's preferences or interests. \"Targeted\nadvertising\" does not include:\n(a) Advertisements based on activities within a controller's own or affiliated\nwebsites or online applications;\n(b) Advertisements based on the context of a consumer's current search query,\nvisit to a website, or online application;\n(c) Advertisements directed to a consumer in response to the consumer's request\nfor information or feedback; or\n(d) Processing personal data solely for measuring or reporting advertising\nperformance, reach, or frequency;\n(31) \"Third party\" means a natural or legal person, public authority, agency, or body\nother than the consumer, controller, processor, or an affiliate of the pro cessor or the\ncontroller; and\n(32) \"Trade secret\" has the same meaning as in KRS 365.880.\nEffective: January 1, 2026","path":["KRS Chapter 367"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55836","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:59:03Z","sha256":"e1f470188ff70bc81bb26abdbd13a87f7473479794fca8e71cf9d16be8f9563b","source_id":"us-ky","stale":false,"prev":"us-ky/krs-367.361","next":"us-ky/krs-367.3613"},"notice":"GroundRules: Original legal text. Not legal advice."}