{"data":{"id":"us-ky/krs-367.3613","jurisdiction":"us-ky","citation":"KRS 367.3613","heading":"Application -- Limitations -- Information and data exemptions --","body":"Compliance with federal children's online privacy laws.\n(1) KRS 367.3611 to 367.3629 apply to persons that conduct business in the\nCommonwealth or produce products or  services that are targeted to residents of the\nCommonwealth and that during a calendar year control or process personal data of\nat least:\n(a) One hundred thousand (100,000) consumers; or\n(b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%)\nof gross revenue from the sale of personal data.\n(2) KRS 367.3611 to 367.3629 shall not apply to any:\n(a) City, state agency, or any political subdivision of the state;\n(b) Financial institutions, their affiliates, or data subject to Title V of  the federal\nGramm-Leach-Bliley Act, 15 U.S.C. sec. 6801 et seq.;\n(c) Covered entity or business associate governed by the privacy, security, and\nbreach notification rules issued by the United States Department of Health\nand Human Services, 45 C.F.R. pts. 160 and 164 established pursuant to\nHIPAA;\n(d) Nonprofit organization;\n(e) Institution of higher education;\n(f) Organization that:\n1. Does not provide net earnings to, or operate in any manner that inures to\nthe benefit of, any officer, employee, or shareholder of the entity; and\n2. Is an entity such as those recognized under KRS 304.47 -060(1)(e), so\nlong as the entity collects, processe s, uses, or shares data solely in\nrelation to identifying, investigating, or assisting:\na. Law enforcement agencies in connection with suspected\ninsurance-related criminal or fraudulent acts; or\nb. First responders in connection with catastrophic events; or\n(g) Small telephone utility as defined in KRS 278.516, a Tier III CMRS provider\nas defined in KRS 65.7621, or a municipally owned utility that does not sell\nor share personal data with any third-party.\n(3) The following information and data are exempt from KRS 367.3611 to 367.3629:\n(a) Protected health information under HIPAA;\n(b) Health records;\n(c) Patient identifying information for purposes of 42 C.F.R. sec. 2.11;\n(d) Identifiable private information for purposes of the federal policy for the\nprotection of human subjects under 45 C.F.R. pt. 46; identifiable private\ninformation that is otherwise information collected as part of human subjects\nresearch pursuant to the good clinical practice guidelines issued by the\nInternational Council for Harmonisation  of Technical Requirements for\nPharmaceuticals for Human Use; the protection of human subjects under 21\nC.F.R. pts. 50 and 56; or personal data used or shared in research conducted in\naccordance with the requirements set forth in KRS 367.3611 to 367.3629, or\nother research conducted in accordance with applicable law;\n(e) Information and documents created for purposes of the federal Health Care\nQuality Improvement Act of 1986, 42 U.S.C. sec. 11101 et seq.;\n(f) Patient safety work product for purposes of the federal Patient Safety and\nQuality Improvement Act, 42 U.S.C. sec. 299b-21 et seq.;\n(g) Information derived from any of the health care -related information listed in\nthis subsection that is de -identified in accordance with the requirements for\nde-identification pursuant to HIPAA;\n(h) Information originating from, and intermingled to be indistinguishable from,\nor information treated in the same manner as information exempt under this\nsubsection that is maintained by a covered entity or business associate, or  a\nprogram or qualified service organization as defined by 42 C.F.R. sec. 2.11;\n(i) Information collected by a health care provider who is a covered entity that\nmaintains protected health information in accordance with HIPAA and related\nregulations, 45 C.F.R. sec. pts. 160, 162, and 164;\n(j) Information included in a limited data set as described in 45 C.F.R. sec.\n164.514(e), to the extent the information is used, disclosed, and maintained as\nspecified in 45 C.F.R. sec. 164.514(e);\n(k) Information used only  for public health activities and purposes as authorized\nby HIPAA;\n(l) The collection, maintenance, disclosure, sale, communication, or use of any\npersonal information bearing on a consumer's creditworthiness, credit\nstanding, credit capacity, character, g eneral reputation, personal\ncharacteristics, or mode of living by a consumer reporting agency, furnisher,\nor user that provides information for use in a consumer report, and by a user\nof a consumer report, but only to the extent that such activity is regul ated by\nand authorized under the federal Fair Credit Reporting Act, 15 U.S.C. sec.\n1681 et seq.;\n(m) Personal data collected, processed, sold, or disclosed in compliance with the\nfederal Driver's Privacy Protection Act of 1994, 18 U.S.C. sec. 2721 et seq.;\n(n) Personal data regulated by the federal Family Educational Rights and Privacy\nAct, 20 U.S.C. sec. 1232g et seq.;\n(o) Personal data collected, processed, sold, or disclosed in compliance with the\nfederal Farm Credit Act, 12 U.S.C. sec. 2001 et seq.;\n(p) Data processed or maintained:\n1. In the course of an individual applying to, employed by, or acting as an\nagent or independent contractor of a controller, processor, or third party,\nto the extent that the data is collected and used within the context of t hat\nrole;\n2. As the emergency contact information of an individual used for\nemergency contact purposes; or\n3. That is necessary to retain to administer benefits for another individual\nrelating to the individual under subparagraph 1. of this paragraph and\nused for the purposes of administering those benefits;\n(q) Data processed by a utility, an affiliate of a utility, or a holding company\nsystem organized specifically for the purpose of providing goods or services\nto a utility as defined in KRS 278.010. For  purposes of this paragraph,\n\"holding company system\" means two (2) or more affiliated persons, one (1)\nor more of which is a utility; and\n(r) Personal data collected and used for purposes of federal policy under the\nCombat Methamphetamine Epidemic Act of 2005.\n(4) Controllers and processors that comply with the verifiable parental consent\nrequirements of the Children's Online Privacy Protection Act, 15 U.S.C. sec. 6501\net seq., sh all be deemed compliant with any obligation to obtain parental consent\nunder KRS 367.3611 to 367.3629.","path":["KRS Chapter 367"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:59:03Z","sha256":"e7849bd05fdefea2c172ad48952d73df02faada714be3a532f5d18ca1ea0a95b","source_id":"us-ky","stale":false,"prev":"us-ky/krs-367.3611","next":"us-ky/krs-367.3615"},"notice":"GroundRules: Original legal text. Not legal advice."}