{"data":{"id":"us-ky/krs-367.3615","jurisdiction":"us-ky","citation":"KRS 367.3615","heading":"Consumer rights request -- Controller compliance -- Requirements --","body":"Appeal process.\n(1) A consumer may invoke the consumer rights authorized pursuant to this section at\nany time by submitting a request to a controller, via the means sp ecified by the\ncontroller pursuant to KRS 367.3617, specifying the consumer rights the consumer\nwishes to invoke. A child's parent or legal guardian may invoke such consumer\nrights on behalf of the child regarding processing personal data belonging to the\nchild.\n(2) A controller shall comply with an authenticated consumer request to exercise the\nright to:\n(a) Confirm whether or not a controller is processing the consumer's personal\ndata and to access the personal data, unless the confirmation and access would\nrequire the controller to reveal a trade secret;\n(b) Correct inaccuracies in the consumer's personal data, taking into account the\nnature of the personal data and the purposes of processing the data;\n(c) Delete personal data provided by or obtained about the consumer;\n(d) Obtain a copy of the consumer's personal data that the consumer previously\nprovided to the controller in a portable and, to the extent technically\npracticable, readily usable format that allows the consumer to transmit the\ndata to anoth er controller without hindrance, where the processing is carried\nout by automated means. The controller shall not be required to reveal any\ntrade secrets; and\n(e) Opt out of the processing of personal data for purposes of targeted\nadvertising, the sale of personal data, or profiling in furtherance of decisions\nthat produce legal or similarly significant effects concerning the consumer.\n(3) Except as otherwise provided in KRS 367.3611 to 367.3629, a controller shall\ncomply with a request by a consumer to exe rcise the consumer rights pursuant to\nthis section as follows:\n(a) A controller shall respond to the consumer without undue delay, but in all\ncases within forty -five (45) days of receipt of the request submitted pursuant\nto the methods described in this section. The response period may be extended\nonce by forty-five (45) additional days when reasonably necessary, taking into\nconsideration the complexity and number of the consumer's requests, so long\nas the controller informs the consumer of any extension wi thin the initial\nforty-five (45) day response period, together with the reason for the extension;\n(b) If a controller declines to take action regarding the consumer's request, the\ncontroller shall inform the consumer without undue delay, but no later than\nforty-five (45) days after receipt of the request, of the justification for\ndeclining to take action and instructions on how to appeal the decision;\n(c) Information provided in response to a consumer request shall be provided by a\ncontroller free of charge, up to twice annually per consumer. If requests from\na consumer are excessive, repetitive, technically infeasible, or manifestly\nunfounded, the controller may charge the consumer a reasonable fee to cover\nthe administrative costs of complying with the request or decline to act on the\nrequest. The controller bears the burden of demonstrating the excessive,\nrepetitive, technically infeasible, or manifestly unfounded nature of the\nrequest;\n(d) If a controller is unable to authenticate the request using commercially\nreasonable efforts, the controller shall not be required to comply with a\nrequest to initiate an action under subsection (1) of this section and m ay\nrequest that the consumer provide additional information reasonably\nnecessary to authenticate the consumer and the consumer's request; and\n(e) A controller that has obtained personal data about a consumer from a source\nother than the consumer shall be d eemed in compliance with a consumer's\nrequest to delete such data pursuant to subsection (2)(c) of this section by:\n1. Retaining a record of the deletion request and the minimum data\nnecessary for the purpose of ensuring the consumer's personal data\nremains deleted from the business' records and not using the retained\ndata for any other purpose pursuant to the provisions of KRS 367.3611\nto 367.3629; or\n2. Opting the consumer out of the processing of the personal data for any\npurpose except for those exempted pursuant to KRS 367.3613.\n(4) A controller shall establish a process for a consumer to appeal the controller's\nrefusal to take action on a request within a reasonable period of time after the\nconsumer's receipt of the decision pursuant to subsection (3)( b) of this section. The\nappeal process shall be conspicuously available and similar to the process for\nsubmitting requests to initiate action pursuant to this section. Within sixty (60) days\nof receipt of an appeal, a controller shall inform the consumer i n writing of any\naction taken or not taken in response to the appeal, including a written explanation\nof the reasons for the decisions. If the appeal is denied, the controller shall also\nprovide the consumer with an online mechanism, if available, or other  method\nthrough which the consumer may contact the Attorney General to submit a\ncomplaint.","path":["KRS Chapter 367"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55838","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:59:03Z","sha256":"0fa4798f92c4fbf77dc5ed7236e59b152e4c992776a81a4e27e943c740eb0388","source_id":"us-ky","stale":false,"prev":"us-ky/krs-367.3613","next":"us-ky/krs-367.3617"},"notice":"GroundRules: Original legal text. Not legal advice."}