UNOFFICIAL COPY 1 2 19 RS BR 821 AN ACT relating to personal information. Be it enacted by the General Assembly of the Commonwealth of Kentucky: SECTION 1. 3 A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO 4 READ AS FOLLOWS: 5 For purposes of Sections 1 to 7 of this Act, the following definitions shall apply: 6 (1) 7 8 "Biometric identification information" means any record of friction ridge detail of fingerprints, palm prints, or footprints; (2) "Commercial activity" means the permissible uses set forth in the federal 9 Driver’s Privacy Protection Act of 1994, 18 U.S.C. secs. 2721 et seq.; the Fair 10 Credit Reporting Act, 15 U.S.C. secs. 1681 et seq.; or the Financial Services 11 Modernization Act of 1999, 15 U.S.C. secs. 6801 et seq., or verification of the 12 accuracy of personal information received by a commercial entity in the normal 13 course of its business, including identification or prevention of fraud or 14 matching, verifying, or retrieving information. It does not include the display or 15 bulk sale of Social Security numbers to the public or the distribution of these 16 numbers to any customer that is not identifiable by the commercial entity; 17 (3) "Commercial entity" means any corporation, partnership, limited partnership, 18 proprietorship, sole proprietorship, firm, enterprise, franchise, or association that 19 performs a commercial activity in this state; 20 (4) "Government-sponsored recreation program" means a program for which an 21 agency assumes responsibility for a child participating in that program, including 22 but not limited to after-school programs, athletic programs, nature programs, 23 summer camps, or other recreational programs; 24 (5) "Identification and location information" means the home address, telephone 25 number, and date of birth of persons listed in subsection (2) of Section 2 of this 26 Act; 27 (6) "Public agency" means a state, county, district, authority, or municipal officer, Page 1 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 or department, division, board, bureau, commission, or other separate unit of 2 government created or established by law; 3 (7) "Public records" means all documents, papers, letters, maps, books, tapes, 4 photographs, films, sound recordings, data processing software, or other 5 material, regardless of the physical form, characteristics, or means of 6 transmission, made or received pursuant to law or ordinance or in connection 7 with the transaction of official business by any agency; 8 (8) 9 conceal from an electronic image that is available for public viewing, that portion 10 11 "Redact" means to conceal from a copy of an original public record, or to of the record containing exempt or confidential information; and (9) "Third-party contractor" means an individual, partnership, corporation, or 12 business entity that enters into a contract for services with a public agency and is 13 acting on behalf of a public agency. 14 SECTION 2. 15 READ AS FOLLOWS: 16 (1) A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO The following personal information related to any of the persons provided for in 17 subsection (2) of this section shall be protected from disclosure by a public 18 agency or third party contractor by Sections 1 to 7 of this Act through redaction 19 or other means. This information includes the person's: 20 (a) Home address; 21 (b) Identity of immediate family members or dependents; 22 (c) Legal name of the person's parents or legal guardian; 23 (d) Telephone numbers including home telephone numbers, personal cellular 24 telephone numbers, personal pager telephone numbers, and telephone 25 numbers associated with personal communications devices; 26 (e) Bank accounts, health savings accounts, retirement account information; 27 (f) Social Security number; Page 2 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 (g) Residential address information; 2 (h) Driver's license information unless driving is part of the job description; 3 (i) Day, month, and year of birth; 4 (j) Financial information; 5 (k) Insurance and medical information; 6 (l) Personal e-mail address; 7 (m) Personal photographs not publicly released by the person on social media; 8 (n) Public utility account information; 9 (o) Any publicly available information through the county clerk’s office, to 10 include any permits, liens, filings; 11 (p) 12 Passwords for public employees, teachers and sworn law enforcement officers; 13 (q) 14 Any information related to promotion, appraisal, and employee discipline records; 15 (r) Social Security number except as provided in subsection (2) of this section. 16 (s) Any information the disclosure of which would constitute an unwarranted 17 invasion of personal privacy; and 18 (t) Any of the information in this subsection related to the immediate family or 19 household members and their emergency contact information of any of the 20 persons listed in subsection (2) of this section; 21 (2) 22 Persons covered under Sections 1 to 7 of this Act shall include: (a) Sworn public peace officers, including any officer who derives plenary or 23 special law enforcement powers from, and who is a full-time employee of, 24 the federal government, the Commonwealth, or any political subdivision, 25 agency, department, branch, or service of either, or of any municipality; 26 (b) 27 Public safety officers, including any individual who is an employee of a public agency and who is certified as a first responder under KRS Chapter Page 3 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 311A or whose employment duties include law enforcement or firefighting 2 activities; 3 (c) 4 Judges including any judge elected or appointed to the Supreme Court, District Court or Circuit Court or the Kentucky Labor cabinet; 5 (d) Personnel of the Cabinet for Health and Family Services whose duties 6 include the investigation of abuse, neglect, exploitation, fraud, theft, or 7 other criminal activities; 8 (e) 9 Personnel of the Department of Health whose duties are to support the investigation of child abuse or neglect; 10 (f) Personnel of the Department of Financial Institutions whose duties include 11 the investigation of fraud, theft, workers’ compensation coverage 12 requirements and compliance, other related criminal activities, or state 13 regulatory requirement violations; 14 (g) 15 Personnel of the Department of Revenue whose responsibilities include revenue collection and enforcement; 16 (h) Current or former United States or Commonwealth attorneys, assistant 17 United States or Commonwealth attorneys, statewide prosecutors, or 18 assistant statewide prosecutors, or guardians ad litem; 19 (i) Corrections officers including persons employed by the Department of 20 Corrections and Bureau of Prisons, correctional and correctional probation 21 and parole officers, juvenile probation officers, and juvenile detention 22 officers; and 23 24 (j) (3) Persons employed at emergency call centers in the state of Kentucky. Medical information pertaining to a prospective, current, or former position of a 25 person or employee listed in subsection (2) of this section which, if disclosed, 26 would identify that person or employee shall be exempt from release by a public 27 agency or third party contractor under Sections 1 to 7 of this Act. However, this Page 4 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 information may be disclosed if the person to whom the information pertains or 2 the person’s legal representative provides written permission or pursuant to court 3 order. 4 (4) Personal identifying information of a dependent child of a current or former 5 officer or employee of a person listed under subsection (2) of this section of this 6 Act shall be exempt from release by a public agency or third party contractor 7 pursuant to Sections 1 to 7 of this Act. 8 (5) Medical history records and information related to health or property insurance 9 provided to a public agency or third party contractor of a person listed under 10 subsection (2) of this section shall be exempt from release. However, this 11 information may be disclosed if the person to whom the information pertains or 12 the person’s legal representative provides written permission, or pursuant to 13 court order. Governmental entities or their agents shall have access to such 14 confidential and exempt records and information for the purpose of auditing 15 federal, state, or local housing programs or housing assistance programs. These 16 confidential and exempt records and information may be used in any 17 administrative or judicial proceeding, if the records are kept confidential and 18 exempt unless otherwise ordered by a court. 19 (6) Any information revealing undercover personnel of any criminal justice agency 20 operating within the state of Kentucky is exempt from release by a public agency 21 or third party contractor pursuant to Sections 1 to 7 of this Act. 22 (7) Information that would identify or locate a child, or the parent or guardian of a 23 child of any of the persons listed in subsection (2) of this section who participates 24 in a government-sponsored recreation program is exempt from release by a 25 public agency or third party contractor pursuant to Sections 1 to 7 of this Act. 26 (8) 27 Information that would identify the name and location of a school or place of employment of a spouse of a person listed in subsection (2) of this section or Page 5 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 information that would identify the name and location of a school or a daycare 2 facility attended by a dependent of a person listed in subsection (2) of this section 3 shall be exempt from release by a public agency or third party contractor 4 pursuant to Sections 1 to 7 of this Act. 5 (9) Biometric identification of any of the persons listed in subsection (2) of this 6 section is exempt from release by a public agency or third party contractor 7 pursuant to Sections 1 to 7 of this Act. 8 (10) The personal identifying information of an applicant for or a recipient of 9 paratransit services for any of the persons listed in subsection (2) of this section is 10 exempt from release by a public agency or third party contractor. This provision 11 applies to personal identifying information of an applicant for or a recipient of 12 paratransit services which is held by an agency before, on, or after the effective 13 date of Sections 1 to 7 of this Act and who is a person listed in subsection (2) of 14 this section. 15 (11) Confidential and exempt personal identifying information as provided in this 16 section may only be disclosed: 17 (a) 18 With the express written consent of the person or recipient or the legally authorized representative of the applicant or recipient; 19 (b) 20 In a medical emergency, but only to the extent that is necessary to protect the health or life of the applicant or recipient; 21 (c) By court order upon a showing of good cause; or 22 (d) To another agency in the performance of its duties and responsibilities. 23 (12) Identification and location information held by a public agency or third party 24 contractor of a person listed in subsection (2) of this section is exempt from 25 release under Sections 1 to 7 of this Act unless requested by an attorney, judge, or 26 magistrate who submits to an agency that has custody of the identification and 27 location information: Page 6 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 (a) A written request to exempt the information from public disclosure; and 2 (b) A written statement that he or she has made reasonable efforts to protect the 3 identification and location information requested from being accessible 4 through other means available to the public. 5 (13) Any information furnished by a person listed in subsection (2) of this section to a 6 public agency for the purpose of being provided with emergency notification by 7 the agency shall be exempt from release under Sections 1 to 7 of this Act. 8 (14) Identification and location information held by a public agency or third party 9 contractor of the persons listed in subsection (2) of this section shall be exempt 10 from disclosure if the covered individual submits to an agency that has custody of 11 the identification and location information: 12 (a) 13 A written request to exempt the identification and location information from public disclosure; and 14 (b) A written statement that he or she has made reasonable efforts to protect the 15 identification and location information from being accessible through other 16 means available to the public. 17 (15) Any public agency that is the custodian of the information specified in subsection 18 (1) of this section that is not the employer of the officer, employee, justice, judge, 19 or other person specified in the preceding shall maintain the exempt status of that 20 information only if the officer, employee, justice, judge, other person, or 21 employing agency of the designated employee submits a written request for 22 maintenance of the exemption to the custodial agency. 23 (16) The exemption provided in subsection (15) of this section shall apply to personal 24 identifying information held by an agency before, on, or after the effective date of 25 this Act. 26 SECTION 3. 27 A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO READ AS FOLLOWS: Page 7 of 15 XXXX Jacketed UNOFFICIAL COPY 1 (1) 19 RS BR 821 Notwithstanding any other provision of law, the Social Security numbers of any 2 of the persons listed in subsection (2) of Section 2 of this Act and held by an 3 employing public agency operating in the Commonwealth shall be exempt from 4 disclosure, unless: 5 (a) 6 The disclosure of the Social Security number is expressly required by federal or state law, or by a court order; 7 (b) 8 The current or former agency employee expressly consents in writing to the disclosure of his or her Social Security number; 9 (c) 10 The disclosure of the Social Security number is necessary for the receiving agency or governmental entity to perform its duties and responsibilities; 11 (d) The disclosure of the Social Security number is for the purpose of the 12 administration of health benefits for an agency employee or his or her 13 dependents; 14 (e) The disclosure of the Social Security number is for the purpose of the 15 administration of a pension fund administered for the agency employee’s 16 retirement fund, deferred compensation plan, or defined contribution plan; 17 or 18 (f) The disclosure of the Social Security number is for the purpose of the 19 administration of the Uniform Commercial Code by the office of the 20 Secretary of State. 21 (2) A public agency shall not deny a commercial entity engaged in the performance 22 of a commercial activity access to the Social Security numbers of the persons 23 listed in subsection (2) of Section 2 of this Act provided that the Social Security 24 number will be used only in the performance of a commercial activity and 25 provided that the commercial entity makes a written request for the Social 26 Security numbers. The written request shall: 27 (a) Be legibly signed by an authorized officer, employee, or agent of the Page 8 of 15 XXXX Jacketed UNOFFICIAL COPY 1 19 RS BR 821 commercial entity; 2 (b) 3 Contain the commercial entity’s name, business mailing and location addresses, and business telephone number; and 4 (c) Contain a statement of the specific purposes for which it needs the Social 5 Security numbers and how the Social Security numbers will be used in the 6 performance of a commercial activity, including the identification of any 7 specific federal or state law that permits this use. 8 (3) A public agency may request any other information reasonably necessary to 9 verify the identity of a commercial entity requesting the Social Security numbers 10 of the persons listed in subsection (2) of Section 2 of this Act and the specific 11 purposes for which the Social Security numbers will be used. 12 (4) Notwithstanding any other provision of law, any person who makes a false 13 representation in order to obtain a Social Security number of the persons listed in 14 subsection (2) of Section (2) of this Act pursuant to this paragraph, or any person 15 who willfully and knowingly violates the provisions of this section shall be guilty 16 of a Class D felony. 17 SECTION 4. 18 READ AS FOLLOWS: 19 (1) A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO Pursuant to KRS 61.932 and Sections 1 to 7 of this Act, upon the effective date of 20 Sections 1 to 7 of this Act, any contract between a public agency and a third party 21 contractor shall include the following: 22 (a) A provision that requires the contractor to comply with public records laws, 23 specifically to keep and maintain public records required by the public 24 agency to perform the service; and 25 (b) A provision in substantially similar form identifying the contact 26 information of the public agency’s custodian of public records in at least 27 fourteen (14) point boldfaced type and stating: Page 9 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 IF THE CONTRACTOR HAS QUESTIONS REGARDING THE 2 APPLICATION OF SECTIONS 1 TO 7 OF THIS ACT TO THE 3 CONTRACTOR’S DUTY UNDER THE CONTRACT TO PROVIDE 4 PUBLIC RECORDS RELATING TO THIS CONTRACT, CONTACT THE 5 CUSTODIAN OF PUBLIC RECORDS. 6 The contract shall also include contact information for the custodian of 7 public records, including telephone address, email address, and mailing 8 address. 9 (2) Upon request from the public agency’s custodian of public records, a third party 10 contractor shall provide the public agency with a copy of the requested records or 11 allow the records to be inspected or copied within a reasonable time at a cost that 12 does not exceed the cost provided under KRS 61.874. 13 (3) A third party contractor shall ensure that public records that are exempt or 14 confidential and exempt from public records disclosure requirements pursuant to 15 Sections 1 to 7 of this Act are not disclosed except as authorized by law for the 16 duration of the contract term and following completion of the contract if the 17 contractor does not transfer the records to the public agency. 18 (4) Pursuant to KRS 61.932 and Sections 1 to 7 of this Act, a third party contractor 19 that maintains or otherwise possesses personal information shall implement, 20 maintain, and update security practices, including the following: 21 (a) Upon completion of the contract, the third-party contractor shall transfer, at 22 no cost, to the public agency all public records in possession of the third 23 party contractor or keep and maintain public records required by the public 24 agency to perform the service; 25 (b) If the third-party contractor transfers all public records to the public agency 26 upon completion of the contract, the contractor shall destroy any duplicate 27 public records that are exempt or confidential and exempt from public Page 10 of 15 XXXX Jacketed UNOFFICIAL COPY 1 19 RS BR 821 records disclosure requirements pursuant to Sections 1 to 7 of this Act; 2 (c) If the contractor keeps and maintains public records upon completion of the 3 contract, the contractor shall meet all applicable requirements for retaining 4 public records under the law; and 5 (d) All records stored electronically shall be provided to the public agency, 6 upon request from the public agency’s custodian of public records, in a 7 format that is compatible with the information technology systems of the 8 public agency. SECTION 5. 9 10 READ AS FOLLOWS: 11 (1) A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO Notwithstanding any other provision of the law, a request to inspect or copy 12 public records relating to a public agency’s contract for services shall be made 13 directly to the public agency. If the public agency does not possess the requested 14 records, the public agency shall immediately notify the contractor of the request, 15 and the third party contractor shall provide the records to the public agency or 16 allow the records to be inspected or copied within a reasonable time. 17 (2) If a third party contractor does not comply with the public agency’s request for 18 records, the public agency shall enforce the contract provisions in accordance 19 with the contract. 20 (3) If a civil action is filed against a third party contractor to compel production of 21 public records relating to a public agency’s contract for services, the court shall 22 assess and award against the contractor the reasonable costs of enforcement, 23 including reasonable attorney fees, if: 24 (a) 25 The court determines that the contractor unlawfully refused to comply with the public records request within a reasonable time; and 26 (b) 27 At least eight (8) business days before filing the action, the plaintiff is provided written notice of the public records request, including a statement Page 11 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 that the contractor has not complied with the request, to the public agency 2 and to the contractor. 3 (4) Notice shall comply with subsection (3)(b) of this section if it is sent to the public 4 agency’s custodian of public records and to the contractor at the contractor’s 5 address listed on its contract with the public agency or to the contractor’s 6 registered agent. This notice shall be sent by common carrier delivery service or 7 by registered, Global Express Guaranteed, or certified mail, with postage or 8 shipping paid by the sender and with evidence of delivery, which may be in an 9 electronic format. 10 (5) A contractor who complies with a public records request within eight (8) business 11 days after the notice referenced in subsection (4) of this section shall not be liable 12 for the reasonable costs of compliance with this section. 13 SECTION 6. 14 READ AS FOLLOWS: 15 (1) A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO Any public officer who violates Sections 1 to 7 of this Act commits a violation, 16 which shall be punishable by a fine not exceeding five hundred dollars ($500) per 17 violation. 18 (2) 19 20 an order directing compliance with Sections 1 to 7 of this Act. (3) 21 22 Any person who is a victim of a violation of this section may petition the court for Whenever an action is filed to enforce Sections 1 to 7 of this Act, the court shall set an immediate hearing, giving the case priority over other pending cases. (4) Whenever a court orders a public agency to open its records for inspection in 23 accordance with Sections 1 to 7 of this Act, the agency shall comply with the 24 order within forty-eight (48) hours, unless otherwise provided by the court issuing 25 the order, or unless the appellate court issues a stay order within the forty-eight 26 hour period. 27 (5) A stay order shall not be issued unless the court determines that there is a Page 12 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 substantial probability that opening the records for inspection will result in 2 significant damage to the complainant. 3 (6) Upon service of a complaint, counterclaim, or cross-claim in a civil action 4 brought to enforce Sections 1 to 7 of this Act, the custodian of the public record 5 that is the subject matter of such civil action shall not transfer custody, alter, 6 destroy, or otherwise dispose of the public record sought to be inspected and 7 examined, notwithstanding the applicability of an exemption or the assertion that 8 the requested record is not a public record subject to inspection and examination 9 under Sections 1 to 7 of this Act, until the court directs otherwise. The person 10 who has custody of the public record may, however, at any time permit inspection 11 of the requested record as provided under Sections 1 to 7 of this Act and other 12 provisions of the law. 13 (7) (a) If a civil action is filed against a public agency to enforce Sections 1 to 7 of 14 this Act, the court shall assess and award the reasonable costs of 15 enforcement, including reasonable attorney fees, against the responsible 16 agency if the court determines that: 17 1. 18 The agency unlawfully refused to permit a public record to be inspected or copied; and 19 2. The complainant provided written notice identifying the public record 20 request to the agency’s custodian of public records at least five (5) 21 business days before filing the civil action, except as provided under 22 subsection (5) of this Act. 23 (b) A complainant shall not be required to provide written notice of the public 24 record request to the agency’s custodian of public records as provided in 25 subsection (7)(a)2. of this section if the agency has not prominently posted 26 the contact information for the agency’s custodian of public records in the 27 agency’s primary administrative building in which public records are Page 13 of 15 XXXX Jacketed UNOFFICIAL COPY 19 RS BR 821 1 routinely created, sent, received, maintained, and requested, and on the 2 agency’s Web site, if the agency has a Web site. 3 (8) The court shall determine whether the complainant requested to inspect or copy a 4 public record or participated in the civil action for an improper purpose. If the 5 court determines that there was an improper purpose, the court may decline to 6 assess and award the reasonable costs of enforcement, including reasonable 7 attorney fees, to the complainant, and shall assess and award against the 8 complainant and to the agency the reasonable costs, including reasonable 9 attorney fees, incurred by the agency in responding to the civil action. For 10 purposes of this subsection, the term "improper purpose" means a request to 11 inspect or copy a public record or to participate in the civil action primarily to 12 cause a violation of this chapter or for a frivolous purpose. 13 (9) This section shall not be interpreted to create a private right of action authorizing 14 the award of monetary damages for a person who brings an action to enforce 15 Sections 1 to 7 of this Act. Payments by the responsible agency may include only 16 the reasonable costs of enforcement, including reasonable attorney fees, directly 17 attributable to a civil action brought to enforce this chapter. 18 (10) A complaint of misconduct filed with a public agency against an agency employee 19 related to the personal information of persons listed in subsection (2) of Section 2 20 of this Act and all information obtained pursuant to an investigation by the 21 public agency of the complaint of misconduct is confidential and exempt from 22 release under Sections 1 to 7 of this Act until the investigation ceases to be active, 23 or until the agency provides written notice to the employee who is the subject of 24 the complaint, either personally or by mail, that the agency has either: 25 (a) 26 Concluded the investigation with a finding not to proceed with disciplinary action or file charges; or 27 (b) Concluded the investigation with a finding to proceed with disciplinary Page 14 of 15 XXXX Jacketed UNOFFICIAL COPY 1 19 RS BR 821 action or to file charges. SECTION 7. 2 A NEW SECTION OF KRS CHAPTER 61 IS CREATED TO 3 READ AS FOLLOWS: 4 Sections 1 to 7 of this Act shall apply to any information held by a public agency or 5 third party contractor before, on, or after the effective date of this Act. Page 15 of 15 XXXX Jacketed