367.3615 Consumer rights request -- Controller compliance -- Requirements --
798 words·~4 min read·
/ky/367-3615A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Appeal process.
(1)A consumer may invoke the consumer rights authorized pursuant to this section at
any time by submitting a request to a controller, via the means specified by the
controller pursuant to KRS 367.3617, specifying the consumer rights the consumer
wishes to invoke. A child's parent or legal guardian may invoke such consumer
rights on behalf of the child regarding processing personal data belonging to the
child.
(2)A controller shall comply with an authenticated consumer request to exercise the
right to:
(a)Confirm whether or not a controller is processing the consumer's personal
data and to access the personal data, unless the confirmation and access would
require the controller to reveal a trade secret;
(b)Correct inaccuracies in the consumer's personal data, taking into account the
nature of the personal data and the purposes of processing the data;
(c)Delete personal data provided by or obtained about the consumer;
(d)Obtain a copy of the consumer's personal data that the consumer previously
provided to the controller in a portable and, to the extent technically
practicable, readily usable format that allows the consumer to transmit the
data to another controller without hindrance, where the processing is carried
out by automated means. The controller shall not be required to reveal any
trade secrets; and
(e)Opt out of the processing of personal data for purposes of targeted
advertising, the sale of personal data, or profiling in furtherance of decisions
that produce legal or similarly significant effects concerning the consumer.
(3)Except as otherwise provided in KRS 367.3611 to 367.3629, a controller shall
comply with a request by a consumer to exercise the consumer rights pursuant to
this section as follows:
(a)A controller shall respond to the consumer without undue delay, but in all
cases within forty-five
(45)days of receipt of the request submitted pursuant
to the methods described in this section. The response period may be extended
once by forty-five
(45)additional days when reasonably necessary, taking into
consideration the complexity and number of the consumer's requests, so long
as the controller informs the consumer of any extension within the initial
forty-five
(45)day response period, together with the reason for the extension;
(b)If a controller declines to take action regarding the consumer's request, the
controller shall inform the consumer without undue delay, but no later than
forty-five
(45)days after receipt of the request, of the justification for
declining to take action and instructions on how to appeal the decision;
(c)Information provided in response to a consumer request shall be provided by a
controller free of charge, up to twice annually per consumer. If requests from
a consumer are excessive, repetitive, technically infeasible, or manifestly
unfounded, the controller may charge the consumer a reasonable fee to cover
the administrative costs of complying with the request or decline to act on the
request. The controller bears the burden of demonstrating the excessive,
repetitive, technically infeasible, or manifestly unfounded nature of the
request;
(d)If a controller is unable to authenticate the request using commercially
reasonable efforts, the controller shall not be required to comply with a
request to initiate an action under subsection
(1)of this section and may
request that the consumer provide additional information reasonably
necessary to authenticate the consumer and the consumer's request; and
(e)A controller that has obtained personal data about a consumer from a source
other than the consumer shall be deemed in compliance with a consumer's
request to delete such data pursuant to subsection (2)(c) of this section by:
1. Retaining a record of the deletion request and the minimum data
necessary for the purpose of ensuring the consumer's personal data
remains deleted from the business' records and not using the retained
data for any other purpose pursuant to the provisions of KRS 367.3611
to 367.3629; or
2. Opting the consumer out of the processing of the personal data for any
purpose except for those exempted pursuant to KRS 367.3613.
(4)A controller shall establish a process for a consumer to appeal the controller's
refusal to take action on a request within a reasonable period of time after the
consumer's receipt of the decision pursuant to subsection (3)(b) of this section. The
appeal process shall be conspicuously available and similar to the process for
submitting requests to initiate action pursuant to this section. Within sixty
(60)days
of receipt of an appeal, a controller shall inform the consumer in writing of any
action taken or not taken in response to the appeal, including a written explanation
of the reasons for the decisions. If the appeal is denied, the controller shall also
provide the consumer with an online mechanism, if available, or other method
through which the consumer may contact the Attorney General to submit a
complaint.