AN ACT relating to the security of personal information. Amend KRS 61.931 to include user name, e-mail address, and security questions with answers in the definition of "personal information" involved in a data security breach of information held by state and local government agencies; amend KRS 61.933 to allow a civil cause of action for actual damages, attorney's fees and court costs in Franklin Circuit Court against state and local government agencies who violate the investigation and notice procedures of KRS 61.931 to 61.934, waiving sovereign immunity; amend KRS 365.732, regarding data security breaches in businesses, to expand the definition of "breach of the security system" to include noncomputerized records as well as computerized records, records which are accessed as well as records which are acquired, and encrypted records when the key is also compromised; define "encryption" as meeting National Institute of Standards and Technology guidelines; expand definition of "personally identifiable information" to mirror the definition of "personal information" in KRS 61.931; include third party agents who contract with information holders in the section's provisions; limit time frames for notice of breaches.