AN ACT relating to consumer data privacy.

Create new sections of KRS Chapter 367 to establish consumer rights relating to personal data, including the rights to confirm whether data is being processed, to delete personal data provided by the consumer, to obtain a copy of the consumer's personal data that was previously provided, and to opt out of targeted advertising and the sale of data; create definitions for terms; require that persons controlling data establish an appeal process by which a consumer may appeal the controller's refusal to take action with respect to a request to exercise a right set forth in this Act; set forth the types of data and the persons or entities to which the provisions of the Act apply and do not apply; set forth requirements for persons or entities that control and process consumer data; require persons who control data to conduct data protection impact assessments; establish that the Attorney General has exclusive authority to enforce, with the exception of a private right of action by which consumers can seek injunctive relief for specific violations; create a consumer privacy fund in the state treasury to be administered by the State Treasurer; amend KRS 367.240 to conform; EFFECTIVE January 1, 2024.