UNOFFICIAL COPY 22 RS BR 891
Page 1 of 8
XXXX Jacketed
AN ACT relating to violations of privacy. 1
Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2
SECTION 1. A NEW SECTION OF KRS CHAPTER 411 IS CREATED TO 3
READ AS FOLLOWS: 4
(1) As used in this section: 5
(a) "Identification device" means any item, application, or product that is 6
passively or actively capable of transmitting personal information, 7
including but not limited to devices using radio frequency technology or any 8
electronic device used to track, harass, or download information without 9
permission; 10
(b) "Introduction" means subcutaneous injection, inhalation, ingestion, or 11
placement on or within the human body by other means; 12
(c) "Personal information" means any of the following data elements to the 13
extent they are alone or in conjunction with any other information that can 14
identify an individual: 15
1. E-mail, Internet protocol, or Web site address; 16
2. Date of birth; 17
3. Operator's license number or personal identification card number; 18
4. Any unique personal identifier number contained or encoded in an 19
operator's license or personal identification card issued; 20
5. Bank, credit card, or other financial institution account number; 21
6. Any unique personal identifier contained or encoded in a health 22
insurance, health benefit, or benefit card, or record issued in 23
conjunction with any government-supported aid program; 24
7. Religion; 25
8. Ethnicity or nationality; 26
9. Photograph; 27 UNOFFICIAL COPY 22 RS BR 891
Page 2 of 8
XXXX Jacketed
10. Fingerprint or other biometric identifier; 1
11. Social Security number; or 2
12. Any other unique personal identifier; 3
(d) "Require, coerce, or compel" means any physical violence, threat, 4
intimidation, or retaliation, or the conditioning of any private or public 5
benefit or care on consent to implantation, including employment, 6
promotion, or other employment benefit, or any means that cause a 7
reasonable person of ordinary susceptibilities to acquiesce to implantation 8
when he or she otherwise would not, but does not include legitimate medical 9
uses for which the patient or his or her guardian or parent has consented; 10
and 11
(e) "Subcutaneous" means existing, performed, or introduced under the skin. 12
(2) No person shall: 13
(a) Require, coerce, or compel any other individual to undergo the introduction 14
of an identification device; or 15
(b) Introduce an identification device without the consent of the person to 16
whom the identification device is introduced. 17
(3) A person to whom an identification device is introduced in violation of subsection 18
(2) of this section may bring a civil action for actual damages, compensatory 19
damages, punitive damages, injunctive relief, any combination of those, or any 20
other appropriate relief. The court may also grant a prevailing plaintiff 21
reasonable attorney's fees and litigation costs, including but not limited to expert 22
witness fees and expenses as part of the costs. 23
(4) In addition to the damages and relief authorized in subsection (3) of this section, 24
punitive damages may also be awarded upon proof of the defendant's malice, 25
oppression, fraud, or duress in requiring, coercing, or compelling the plaintiff to 26
undergo the introduction of an identification device. 27 UNOFFICIAL COPY 22 RS BR 891
Page 3 of 8
XXXX Jacketed
(5) An action brought under this section shall be commenced within five (5) years of 1
the date upon which the identification device was introduced, or within five (5) 2
years of the date the introduction was discovered by the person. 3
(6) For purposes of introduction only, any interested person may file a petition for an 4
order or judgment declaring an incompetent person or minor free from the 5
control of a parent or guardian who is requiring or preventing introduction of an 6
identification device. The court shall consider that petition in light of applicable 7
law with respect to the best interests of the incompetent person or minor. 8
(7) Any restitution paid by the defendant to the victim shall be credited against any 9
judgment, award, or settlement obtained under this section. 10
(8) This section shall be liberally construed so as to protect privacy and bodily 11
integrity. 12
(9) Actions brought under this section are independent of any other actions, 13
remedies, or procedures that may be available to an aggrieved party under any 14
other law. 15
(10) This section shall not in any way modify existing statutory or case law regarding 16
the rights of parents or guardians, the rights of children or minors, or the rights 17
of dependent adults. 18
SECTION 2. A NEW SECTION OF KRS CHAPTER 454 IS CREATED TO 19
READ AS FOLLOWS: 20
(1) As used in this section, unless context requires otherwise: 21
(a) "Facial recognition technology" means computerized technology that helps 22
in discerning and identifying human faces using biometrics to map facial 23
features from a photo or video and comparing this information with a large 24
database of recorded faces; 25
(b) 1. "Biometric identifier" means a retina or iris scan, fingerprint, 26
voiceprint, or scan of hand or face geometry. 27 UNOFFICIAL COPY 22 RS BR 891
Page 4 of 8
XXXX Jacketed
2. Biometric identifiers do not include: 1
a. Writing samples, written signatures, photographs, human 2
biological samples used for valid scientific testing or screening, 3
demographic data, tattoo descriptions, or physical descriptions 4
such as height, weight, hair color, or eye color; 5
b. Donated organs, tissues, or blood or serum stored on behalf of 6
recipients or potential recipients of living or cadaveric 7
transplants and obtained or stored by a federally designated 8
organ procurement agency; 9
c. Information captured from a patient in a health care setting or 10
information collected, used, or stored for health care treatment, 11
payment, or operations under the federal Health Insurance 12
Portability and Accountability Act of 1996; and 13
d. Any X-ray, roentgen process, computed tomography, MRI, PET 14
scan, mammography, or other image or film of the human 15
anatomy used to diagnose or treat an illness or other medical 16
condition or to further validate scientific testing or screening; 17
and 18
(c) "Biometric information" means any information, regardless of how it is 19
captured, converted, stored, or shared, based on an individual's biometric 20
identifier used to identify an individual. Biometric information does not 21
include information derived from items or procedures excluded under the 22
definition of biometric identifiers. 23
(2) It is unlawful, absent a court-approved warrant, for any state or local government 24
agency, or an official thereof, to obtain, retain, request, access, or use: 25
(a) Facial recognition technology; or 26
(b) Information obtained from or by use of facial recognition. 27 UNOFFICIAL COPY 22 RS BR 891
Page 5 of 8
XXXX Jacketed
(3) Once a person is accepted by law enforcement as being a missing person or child, 1
facial recognition technology may be used if there is video or a real time feed 2
available, provided a proven family member or court-approved guardian gives 3
written consent for the use of facial recognition technology. 4
(4) Photographs taken by the Transportation Cabinet, or by any other agency, in 5
order to issue operators' licenses or personal identification cards shall not be sold 6
to any entity and shall not be provided to any state or local government agency 7
for the purpose of using facial recognition technology without a warrant. 8
(5) A private entity in possession of biometric identifiers or biometric information 9
shall develop a written policy, made available to the public, establishing a 10
retention schedule and guidelines for permanently destroying biometric 11
identifiers and biometric information when the initial purpose for collecting or 12
obtaining such identifiers or information has been satisfied or within three (3) 13
years of the individual's last interaction with the private entity, whichever occurs 14
first. Absent a valid warrant or subpoena issued by a court of competent 15
jurisdiction, a private entity in possession of biometric identifiers or biometric 16
information shall comply with its established retention schedule and destruction 17
guidelines. 18
(6) No private entity may collect, capture, purchase, receive through trade, or 19
otherwise obtain a person's or a customer's biometric identifier or biometric 20
information, unless it first: 21
(a) Informs the subject or the subject's legally authorized representative in 22
writing that a biometric identifier or biometric information is being 23
collected or stored; 24
(b) Informs the subject or the subject's legally authorized representative in 25
writing of the specific purpose and length of term for which a biometric 26
identifier or biometric information is being collected, stored, and used; and 27 UNOFFICIAL COPY 22 RS BR 891
Page 6 of 8
XXXX Jacketed
(c) Receives a written release executed by the subject of the biometric identifier 1
or biometric information or the subject's legally authorized representative. 2
(7) No private entity in possession of a biometric identifier or biometric information 3
may sell, lease, trade, or otherwise profit from a person's or a customer's 4
biometric identifier or biometric information. 5
(8) No private entity in possession of a biometric identifier or biometric information 6
may disclose, redisclose, or otherwise disseminate a person's or a customer's 7
biometric identifier or biometric information unless: 8
(a) The subject of the biometric identifier or biometric information or the 9
subject's legally authorized representative consents to the disclosure or 10
redisclosure; 11
(b) The disclosure or redisclosure completes a financial transaction requested 12
or authorized by the subject of the biometric identifier or the biometric 13
information or the subject's legally authorized representative; 14
(c) The disclosure or redisclosure is required by law; or 15
(d) The disclosure is required pursuant to a valid warrant or subpoena issued 16
by a court of competent jurisdiction. 17
(9) A private entity in possession of a biometric identifier or biometric information 18
shall store, transmit, and protect from disclosure all biometric identifiers and 19
biometric information: 20
(a) Using the reasonable standard of care within the private entity's industry; 21
and 22
(b) In a manner that is the same as or more protective than the manner in 23
which the private entity stores, transmits, and protects other sensitive 24
information. 25
SECTION 3. A NEW SECTION OF KRS CHAPTER 411 IS CREATED TO 26
READ AS FOLLOWS: 27 UNOFFICIAL COPY 22 RS BR 891
Page 7 of 8
XXXX Jacketed
(1) Any violation of Section 2 of this Act constitutes an injury and any person may 1
institute proceedings for injunctive relief, declaratory relief, or writ of mandamus 2
in any court of competent jurisdiction to enforce Section 2 of this Act. 3
(2) Any person who has been subjected to facial recognition in violation of Section 2 4
of this Act, or about whom information has been obtained, retained, accessed, or 5
used in violation of Section 2 of this Act, may institute proceedings in any court 6
of competent jurisdiction. 7
(3) A prevailing party may recover for each violation: 8
(a) Against an entity that negligently violates a provision of Section 2 of this 9
Act, liquidated damages of one thousand dollars ($1,000) or actual 10
damages, whichever is greater; 11
(b) Against an entity that intentionally or recklessly violates a provision of 12
Section 2 of this Act, liquidated damages of five thousand dollars ($5,000) 13
or actual damages, whichever is greater; 14
(c) Reasonable attorneys' fees and costs, including expert witness fees and 15
other litigation expenses; and 16
(d) Other relief, including an injunction, as the court may deem appropriate. 17
(4) The Attorney General may bring an action to enforce Section 2 of this Act. In any 18
action brought by the Attorney General, a violation of Section 2 of this Act is 19
subject to a civil penalty of one thousand dollars ($1,000) for each violation. 20
SECTION 4. A NEW SECTION OF KRS CHAPTER 6 IS CREA TED TO 21
READ AS FOLLOWS: 22
No information obtained from or by use of facial recognition may be received in 23
evidence in any legislative committee, task force, or other legislative body. 24
SECTION 5. A NEW SECTION OF KRS CHAPTER 13B IS CREATED TO 25
READ AS FOLLOWS: 26
No information obtained from or by use of facial recognition may be received in 27 UNOFFICIAL COPY 22 RS BR 891
Page 8 of 8
XXXX Jacketed
evidence in an administrative hearing. 1
SECTION 6. A NEW SECTION OF KRS CHAPTER 23A IS CREATED TO 2
READ AS FOLLOWS: 3
No information obtained from or by use of facial recognition may be received in 4
evidence in any trial, hearing, or other proceeding. 5
SECTION 7. A NEW SECTION OF KRS CHAPTER 24A IS CREATED TO 6
READ AS FOLLOWS: 7
No information obtained from or by use of facial recognition may be received in 8
evidence in any trial, hearing, or other proceeding. 9
SECTION 8. A NEW SECTION OF KRS CHAPTER 29A IS CREATED TO 10
READ AS FOLLOWS: 11
No information obtained from or by use of facial recognition may be received in 12
evidence before a grand jury. 13
SECTION 9. A NEW SECTION OF THE KENTUCKY RULES OF 14
EVIDENCE IS CREATED TO READ AS FOLLOWS: 15
Evidence obtained by use of facial recognition is not admissible. 16