UNOFFICIAL COPY 23 RS BR 850
Page 1 of 8
XXXX 1/20/2023 8:20 AM Jacketed
AN ACT relating to violations of privacy. 1
Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2
SECTION 1. A NEW SECTION OF KRS CHAPTER 411 IS CREATED TO 3
READ AS FOLLOWS: 4
(1) As used in this section: 5
(a) "Identification device" means any item, application, or product that is 6
passively or actively capable of transmitting personal information, including 7
but not limited to devices using radio frequency technology or any 8
electronic device used to track, harass, or download information without 9
permission; 10
(b) "Introduction" means subcutaneous injection, inhalation, ingestion, or 11
placement on or within the human body by other means; 12
(c) "Personal information" means any of the following data elements to the 13
extent they are alone or in conjunction with any other information that can 14
identify an individual: 15
1. E-mail, Internet protocol, or website address; 16
2. Date of birth; 17
3. Operator's license number or personal identification card number; 18
4. Any unique personal identifier number contained or encoded in an 19
operator's license or personal identification card issued; 20
5. Bank, credit card, or other financial institution account number; 21
6. Any unique personal identifier contained or encoded in a health 22
insurance, health benefit, or benefit card, or record issued in 23
conjunction with any government-supported aid program; 24
7. Religion; 25
8. Ethnicity or nationality; 26
9. Photograph; 27 UNOFFICIAL COPY 23 RS BR 850
Page 2 of 8
XXXX 1/20/2023 8:20 AM Jacketed
10. Fingerprint or other biometric identifier; 1
11. Social Security number; or 2
12. Any other unique personal identifier; 3
(d) "Require, coerce, or compel" means any physical violence, threat, 4
intimidation, or retaliation, or the conditioning of any private or public 5
benefit or care on consent to implantation, including employment, 6
promotion, or other employment benefit, or any means that cause a 7
reasonable person of ordinary susceptibilities to acquiesce to implantation 8
when he or she otherwise would not, but does not include legitimate medical 9
uses for which the patient or his or her guardian or parent has consented; 10
and 11
(e) "Subcutaneous" means existing, performed, or introduced under the skin. 12
(2) No person shall: 13
(a) Require, coerce, or compel any other individual to undergo the introduction 14
of an identification device; or 15
(b) Introduce an identification device without the consent of the person to 16
whom the identification device is introduced. 17
(3) A person to whom an identification device is introduced in violation of subsection 18
(2) of this section may bring a civil action for actual damages, compensatory 19
damages, punitive damages, injunctive relief, any combination of those, or any 20
other appropriate relief. The court may also grant a prevailing plaintiff 21
reasonable attorney's fees and litigation costs, including but not limited to expert 22
witness fees and expenses as part of the costs. 23
(4) In addition to the damages and relief authorized in subsection (3) of this section, 24
punitive damages may also be awarded upon proof of the defendant's malice, 25
oppression, fraud, or duress in requiring, coercing, or compelling the plaintiff to 26
undergo the introduction of an identification device. 27 UNOFFICIAL COPY 23 RS BR 850
Page 3 of 8
XXXX 1/20/2023 8:20 AM Jacketed
(5) An action brought under this section shall be commenced within five (5) years of 1
the date upon which the identification device was introduced, or within five (5) 2
years of the date the introduction was discovered by the person. 3
(6) Any restitution paid by the defendant to the victim shall be credited against any 4
judgment, award, or settlement obtained under this section. 5
(7) This section shall be liberally construed so as to protect privacy and bodily 6
integrity. 7
(8) Actions brought under this section are independent of any other actions, 8
remedies, or procedures that may be available to an aggrieved party under any 9
other law. 10
(9) This section shall not in any way modify existing statutory or case law regarding 11
the rights of parents or guardians, the rights of children or minors, or the rights 12
of dependent adults. 13
SECTION 2. A NEW SECTION OF KRS CHAPTER 454 IS CREATED TO 14
READ AS FOLLOWS: 15
(1) As used in this section, unless context requires otherwise: 16
(a) "Facial recognition technology" means computerized technology that helps 17
in discerning and identifying human faces using biometrics to map facial 18
features from a photo or video and comparing this information with a large 19
database of recorded faces; 20
(b) 1. "Biometric identifier" means a retina or iris scan, fingerprint, 21
voiceprint, or scan of hand or face geometry. 22
2. Biometric identifiers do not include: 23
a. Writing samples, written signatures, photographs, human 24
biological samples used for valid scientific testing or screening, 25
demographic data, tattoo descriptions, or physical descriptions 26
such as height, weight, hair color, or eye color; 27 UNOFFICIAL COPY 23 RS BR 850
Page 4 of 8
XXXX 1/20/2023 8:20 AM Jacketed
b. Donated organs, tissues, or blood or serum stored on behalf of 1
recipients or potential recipients of living or cadaveric 2
transplants and obtained or stored by a federally designated 3
organ procurement agency; 4
c. Information captured from a patient in a health care setting or 5
information collected, used, or stored for health care treatment, 6
payment, or operations under the federal Health Insurance 7
Portability and Accountability Act of 1996; and 8
d. Any X-ray, roentgen process, computed tomography, MRI, PET 9
scan, mammography, or other image or film of the human 10
anatomy used to diagnose or treat an illness or other medical 11
condition or to further validate scientific testing or screening; 12
and 13
(c) "Biometric information" means any information, regardless of how it is 14
captured, converted, stored, or shared, based on an individual's biometric 15
identifier used to identify an individual. Biometric information does not 16
include information derived from items or procedures excluded under the 17
definition of biometric identifiers. 18
(2) It is unlawful, absent a court-approved warrant, for any state or local government 19
agency, or an official thereof, to obtain, retain, request, access, or use: 20
(a) Facial recognition technology; or 21
(b) Information obtained from or by use of facial recognition. 22
(3) Once a person is accepted by law enforcement as being a missing person or child, 23
facial recognition technology may be used if there is video or a real time feed 24
available, provided a proven family member or court-approved guardian gives 25
written consent for the use of facial recognition technology. 26
(4) Photographs taken by the Transportation Cabinet, or by any other agency, in 27 UNOFFICIAL COPY 23 RS BR 850
Page 5 of 8
XXXX 1/20/2023 8:20 AM Jacketed
order to issue operators' licenses or personal identification cards shall not be sold 1
to any entity and shall not be provided to any state or local government agency 2
for the purpose of using facial recognition technology without a warrant. 3
(5) A private entity in possession of biometric identifiers or biometric information 4
shall develop a written policy, made available to the public, establishing a 5
retention schedule and guidelines for permanently destroying biometric 6
identifiers and biometric information when the initial purpose for collecting or 7
obtaining such identifiers or information has been satisfied or within three (3) 8
years of the individual's last interaction with the private entity, whichever occurs 9
first. Absent a valid warrant or subpoena issued by a court of competent 10
jurisdiction, a private entity in possession of biometric identifiers or biometric 11
information shall comply with its established retention schedule and destruction 12
guidelines. 13
(6) No private entity may collect, capture, purchase, receive through trade, or 14
otherwise obtain a person's or a customer's biometric identifier or biometric 15
information, unless it first: 16
(a) Informs the subject or the subject's legally authorized representative in 17
writing that a biometric identifier or biometric information is being 18
collected or stored; 19
(b) Informs the subject or the subject's legally authorized representative in 20
writing of the specific purpose and length of term for which a biometric 21
identifier or biometric information is being collected, stored, and used; and 22
(c) Receives a written release executed by the subject of the biometric identifier 23
or biometric information or the subject's legally authorized representative. 24
(7) No private entity in possession of a biometric identifier or biometric information 25
may sell, lease, trade, or otherwise profit from a person's or a customer's 26
biometric identifier or biometric information. 27 UNOFFICIAL COPY 23 RS BR 850
Page 6 of 8
XXXX 1/20/2023 8:20 AM Jacketed
(8) No private entity in possession of a biometric identifier or biometric information 1
may disclose, redisclose, or otherwise disseminate a person's or a customer's 2
biometric identifier or biometric information unless: 3
(a) The subject of the biometric identifier or biometric information or the 4
subject's legally authorized representative consents to the disclosure or 5
redisclosure; 6
(b) The disclosure or redisclosure completes a financial transaction requested 7
or authorized by the subject of the biometric identifier or the biometric 8
information or the subject's legally authorized representative; 9
(c) The disclosure or redisclosure is required by law; or 10
(d) The disclosure is required pursuant to a valid warrant or subpoena issued 11
by a court of competent jurisdiction. 12
(9) A private entity in possession of a biometric identifier or biometric information 13
shall store, transmit, and protect from disclosure all biometric identifiers and 14
biometric information: 15
(a) Using the reasonable standard of care within the private entity's industry; 16
and 17
(b) In a manner that is the same as or more protective than the manner in 18
which the private entity stores, transmits, and protects other sensitive 19
information. 20
SECTION 3. A NEW SECTION OF KRS CHAPTER 411 IS CREATED TO 21
READ AS FOLLOWS: 22
(1) Any violation of Section 2 of this Act constitutes an injury, and any person may 23
institute proceedings for injunctive relief, declaratory relief, or writ of mandamus 24
in any court of competent jurisdiction to enforce Section 2 of this Act. 25
(2) Any person who has been subjected to facial recognition in violation of Section 2 26
of this Act, or about whom information has been obtained, retained, accessed, or 27 UNOFFICIAL COPY 23 RS BR 850
Page 7 of 8
XXXX 1/20/2023 8:20 AM Jacketed
used in violation of Section 2 of this Act, may institute proceedings in any court 1
of competent jurisdiction. 2
(3) A prevailing party may recover for each violation: 3
(a) Against an entity that negligently violates a provision of Section 2 of this 4
Act, liquidated damages of one thousand dollars ($1,000) or actual 5
damages, whichever is greater; 6
(b) Against an entity that intentionally or recklessly violates a provision of 7
Section 2 of this Act, liquidated damages of five thousand dollars ($5,000) 8
or actual damages, whichever is greater; 9
(c) Reasonable attorneys' fees and costs, including expert witness fees and 10
other litigation expenses; and 11
(d) Other relief, including an injunction, as the court may deem appropriate. 12
(4) The Attorney General may bring an action to enforce Section 2 of this Act. In any 13
action brought by the Attorney General, a violation of Section 2 of this Act is 14
subject to a civil penalty of one thousand dollars ($1,000) for each violation. 15
SECTION 4. A NEW SECTION OF KRS CHAPTER 6 IS CREATED TO 16
READ AS FOLLOWS: 17
No information obtained from or by use of facial recognition may be received in 18
evidence in any legislative committee, task force, or other legislative body. 19
SECTION 5. A NEW SECTION OF KRS CHAPTER 13B IS CREATED TO 20
READ AS FOLLOWS: 21
No information obtained from or by use of facial recognition may be received in 22
evidence in an administrative hearing. 23
SECTION 6. A NEW SECTION OF KRS CHAPTER 23A IS CREATED TO 24
READ AS FOLLOWS: 25
No information obtained from or by use of facial recognition may be received in 26
evidence in any trial, hearing, or other proceeding. 27 UNOFFICIAL COPY 23 RS BR 850
Page 8 of 8
XXXX 1/20/2023 8:20 AM Jacketed
SECTION 7. A NEW SECTION OF KRS CHAPTER 24A IS CREATED TO 1
READ AS FOLLOWS: 2
No information obtained from or by use of facial recognition may be received in 3
evidence in any trial, hearing, or other proceeding. 4
SECTION 8. A NEW SECTION OF KRS CHAPTER 29A IS CREATED TO 5
READ AS FOLLOWS: 6
No information obtained from or by use of facial recognition may be received in 7
evidence before a grand jury. 8
SECTION 9. A NEW SECTION OF THE KENTUCKY RULES OF 9
EVIDENCE IS CREATED TO READ AS FOLLOWS: 10
Evidence obtained by use of facial recognition is not admissible. 11