Skip to main content
Find a Lawyer

Kentucky Revised Statutes Title XXV. Business and Financial Institutions § 304.3-750.Definitions for KRS 304.3-750 to 304.3-768

Current as of January 01, 2025 | Updated by Findlaw Staff

As used in KRS 304.3-750 to 304.3-768 of this Act:

(1) “Consumer” means an individual, including but not limited to an applicant, policyholder, insured, beneficiary, claimant, and certificate holder:

(a) Who is a resident of this Commonwealth; and

(b) Whose nonpublic information is in a licensee's possession, custody, or control;

(2) “Cybersecurity event”:

(a) Means an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on an information system; and

(b) Shall not include:

1. Unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; or

2. An event with regard to which the licensee has determined that the nonpublic information accessed by an unauthorized person:

a. Has not been used or released; and

b. Has been returned or destroyed;

(3) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key;

(4) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information;

(5) “Information system”:

(a) Means a discrete set of electronic nonpublic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information; and

(b) Shall include any specialized system such as industrial or process controls systems, telephone switching and private branch exchange systems, and environmental control systems;

(6) “Licensee”:

(a) Means any person who is, or is required to be, licensed, authorized to operate, or registered pursuant to the insurance laws of this state; and

(b) Shall not include:

1. A purchasing group or a risk retention group chartered and licensed in a state other than this state; or

2. A licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction;

(7) “Nonpublic information”:

(a) Means electronic information that is not publicly available information; and

(b) Shall include:

1. Business-related information of a licensee that if tampered with, or disclosed, accessed, or used without authorization, would cause a material adverse impact to the business, operations, or security of the licensee;

2. Any confidential personal identifying information of a consumer, including:

a. Social Security number;

b. Operator's license number or personal identification card number;

c. Financial account number;

d. Credit or debit card number;

e. Any security code, access code, or password that would permit access to a consumer's financial account; or

f. Biometric records; and

3. Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that relates to:

a. The past, present, or future physical, mental, or behavioral health or condition of any consumer or member of the consumer's family;

b. The provision of health care to any consumer; or

c. Payment for the provision of health care to any consumer;

(8) “Person” means any individual or nongovernmental entity, including but not limited to any nongovernmental partnership, corporation, branch, agency, or association;

(9)(a) “Publicly available information” means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:

1. Federal, state, or local government records;

2. Widely distributed media; or

3. Disclosures to the general public that are required to be made by federal, state, or local law.

(b) For purposes of this definition, a licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine:

1. That the information is of the type that is available to the general public; and

2. Whether the consumer can direct that information not be made available to the general public, and if so, that the consumer has not done so; and

(10) “Third-party service provider” means a person, other than a licensee, that:

(a) Contracts with a licensee to maintain, process, or store nonpublic information; or

(b) Is otherwise permitted access to nonpublic information through its provision of services to a licensee.

Previous Part of Code Next Part of Code
Back to Chapter List

Cite this article: FindLaw.com - Kentucky Revised Statutes Title XXV. Business and Financial Institutions § 304.3-750.Definitions for KRS 304.3-750 to 304.3-768 - last updated January 01, 2025 | https://codes.findlaw.com/ky/title-xxv-business-and-financial-institutions/ky-rev-st-sect-304-3-750/

FindLaw Codes may not reflect the most recent version of the law in your jurisdiction. Please verify the status of the code you are researching with the state legislature before relying on it for your legal needs.

Was this helpful?

Welcome to FindLaw's Cases & Codes

A free source of state and federal court opinions, state laws, and the United States Code. For more information about the legal concepts addressed by these cases and statutes, visit FindLaw’s Learn About the Law.

Go to Learn About the Law

Latest Blog Posts

For Legal Professionals

Learn About The Law

Get help with your legal needs

FindLaw’s Learn About the Law features thousands of informational articles to help you understand your options. And if you’re ready to hire an attorney, find one in your area who can help.

Go to Learn About the Law

Need to Find an Attorney?

Search our directory by legal issue

Enter information in one or both fields (Required)

Copied to clipboard