Kentucky Weighs Cyber Breach Notifcation Law

A bill backed by state Auditor Adam Edelen and a bipartisan group of lawmakers would require state and local government agencies to notify Kentuckians when their personal information is breached.

The bill’s backers said the measure has drawn more than 60 House co-sponsors.

Edelen said government possesses volumes of private information, from Social Security numbers to tax returns and health records. When government loses that information, he said, citizens have a right to know.

The bill requires state and local agencies to notify individuals affected by a data breach within 35 days of the incident. If a breach affects more than 1,000 people, national consumer reporting agencies must be notified.

Edelen says Kentucky is among four states without a notification law.