Can I use third-party marketing automation tools that collect personal information in Kentucky? What are the requirements?

Third-Party Marketing Automation Tools in Kentucky

Kentucky has laws that regulate the collection and use of personal information. If you are using third-party marketing automation tools that collect personal information, you must comply with these laws.

Under Kentucky law, personal information is defined as an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:

• Social Security number;
• Driver’s license number or state identification card number;
• Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account;
• Account number, credit or debit card number, or any other financial information that is not publicly available, in combination with any required security code, access code, or password that would permit access to an individual’s financial account;
• Individual taxpayer identification number; or
• Passport number.

If you collect personal information through third-party marketing automation tools, you must provide notice to individuals about the collection and use of their personal information. You must also take reasonable steps to protect the security of the personal information you collect.

Requirements for Collecting Personal Information

Kentucky law requires that you take reasonable steps to protect the security of personal information you collect. This includes implementing and maintaining reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

If you experience a data breach involving personal information, you must provide notice to affected individuals and the Kentucky Office of the Attorney General. The notice must include specific information about the breach and steps individuals can take to protect themselves.

Licensure by Endorsement

While licensure by endorsement is not directly related to the use of third-party marketing automation tools, it is worth noting that Kentucky law allows for licensure by endorsement for individuals who are registered, licensed, or certified in another state if the requirements for registration, licensing, or certification in the issuing state are substantially equal to the requirements for licensing in Kentucky ^[2.1].

Conclusion

If you are using third-party marketing automation tools that collect personal information in Kentucky, you must comply with Kentucky’s laws regarding the collection and use of personal information. This includes providing notice to individuals about the collection and use of their personal information, taking reasonable steps to protect the security of the personal information you collect, and providing notice in the event of a data breach.

Source(s):

• [2.1] Licensure by endorsement.

Jurisdiction

Kentucky

• Privacy