|An Act Concerning Protection of Certain Personal Information, S.B. 196|
|CITATION||Kan. Stat. 50-7a01 and 50-7a02|
A person that conducts business in Kansas, or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information must, when it becomes aware of any breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused. If the investigation determines that the misuse of information has occurred or is reasonably likely to occur, the person or government, governmental subdivision or agency shall give notice as soon as possible to the affected Kansas resident.
Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.
An individual or a commercial entity that maintains computerized data that includes personal information that the individual or the commercial entity does not own or license shall give notice to the owner or licensee of the information of any breach of the security of the data following discovery of a breach, if the personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person.
The law covers ‘Personal Information’ which is defined as a consumer's first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted:
|INDUSTRY||A person that conducts business in Kansas, or a governmental agency that owns or licenses computerized data that includes personal information.|
For violations by insurance companies licensed to do business in Kansas, the insurance commissioner has the sole authority to enforce the provisions of the law.
For all other violations, the state attorney general is empowered to bring an action to address violations of the law and may seek relief that is appropriate.