Create new sections of KRS Chapter 194A to establish the Kentucky statewide health data utility; define terms; establish purposes and a restricted fund for the utility; require the executive director of the Office of Data Analytics to be responsible for the development, implementation, operation, and maintenance of the utility, contract with a consortium of public health colleges to operate and govern the utility, and promulgate administrative regulations to carry out those duties; establish functions and content of utility; create a consortium of public health colleges; establish duties of consortium in operating and governing the utility; establish administration and operation requirements for the consortium; establish the Kentucky Health Information Technology Board; require the board to establish policies and procedures for the sharing and submission of health information, approve data control, governance, and privacy practices, and advise the executive director and the consortium; require the utility's participants to comply with health information sharing and submission requirements within certain timeframes; require the secretary of the Cabinet for Health and Family Services to enforce the mandatory reporting requirements for the utility's participants; establish enforcement powers of secretary including civil penalty assessment; require the consortium and the executive director to make annual reports relating to the utility; amend KRS 194A.030, 194A.101, 194A.103, 194A.095, 205.640, 205.6489, 211.474, 214.375, and 311A.190 to conform; repeal KRS 216.2920, 216.2921, 216.2923, 216.2925, 216.2927, and 216.2929, relating to health data collection; establish timeframe for making initial appointments, and provide for staggered appointments to the board; require the Cabinet for Health and Family Services or the Department for Medicaid Services to seek federal approval if it is determined that such approval is necessary; provide authorization from the General Assembly to make changes in the Medicaid program as required under KRS 205.5372(1); EFFECTIVE, in part, July 1, 2028.
Amend KRS 367.3611, relating to the Kentucky Consumer Data Protection Act, to define "automatic content recognition" and "smart monitor" and to include automatic content recognition data in the definition of "sensitive data"; EFFECTIVE July 1, 2027.
Establish Subtitle 13 of KRS Chapter 286 and create new sections thereof to regulate virtual currency kiosks; establish definitions; provide for enforcement by the commissioner of the Department of Financial Institutions; establish license requirements for virtual currency kiosks; require regulatory filings to be submitted to a nationwide licensing system registry; establish initial and renewal application processes and requirements, reporting, surety bond and tangible net worth, and change of control requirements for virtual currency kiosk operators; require the commissioner to promulgate administrative regulations to establish format, document submission, fee, and trade practice requirements for virtual currency kiosk operators; establish record retention requirements for persons required to be licensed as virtual currency kiosk operators; establish trade practice requirements relating to protection of resident assets, virtual currency kiosk transactions, prohibited practices, and fraud and information security compliance procedures; authorize the commissioner to conduct investigations and examinations; provide for the confidentiality of certain documents provided to the commissioner; authorize the commissioner to share, disclose, and report information and take other actions to assist in the commissioner's duties; require the commissioner to submit an annual licensing report to the Legislative Research Commission; establish due process requirements for adverse actions taken by the commissioner against licensees and other persons; establish requirements for the denial, suspension, or revocation of a license; authorize the commissioner to enter cease and desist orders and emergency orders; authorize the commissioner to order civil penalties against persons that violate the subtitle; require the commissioner of the Department of Financial Institutions to promulgate any required emergency and ordinary administrative regulations on or before January 1, 2027; EFFECTIVE, in part, March 31, 2027.
Create a new section of KRS Chapter 189 to define terms related to automated license plate readers; restrict use of automated license plate readers; establish limitations on use and sale of data captured by automated license plate readers; provide that captured license plate data may be retained longer than 90 days only if it is being used in a criminal or insurance investigation or has become subject to a preservation of evidence notification; require law enforcement agencies to adopt and make public a written policy governing use of automated license plate readers; provide that any recorded images or data captured by an automated license plate reader may be made available to the National Insurance Crime Bureau or its successor organization; require the Transportation Cabinet to establish a permit process for installation of automated license plate readers on highway rights-of-way and to promulgate administrative regulations; amend KRS 189.990 to establish penalty for violation.
Amend KRS 172.100 and 172.200, relating to county law libraries, to ensure that law library funds can be expended for subscriptions to computer-assisted legal research, internet access, and computers and related equipment.
Create new sections of KRS Chapter 367 to establish requirements to protect minors from AI companion platforms and social media platforms using addictive features and predatory data collection; define terms; require AI companion platforms and social media platforms to refine their age verification for users; prohibit AI companion platforms or social media platforms from maintaining accounts for children without verifiable parental consent; create a private right of action for violations by AI companion platforms or social media platforms; authorize the Attorney General to enforce violations.
Create a new section of KRS Chapter 39G to define "center," "executive director," "foreign enterprise," and "resident of the Commonwealth"; prohibit a resident of the Commonwealth from engaging in a transaction with a foreign enterprise if the transaction would result in foreign control of intellectual property, infrastructure, technology, or assets critical to the economic security of the Commonwealth, obstruction of counter-intelligence efforts, or would compromise the economic security of the Commonwealth; require the Kentucky Intelligence Fusion Center to review and investigate a transaction between a foreign enterprise and a resident of the Commonwealth; require the center to notify the executive director of the Kentucky Office of Homeland Security once it has determined that a transaction would compromise the economic security of the Commonwealth; require the center to refer the matter to the appropriate federal authorities if a transaction would compromise the security of the United States; allow the center to contact other state and local agencies and access state and local databases if necessary in pursuit of a review or an investigation; require the center to assess whether the transaction between a foreign enterprise and a resident of the Commonwealth would pose a threat to the security of the Commonwealth, the level of threat the transaction would pose, whether that threat has been mitigated, whether the transaction is with or on behalf of a foreign government, and whether a foreign entity may obtain control of critical infrastructure, technology, or assets critical to the economic security of the Commonwealth; require the center to refer the matter to the Attorney General and notify the executive director of the Kentucky Office of Homeland Security if it determines that the transaction would pose as a threat to the Commonwealth and the threat cannot be mitigated; require the center to meet with the co-chairs of the Legislative Oversight and Investigations Committee at least twice a year to discuss any findings in its review or investigations that would compromise the economic security of the Commonwealth; allow either co-chair of the Legislative Investigations and Oversight Committee to compel additional meetings; require the co-chairs of the Legislative Oversight and Investigations Committee to have required security clearance before meeting with the center; prohibit the center from meeting with the co-chairs if neither have obtained the required security clearance; exempt the meeting between the center and the co-chairs of the Legislative Oversight and Investigations Committee from the Kentucky Open Meetings Act and exempt any records produced in the meeting from the Kentucky Open Records Act; require center to submit an annual report to the Legislative Oversight and Investigations Committee; exempt certain data from the report from the Kentucky Open Records Act; exempt certain data from the report from the Kentucky Open Meetings Act; direct that the first report to the Legislative Oversight and Investigations Committee be issued by July 1, 2027.
Amend various sections and create new sections of Subtitle 11 of KRS Chapter 286 to expand the scope of the subtitle to include virtual currency kiosk business; define terms; require licensure for virtual currency kiosk business in this state; require each virtual currency kiosk business location to be approved by the commissioner of the Department of Financial Institutions; require each application for a license to engage in virtual currency kiosk business to be accompanied by a surety bond or other similar security; establish requirements for approval to engage in virtual currency kiosk business at a location in this state; apply examination, investigation, recordkeeping, registered agent, and trade practice requirements to virtual currency kiosk operators; establish reporting, transaction, trade practice, notice, disclosure, fraud detection, and refund requirements for virtual currency kiosk operators; apply license and civil penalties to virtual currency kiosk operators; authorize the commissioner to order any virtual currency kiosk operator to provide refunds and to direct any peace officer to seize, impound, or render inoperable a virtual currency kiosk; establish the purpose of the Act; amend KRS 286.2-015 to authorize political subdivisions of this Commonwealth to enact and enforce ordinances, regulations, and resolutions pertaining to virtual currency kiosk business; create a new section of KRS Chapter 367 to provide that a violation of Subtitle 11 of KRS Chapter 286 by a virtual currency kiosk operator shall be deemed a violation of, and subject to the remedies and penalties of, KRS 367.170; repeal KRS 286.11-065, relating to licenses issued under former KRS Chapter 366; require the commissioner to promulgate emergency and ordinary administrative regulations to implement the Act within 30 days after the effective date of the Act; provide that persons shall not be required to comply with licensing and other provisions of the Act until certain contingencies are satisfied.
