Who Is Covered?

A person that conducts business in Kansas, or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information. Kan. Stat. Ann. § 50-7a02(a).

What Information Is Protected?

“Personal information” means a consumer’s first name or first initial and last name linked to any one or more of the following data elements that relate to the consumer, when the data elements are neither encrypted nor redacted:

1. Social security number;
2. Driver’s license number or state identification card number; or
3. Financial account number, or credit or debit card number, alone or in combination with any required security code, access code or password that would permit access to a consumer’s financial account. The term “personal information” does not include publicly available information that is lawfully made available to the general public from federal, state or local government records. Kan. Stat. Ann. § 50-7a01(g).

What Is A “Breach”?

“Security breach” means the unauthorized access and acquisition of unencrypted or unredacted computerized data that compromises the security, confidentiality or integrity of personal information maintained by an individual or a commercial entity and that causes, or such individual or entity reasonably believes has caused or will cause, identity theft to any consumer. Good faith acquisition of personal information by an employee or agent of an individual or a commercial entity for the purposes of the individual or the commercial entity is not a breach of the security of the system, provided that the personal information is not used for or is not subject to further unauthorized disclosure. Kan. Stat. Ann. § 50-7a01(h).

What Triggers Notification?

Becoming aware of any breach of the security of the system that has resulted or has a reasonable likelihood of resulting in the misuse of the personal information of a Kansas resident. Kan. Stat. Ann. § 50-7a02(a).

Likelihood of Harm Exception: Notice is not required if, after conducting in good faith a reasonable and prompt investigation, it is determined that the breach has not and is not reasonably likely to result in the misuse of the personal information of a Kansas resident. Kan. Stat. Ann. § 50-7a02(a).

How Is Notice Provided To Individuals?

Timing: Notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system. Kan. Stat. Ann. § 50-7a02(a).

Delivery: Notice may be made by:

1. Written notice;
2. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001; or
3. Substitute notice, if the individual or the commercial entity required to provide notice demonstrates that the cost of providing notice will exceed $100,000, or that the affected class of consumers to be notified exceeds 5,000, or that the individual or the commercial entity does not have sufficient contact information to provide notice. Kan. Stat. Ann. § 50-7a01(c).

Content: None specified.

Is Notice To The Government Required?

No.

Is Notice To Credit Reporting Agencies Required?

Yes. In the event that a person discovers circumstances requiring notification pursuant to this section of more than 1,000 consumers at one time, the person shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by 15 U.S.C. § 1681a(p), of the timing, distribution and content of the notices. Kan. Stat. Ann. § 50-7a02(f).

Are There Security Measure Standards?

Yes. Unless otherwise required by federal law or regulation, a person or business shall take reasonable steps to destroy or arrange for the destruction of a customer’s records within its custody or control containing personal information which is no longer to be retained by the person or business by shredding, erasing or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means. Kan. Stat. Ann. § 50-7a03.

What Are The Possible Consequences Of A Violation?

For violations of this section, except as to insurance companies licensed to do business in this state, the attorney general is empowered to bring an action in law or equity to address violations of this section and for other relief that may be appropriate. The provisions of this section are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law. For violations of this section by an insurance company licensed to do business in this state, the insurance commissioner shall have the sole authority to enforce the provisions of this section. Kan. Stat. Ann. § 50-7a02(g).

Are There Any Exemptions/Exceptions?

Yes. An individual or a commercial entity that maintains its own notification procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of this section, is deemed to be in compliance with the notice requirements of this section if the individual or the commercial entity notifies affected consumers in accordance with its policies in the event of a breach of security of the system. Kan. Stat. Ann. § 50-7a02(d),

Also, an individual or a commercial entity that is regulated by state or federal law and that maintains procedures for a breach of the security of the system pursuant to the laws, rules, regulations, guidances or guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this section. This section does not relieve an individual or a commercial entity from a duty to comply with other requirements of state and federal law regarding the protection and privacy of personal information. Kan. Stat. Ann. § 50-7a02(e).