{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Foulston Siefkin LLP","Daniel Buller"]
[null,null,"Sarah Otto"]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Kansas"]
["Key Legislation Overview"]
["What is the key legislation?","Several statutory sections address data-security and privacy obligations under Kansas law.  The primary section governing data-security and breach-notification obligations is \nKan. Stat. Ann. § 50-7a01, et seq.The \nKansas Consumer Protection Act, \nKan. Stat. Ann. § 50-6,139b, also imposes data-retention and related obligations on holders of “personal information.”\n"]
["Key Data Protection Provisions"]
["What data is protected?","Kansas’s breach-notification law protects “personal information,” which is defined as a consumer’s first and last name or first initial and last name plus one or more of the following data elements: (i) Social Security number; (ii) driver’s license number or state identification card number; or (iii) financial account number or credit card number alone or in combination with any required security code, access code, or password that would permit access to a consumer’s financial account. \nKan. Stat. Ann. § 50-7a01(g); Kan. Stat. Ann. § 50-6,139b(a)(3).  “Personal information” does not include “publicly available information that is lawfully made available to the general public from federal, state or local government records.” \n Kan. Stat. Ann. § 50-7a01(g).  "]
["Who is subject to privacy obligations?","Kansas’s breach notification obligations apply to any “person that conducts business in [Kansas], or a government, governmental subdivision or agency that owns or licenses computerized data that includes personal information.”  \nKan. Stat. Ann. § 50-7a02(a).  \nKansas’s Consumer-Protection Act’s data-security obligations apply to all “holders” of personal information.  A “holder” is “a person who, in the ordinary course of business, collects, maintains or possesses, or causes to be collected, maintained or possessed, the personal information of any other person.  \nKan. Stat. Ann. § 50-6,139b(a)(1).  "]
["What are the principles applicable to personal data processing?","There are no specific regulations governing the collection of personal data in Kansas.  The Kansas Attorney General has exclusive authority to bring an action for violation of data-security obligations set forth in \nKan. Stat. Ann. § 50-6,139b, et seq.  Except for violations by insurance companies, the Kansas Attorney General is also empowered, though not exclusively, to bring actions for breach-notification violations under \nKan. Stat. Ann. § 50-7a01, et seq.  For breach-notification violations by an insurance company, enforcement authority is vested solely in the Kansas Insurance Commissioner. \nKan. Stat. Ann. § 50-7a02(h). Courts have noted that whether a private cause of action exists for breach-notification violations under \nKan. Stat. Ann. § 50-7a01, et seq. is ambiguous.  See, e.g., In\n re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014) (denying a motion to dismiss).  "]
["How is the processing of personal data regulated?","A holder of personal information must “maintain reasonable procedures and practices appropriate to the nature of the information, and exercise reasonable care to protect the personal information from unauthorized access, use modification or disclosure.”  \nKan. Stat. Ann. 50-6,139b(b)."]
["How are storage, security and retention of personal data regulated?","Unless otherwise required by federal law or regulation, a holder of personal information must “take reasonable steps to destroy or arrange for the destruction of any records within such holder’s custody or control containing any person’s personal information when such holder no longer intends to maintain or possess such records.”  \nKan. Stat. Ann. § 50-6,139b(b)(2).  The statute provides that destruction must be by “shredding, erasing or otherwise modifying the personal identifying information in the records to make it unreadable or undecipherable through any means.”  Id.\n"]
["What are the data subjects' rights?","N/A\n"]
["Are there restrictions on cross-border data transfers?","N/A\n"]
["Are there any notification requirements for data breaches?","If, after a prompt and reasonable investigation, the owner or licensor of personal information determines that the data has been accessed and acquired and is reasonably likely to be “misused,” the breached entity must give “notice as soon as possible to the affected Kansas resident.  Notice must be made in the most expedient time possible and without unreasonable delay,” consistent with law-enforcement needs. \nKan. Stat. Ann. § 50-7a02(a). The notice must be given to all affected Kansas residents. Id. An individual or commercial entity that maintains data that includes personal information that the individual or entity does not own or license must notify the owner or licensee of the information following a data breach if the personal information is reasonably believed to have been accessed and acquired by an unauthorized person. \nKan. Stat. Ann § 50-7a02(b). See also \nKan. Stat. Ann. § 72-6318 for similar notification obligations relating to student data. See also \nKan. Stat. Ann. § 75-7240 for responsibilities of Kansas executive branch agency heads.\n"]
["Who is the privacy regulator?","The Kansas Attorney General and the Kansas Insurance Commissioner.  See our answer to \"\nHow is the collection of personal data regulated?\"."]
["What are the consequences of a privacy breach?","For violations of Kansas’s breach-notification law, the Attorney General may bring an action in law or in equity “and for other relief that may be appropriate.” \nKan. Stat. Ann. § 50-7a02(g). This remedy is “not-exclusive” and may allow for private causes of action to address violations. See id. See also \nIn re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1169 (D. Minn. 2014). Each record that is “not destroyed” in compliance with Kansas’s data-retention law is “a separate unconscionable act” under Kansas’s \nConsumer-Protection Act and subject to civil penalties under that section. \nKan. Stat. Ann. § 50-6,139b(d)."]
["How is electronic marketing regulated?","Kansas has adopted the \nCommercial Electronic Mail Act, which prohibits the transmission of certain forms of “commercial electronic mail” from either a computer located in Kansas or to a resident the sender knows is a Kansas resident. \nKan. Stat. Ann. § 50-6,107(c).  Violators of this section are subject to civil penalties of “not less than USD $500 nor more than USD $10,000 for each such violation.”  \nKan. Stat. Ann. § 50-6,107(j)."]
["Are there any recent developments or expected reforms?","N/A\n"]