Section 3 of Kentucky CDPA establishes the comprehensive consumer rights framework + closely modelled on VCDPA Virginia template. (1) Section 3(1) Five Consumer Rights: (a) Right of Access - confirm whether processing personal data + access copy in portable + readily usable format; (b) Right of Correction - correct inaccuracies based on consumer's request; (c) Right of Deletion - request deletion of personal data provided by or obtained about consumer; (d) Right of Portability - obtain copy of personal data previously provided to controller in portable + readily usable format (where technically feasible); (e) Right to Opt Out of (i) targeted advertising; (ii) sale of personal data; (iii) profiling for decisions that produce legal or similarly significant effects. (2) Section 3(2) Response Window: (a) Authenticated request - controller must respond within 45 CALENDAR DAYS of receipt; (b) One single 45-day extension permitted for complex requests; (c) Total maximum 90 days; (d) Notification to consumer of extension with reasons; (e) Information to be provided about request status. (3) Section 3 Free of Charge: (a) First request per consumer per 12-month period - FREE; (b) Manifestly unfounded or excessive requests - reasonable fee permitted; (c) Refusal allowed if request manifestly unfounded; (d) Refusal must be reasoned + appealable. (4) Section 3 Authenticated Request: (a) Authentication required to prevent fraudulent requests; (b) Reasonable authentication means - account login + email verification + KBA Knowledge-Based Authentication + government ID match; (c) Proportionate to risk of unauthorized access; (d) Authentication cannot be unduly burdensome; (e) Privacy-preserving authentication preferred. (5) Section 3 Rights Request Mechanism: (a) Controller must designate clear + conspicuous mechanism; (b) Web portal + email + phone number + form; (c) Mechanism in plain English; (d) Accessibility for disability per ADA + WCAG 2.2; (e) Mobile-friendly; (f) Privacy professional support. (6) Section 3 Refusal Grounds (Limited): (a) Manifestly unfounded + excessive frequency; (b) Threat to security of personal data; (c) Threat to other's rights; (d) State secret or law enforcement constraints; (e) Cannot verify consumer identity; (f) Refusal must provide reasoned response. (7) Section 3 Appeals Process: (a) Consumer right to appeal controller decision; (b) Appeals process must be conspicuously available; (c) 60-day appeal response window; (d) Reasoned response required for appeals; (e) Online mechanism for appeals encouraged; (f) Plain language explanation. (8) Section 3 Specific Rights Detailed: (a) Right of Access - all personal data + categories + sources + recipients + purposes + retention; (b) Right of Correction - factual inaccuracies + technical errors; (c) Right of Deletion - data provided BY consumer + data obtained ABOUT consumer (broader than some states); (d) Right of Portability - structured + commonly used + machine-readable + automated where feasible; (e) Right to Opt Out - immediate effect + cessation of processing. (9) Universal Opt-Out Mechanism (UOOM) (Section 4(3) emerging): (a) Recognized Universal Opt-Out Mechanism (e.g. GPC Global Privacy Control + emerging others); (b) Browser-level signal recognition; (c) Required to honor for targeted advertising + sale; (d) Required to honor for profiling (emerging); (e) Discoverability + verification requirements; (f) Updated annually with recognized mechanisms (Attorney General); (g) Reflects Colorado CPA + California CCPA UOOM models. (10) Children's Specific Rights (Under 13): (a) Parental request rights; (b) COPPA-aligned mechanisms; (c) Parental consent rescission; (d) Special considerations for minor data. (11) Multi-State Rights Request Coordination: (a) Multi-state rights request standardization; (b) Common request portal across states; (c) Per-state response timeline tracking; (d) Multi-state authentication standardization; (e) Privacy engineering for multi-state DSAR. (12) Penalties for Rights Violations: (a) Section 9 AG enforcement; (b) 30-day cure period; (c) Civil penalty up to USD 7,500 per violation. Coordinates with VCDPA Virginia + Indiana CDPA + Iowa ICDPA + Connecticut CTDPA + Colorado CPA + Utah UCPA + CCPA/CPRA California + Tennessee TIPA + ADPPA federal proposal + GPC Global Privacy Control + IAB TCF v2.2 + COPPA + ADA + WCAG 2.2 + NIST Privacy Framework + multi-state DSAR standards. Kentucky CDPA Consumer Rights + Section 3 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.