A revised version of a bill amending the Kentucky open records law — withdrawn earlier this year following strong protests from open government advocates — has been re-filed.

https://apps.legislature.ky.gov/record/21RS/HB520.html

The re-filed bill, HB 520, seems to more closely follow the New Jersey law — known as Daniel's Law — which inspired it.

Daniel's Law was enacted in November 2020 to protect the home addresses and telephone numbers of judges, prosecutors, and law enforcement officers from public disclosure. It honors the late son of U.S. District Court Judge Esther Salas, Daniel, who was murdered in his family home — and his father seriously wounded —by an individual who had compiled personal information about Judge Salas, including her home address.

https://nj.gov/governor/news/news/562020/approved/20201120b.shtml

https://www.law.com/njlawjournal/2020/11/20/salas-speaks-out-as-daniels…

On February 11, Rep. John Blanton (R-Salyersville) filed HB 520. Blanton withdrew the earlier version of the bill, HB 141, on January 7 after it provoked the ire of the media, the Kentucky Press Association, the Kentucky Open Government Coalition, and others.

https://www.facebook.com/419650175248377/posts/826829887863735/?d=n

https://www.facebook.com/419650175248377/posts/830067930873264/?d=n

https://www.facebook.com/419650175248377/posts/861895964357127/?d=n

https://www.facebook.com/419650175248377/posts/842690806277643/?d=n

HB 141 declared that all personally identifiable information relating to judicial officers, prosecutors, and law enforcement officers — including first and last names — "shall be exempt from the open records act and shall not be released." The bill forbade public agencies from posting, re-posting, publishing, or otherwise making personally identifiable information available.

The earlier bill placed an affirmative duty on public agencies to remove any personally identifiable information from the internet or "any other medium under the control of the public agency" within 72 hours of the bill's effective date.

HB 520 eliminates some of these draconian measures. Although "personally identifiable information" is more broadly defined in Blanton's HB 520 than in the New Jersey law on which it is based, it omits the first and last names of judges, prosecutors, and law enforcement officers from the new definition. This was the item of information included in his earlier bill — HB 141 — that drew the loudest criticism.

We can quibble about some of additional items included in the 12 subpart definition of personally identifiable information in HB 520, but most of them — home address, social security numbers, dates of birth, personal telephone and e-mail addresses, financial information, motor vehicle information — already enjoy protection under the privacy exception in the open records law or under other laws.

https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=49156

Most importantly, HB 520 omits the language in HB 141 declaring the information exempt, prohibiting publication of the information, and imposing an affirmative duty on public agencies to remove any personally identifiable information from the internet or "any other medium under the control of the public agency" within 72 hours of the bill's effective date.

Under HB 520, these duties are only triggered when the judge, prosecutor, law enforcement officer, a member of his/her immediate family, or his/her authorized agent submits a written request that the public agency designate the personally identifiable information as confidential and ensure that it is not posted, re-posted, or published.

A written request also triggers the agency's duty to redact the personally identifiable information within three business days or notify the requester within 24 hours if it cannot.

In other words, HB 520 requires the judge, prosecutor, or law enforcement officer to take the initiative to have the information treated as confidential. While agencies will argue — with good reason — that the requirements are still burdensome, much of that burden will surely be lifted. There appear to be no penalties for public agencies that fail to discharge these duties.

HB 520 is more expansive in the creation of criminal offenses — under Chapter 525 of the Kentucky Revised Statutes — for violation of its provisions than Blanton' earlier bill. It now extends to data brokers — defined as commercial entities that collect "personal information" in order to sell the information or provide third party access to it. Like HB 141, it also applies to "persons, a term that is broadly defined.

Blanton's bill expands the number of offenses associated with "knowing, reckless, or wanton" dissemination. It ratchets up penalties depending on the type of injury the judge, prosecutor, or law enforcement officer — collectively known as "law enforcement officials" — suffers, including a Class A felony if dissemination of the information results in the official's, or his family member's, death and a Class B felony if dissemination results in a loss of $1 million or more.

And like the earlier bill, it amends KRS Chapter 411 to create an independent civil action against data brokers and "persons" if dissemination places the law enforcement official — judge, prosecutor, or law enforcement officer collectively denominated — or his/her family "in reasonable fear of physical injury or reasonable fear of harm to their property" and the personally identifiable information was not removed upon request.

Daniel's law received broad support in New Jersey. A similar bill was nearly adopted in Congress. Sen. Rand Paul (R-Kentucky) blocked the bill, which also prevented data brokers from selling or otherwise trading in the personal identifying information of federal judges. Paul sought to amend the federal bill to include similar protections for members of Congress.

This suggests that there is a perceived need to shield personal information relating to these public officers from the ease of access the internet affords.

The devil in HB 520 is in its details — or in some cases — it's lack thereof. It's broad application, confusing language, and — in some cases — vague standards will make implementation a challenge. What proof of identity will be required of a requester seeking designation of information as confidential? What is a reasonable fear of injury to self or property? What will enforcement through administrative review in the Office of the Attorney General look like? How will public agencies implement the new requirements? Does the law require the maintenance of two records sets—one redacted and one unredacted? Will data brokers and affected "persons" oppose the bill through legal action as attorneys and chiropractors did in 1994 when the open records law was amended to impose higher copying fees on commercial users of public records?

https://www.google.com/amp/s/www.nj.com/news/2020/12/nj-law-is-meant-to…

https://casetext.com/case/amelkin-v-mcclure-3

But from a public access perspective, it changes little. Public agencies regularly withhold the items of information that fall within the definition of the term "personally identifiable information." The exclusion of first and last name from that definition resolves one of the biggest problems with the earlier version of the bill.

Any amendment to the open records law is cause for concern. HB 520, in particular, raises concern because it imposes substantial additional duties on public agencies. But it should not impede the public's existing rights of access to the nonexempt portions of public records relating to judges, prosecutors, or law enforcement officers as originally feared when Blanton introduced HB 141.