Bench & Bar May/June 2025

FEATURE: INTELLECTUAL PROPERTY

business has received the request and will respond in an additional 45 days with an explanation for the delay. The first step of the procedure should be to verify the identity of the requestor. If the business is unable to initially verify the identity of the requestor using “com mercially reasonable efforts,” the business may ask the requestor to provide additional information. A business may require con sumers to use an existing account, but it cannot require consumers to create an account for the purpose of exercising their rights. Because the KCDPA and ICDPA both allow a parent or legal guardian to make requests on behalf of a child, this verification procedure should also include verifying that an individual is the parent or legal guardian of a child data subject. The business must effectuate the request once it verifies the identity of the consumer. Honoring a request for deletion or correc tion may be easy, but a request for access or

portability could prove difficult. Data con cerning a single individual may be stored in a variety of file formats across many loca tions. Opting out of targeted advertising means more than just disabling third-party cookies on a website; it also means disabling tracking web beacons, pixels, SDKs, and other tracking technologies on websites, apps, and devices. The business procedures should ensure that, prior to any new cookie or ad tracking script being deployed on the website, a test is conducted to ensure that consumers who have opted out of targeted advertising and return to the website will not have the new tracking script placed on their browser or machine. If the business denies the consumer’s request, it must provide the consumer with an opportunity to exercise a right to appeal the denial. The business must inform the consumer of the final decision regarding the request within 60 days. The final disposition notice must include a written explanation of the reasons for the decision. It must also

include a method to contact the Attorney General and submit a complaint. Neither the KCDPA nor the ICDPA dictates what content must be included in the con sumer rights response besides the Attorney General contact information in the appeal denial, and no model forms have been pro duced. In this vacuum, many businesses have developed bespoke template responses. The following are template responses com panies often draft to facilitate compliance: • Request to Verify Consumer Identity • Request to Verify Parent/Guardian Identity • Notice of Inability to Verify Identity • Extension Notification • Approval of Request for Correction • Approval of Request for Deletion • Approval of Request for Access • Approval of Request for Portability

David Tachau (david@kymediation.org)

Why Use Kentucky Mediation? I’ve been litigation counsel in dozens of mediations for 25 years. I’ve appreciated mediators who were tenacious, patient, creative – and who understood the pressures I faced as counsel. I want to use this experience to make your mediation successful. My Work Experience: I’ve had a commercial litigation practice since 1984 for plaintiffs and defendants, individuals and businesses, handling a range of

contract, employment, discrimination, noncompete, insurance/policyholder, and trusts/estates disputes. My Mediation Training: Harvard Mediation Intensive; KBA Basic Mediation Training More info, rates and scheduling: www.KyMediation.org (also: www.tachaulaw.com/attorneys/david-tachau) • References available

22 may/june 2025