Rachel Ehlers

Represented clients and led data security and incident response in hundreds of incidents, with companies ranging from Fortune 100 companies to start-ups. Represented multiple large technology clients in the acquisition of new products and technologies, including in the AI and IoT space. Developed HIPAA compliance programs for multiple covered entities and business associates. Developed and helped clients manage global privacy and security programs to meet a variety of legal requirements. Advised on governance issues related to the set-up of new technologies and platforms, many of which heavily involved the use of AI or machine learning. Advised on all types of technology and tech transactions agreements and licenses. Conducted table-top exercises and training related to global privacy and security scenarios. Advised on data subject and consumer data requests, helping build customized solutions to address data rights. Counseled boards and senior leadership on strategic business risks within cyber, privacy, and technology infrastructure.

On April 4, 2024, the Kentucky Governor Andy Brashear signed HB 15, enacting the Kentucky Consumer Data Protection Act (“KCDPA” or the “Act”), to make Kentucky the 15th US state to adopt a comprehensive privacy law. Kentucky joins New Hampshire and New Jersey in a trifecta of states that have enacted privacy legislation in the opening months of 2024. In the days since the KCDPA’s signing, the consumer privacy stakes have been raised, with the Maryland legislature’s passage of its own privacy statute, along with the introduction of the latest federal privacy bill, which would preempt the ever-growing body of state laws.

SB255 generally aligns with prevailing trends in state consumer privacy legislation, including an exemption for personal data obtained in an employment or business capacity. Organizations with privacy programs designed to comply with existing state consumer privacy requirements can leverage those efforts to achieve compliance with SB255, with attention to certain details. For example, data subject rights in New Hampshire may offer slightly broader rights than many other state consumer privacy laws – the deletion right extends to both personal data “provided by” and “obtained about” the consumer; and controllers that sell personal data or use it for targeted advertising must honor opt-out preference signals. In addition, consumers in New Hampshire will have the right to designate an authorized agent to opt-out of targeted advertising or the sale of personal data through various means, including an Internet link or a browser setting, browser extension or global device setting. Similar to other states, state authorities—in this instance, the New Hampshire secretary of state—will also have a power to issue more detailed regulations on key topics, including how consumers can exercise their rights under the law and on establishing standards for privacy notices.