Kentucky’s Bipartisan Data Privacy Law Serves as Model for Federal Legislation as Watts Testifies Before Congress

Kentucky Chamber President and CEO Ashli Watts testified before the U.S. House Subcommittee on Commerce, Manufacturing, and Trade Wednesday in support of H.R. 8413, the SECURE Data Act. The federal legislation is modeled after Kentucky’s comprehensive data privacy law, passed by the General Assembly in 2024, and would establish a single national standard for businesses and consumers in place of a growing patchwork of differing state laws.

The hearing, titled “Examining Legislation to Establish a Federal Comprehensive Privacy and Data Security Law,” was chaired by Congressman Gus Bilirakis of Florida. The full Committee on Energy and Commerce is chaired by Kentucky Congressman Brett Guthrie, who, in his opening remarks, pointed directly to Kentucky as the model for the legislation before the Subcommittee.

Guthrie emphasized that the bill reflects a balance between protecting individuals’ data and ensuring American businesses remain competitive. He also acknowledged the significance of the process for passing the legislation in Kentucky, noting that the broad-based coalition that was built is reflected in the consensus approach now before Congress.

In her testimony, Watts detailed how the Kentucky Chamber convened the coalition that led to the Kentucky General Assembly’s unanimous passage of House Bill 15, which was signed into law by Governor Andy Beshear. She described a deliberate process that brought together stakeholders from across industry sectors, business organizations, retailers, and privacy, security, and technology experts to negotiate a balanced, workable solution.

The Kentucky Chamber’s support is part of a broad national coalition. The U.S. Chamber of Commerce has brought together more than 120 state and local chambers of commerce in unified support of the SECURE Data Act. The bill has earned broad bipartisan support, built on a framework enacted in 20 states by governors and legislators of both parties.

Watts emphasized the urgency of federal action, noting that when every state writes its own privacy law, even good policy creates a patchwork. She cited research from the U.S. Chamber’s Empowering Small Business report showing that nearly two-thirds of small businesses are worried that complying with different state laws will expose them to higher compliance and litigation costs — a number that jumped 14 percentage points in a single year. She also noted that a fragmented privacy landscape is estimated to cost the U.S. economy as much as $1 trillion, with $200 billion of that burden falling on small businesses.

“When customers trust that their information is being handled responsibly, they are more willing to engage, to transact and participate in the digital marketplace,” Watts said. “Clear rules help build that trust.”

She also noted that strong consumer privacy protections and economic growth are not competing goals. She outlined the consumer protections the SECURE Data Act would provide, including rights to access, correct, delete, and control personal data, as well as opt-out and opt-in requirements for sensitive information, noting that the bill establishes a national standard without a private right of action — placing enforcement with government regulators.

“This is not just a technology policy issue, it is a competitiveness issue,” Watts told the Subcommittee. “The SECURE Data Act asks Congress to extend to all Americans what Kentucky and nineteen other states have already put into law. The model is proven, and the consensus exists across party lines. What remains is for Congress to act.”

The Kentucky Chamber will continue to monitor and advocate for the passage of the SECURE Data Act as it moves through Congress.

Watch the full hearing at energycommerce.house.gov.