States across the nation continue to make strides towards improving their legal protections for personal privacy. The latest good news comes from the Bluegrass State, where the Kentucky Senate passed the Personal Privacy Protection Act (PPPA) on February 22 by a vote of 31-3. The measure, S.B. 62, previously passed out of committee in a unanimous 9-0 vote. The Kentucky Senate’s vote occurred less than a month after the Indiana Senate unanimously passed its own version of the PPPA, 50-0.

The PPPA prohibits state agencies and officials from making invasive demands or disclosures about Americans’ support for nonprofit groups. It places Kentucky in compliance with the Supreme Court’s recent and widely-supported pro-privacy ruling in Americans for Prosperity Foundation (AFPF) v. Bonta, which struck down the California Attorney General’s demand for nonprofit supporter lists and put strict guardrails around future collection of such sensitive information. Prior to this year’s legislative sessions, the PPPA was the law of the land in 14 states.

“Donors can choose which charities to support, or give to none at all. And no one has a right to force them – or organizations to which they donate – to reveal that information,” wrote Jim Waters, President and CEO of the Kentucky-based Bluegrass Institute for Public Policy Solutions, in a column for the Richmond Register.

Despite support from the nonprofit community and from state senators of both parties, the legislation has faced skepticism from two groups, the Kentucky Open Government Coalition and Kentucky Press Association (KPA). Their criticisms, outlined in a statement prior to the vote and an article in The Courier-Journal, ignore the problems the bill is designed to solve and misrepresent its impact on state law.

According to Kentucky Open Government Coalition’s Amye Bensenhaver, S.B. 62 “addresses no known problem” and “proceeds from the unsubstantiated premise that collection and disclosure will expose donors to nonprofits affiliated with public agencies to objective harm.”

The supposedly “unsubstantiated premise” that public exposure of a nonprofit’s donors can lead to harm has, in fact, formed the basis for nearly 65 years of Supreme Court precedent protecting the privacy of donors against surveillance or harassment by state officials. The Court’s unanimous decision in 1958’s NAACP v. Alabama, affirmed just two years later in Bates v. City of Little Rock, noted that compelled disclosure of an advocacy group’s members or supporters could “constitute as effective a restraint on freedom of association as” other forms of censorship prohibited by the First Amendment.

Those rulings were again reaffirmed in 2021’s AFPF decision, where lengthy litigation revealed that California state officials carelessly revealed thousands of confidential forms listing nonprofit donors’ names and addresses. These exposures put Americans at risk of harassment and retaliation for their beliefs.

That risk is no mere hypothetical – it’s a disturbingly well-documented trend. From the hack of the crowdfunding site where Canada’s “freedom convoy” raised support for their cause, to the legally-required reporting of donors to candidates and political parties, to the leaking of confidential nonprofit and taxpayer information at the IRS and state agencies, the potential for abuse of donor records is clear. We have seen small donors forced to leave their jobs, close their businesses, and flee the internet in the face of backlash to their donations. If nonprofit donors were similarly exposed, the same unfortunate fate would befall them. The PPPA ensures that will not happen.

The Kentucky Open Government Coalition’s criticism about the “public’s interest” in information about donors to nonprofits “affiliated with public agencies” misses the mark entirely. S.B. 62 includes an exemption to its robust privacy protections for nonprofits “affiliated with” a public agency when such donor and membership disclosure is required by statute. There’s no basis for the organization’s claim that nonprofits affiliated with public agencies could evade legal requirements to report certain information to the public or government officials.

For its part, the KPA says it “supports” the “fundamental right” to personal privacy protected in the AFPF decision. The Association claims, however, that the PPPA goes beyond the AFPF ruling and even “unconstitutionally restricts the public’s and press’s right to access court proceedings.” That claim is false.

The PPPA does allow judges to shield personal information from the public in court proceedings if a finding of “good cause” is shown, but it does not require them to do so. Courts would decide on a case-by-case basis whether this highly sensitive information should be revealed to the public or kept private to protect the litigants or other parties. That’s the way it should be. Even so, this issue will only arise in a sliver of court cases.

The KPA also opposes the liability the PPPA creates for state officials who violate Americans’ privacy rights. But appropriate penalties are necessary to ensure government officials take the measures protections seriously. As the California Attorney General’s demand demonstrated, Supreme Court precedent alone will not deter every state agency from seeking to pierce the privacy of nonprofits and their members.

Importantly, S.B. 62 does not prevent state agencies from enforcing existing state laws in a multitude of investigatory and statutorily required contexts, including existing laws enforced by the Attorney General, Secretary of State, and Auditor of Public Accounts. Nor does it prevent the Kentucky General Assembly from revising donor disclosure regulations under the state’s campaign finance laws. The PPPA merely ensures that donor disclosure mandates are adopted in a considered and lawful manner by preventing individual state agencies from demanding or releasing nonprofit donor information on a whim.

Kentucky Senator Whitney Westerfield, who is sponsoring the legislation, reiterated his support for personal privacy protections in light of these unfounded criticisms.

“I believe the privacy of Kentucky nonprofit donors should be private and safe, consistent with the Bonta decision, in a manner that protects Kentuckians’ First Amendment rights,” he told the Courier-Journal.

So do we. Let’s hope Kentucky lawmakers continue this bipartisan tradition by becoming the 15^th state to pass this vital protection for personal privacy.