“The SECURE Data Act is reportedly based on Kentucky's state privacy law but offers even weaker protections.”