KRWA ADVISORY: Commercial-Use Open Records Request & Protecting Utility Information

Kentucky Rural Water Association (KRWA) has been made aware that numerous water and wastewater utilities across Kentucky have received open records requests from Jorge Salas, reportedly representing Starbridge.ai. These requests seek detailed vendor purchasing and payment information dating from January 1, 2025, to the present.

Starbridge.ai is a commercial company that collects and analyzes public-sector purchasing information to identify sales and marketing opportunities for businesses.

KRWA has obtained a legal opinion indicating that these requests constitute commercial use under KRS 61.874 of the Kentucky Open Records Act.

We are providing the following recommendations to help members comply with the law while protecting their financial resources and critical infrastructure information.

1. KRWA Recommendations — Immediate Actions

If your utility is a “public agency” (e.g. municipal owned utilities and water districts) which has received this open records request, KRWA recommends taking the following steps:

1. Respond within five business days. Kentucky law requires public agencies to provide a written response within five business days of receiving an open records request, excluding weekends and legal holidays. Do not ignore the request or assume that its commercial purpose eliminates your obligation to respond. (KRS 61.880)
2. Request commercial-use certification. Under KRS 61.874(4)(b), utilities may require the requester to provide a certified statement identifying the intended commercial use of the records. KRWA recommends obtaining this certification before proceeding with commercial-use arrangements.

First STEP: Water and Wastewater Utilities should respond immediately via email and include the following language:

Pursuant to KRS 61.874(4)(b), you must provide a certified statement concerning the commercial purpose for which the records will be used. Any time public records are requested for a commercial purpose (other than to the news media), the public agency has the right to know for what commercial purpose its records will be used. We will then prepare and require you to sign a contract to limit the use of the records to the stated purpose.  We will also state a reasonable fee for our staff’s time in preparing the response to your Open Records Request.

If your utility is a “non-public agency” (e.g. water association and investor-owned utility) you can simply ignore the Open Records Request. If Mr. Salas sends a follow-up email, you can respond by stating that “We are a water association, and our utility is not a public agency under the Kentucky Open Records Act. “

Next STEP if you receive a “Certified Statement”: Verify that the certified statement that you receive comes from a resident of the Commonwealth, otherwise it is invalid. Under the statute, the public agency can enter into a contract with Mr. Salas limiting his use of the information to the specific commercial purpose stated in the “Certification” which he makes. KRWA will make available a standard or “template” contract to our members early next week.

1. Determine applicable fees. Kentucky law permits public agencies to charge reasonable fees for commercial use, including qualifying staff time and other costs associated with producing the records. Consult legal counsel regarding the appropriate fee calculation and whether a commercial-use contract is warranted. (KRS 61.874)
2. Identify existing responsive records. Determine which existing accounting or purchasing reports contain the requested information. Utilities generally are not required to create new records or customized reports solely to satisfy a request.
3. Review records before release. Examine records for legally protected financial, personal, and critical infrastructure security information. Redact exempt information where appropriate while releasing the nonexempt portions.
4. Consult legal counsel when necessary. If the utility intends to withhold information, impose commercial-use fees, or require a commercial-use contract, ensure its actions are consistent with Kentucky law.

IMPORTANT: The immediate priority is to provide a timely written response. The utility is not necessarily required to complete production of every requested record within the initial five-business-day response period. Any delay must comply with the applicable statutory requirements.

Supplemental Information

2. Commercial-Use Protections — KRS 61.874

Kentucky law recognizes that public records may be requested for commercial purposes and provides public agencies with additional protections.

Under KRS 61.874(4), utilities may:

• Require a certified statement describing the intended commercial use.
• Require an appropriate contract specifying the authorized use and applicable fees.
• Charge reasonable commercial-use fees that may include staff time, media, mechanical processing, and qualifying costs associated with producing the records.

These protections can help prevent utilities and their customers from unnecessarily bearing the costs of commercial data collection.

Commercial use alone, however, is not grounds to deny access to otherwise disclosable public records.

3. Considerations When Providing Purchasing Records

Vendor payments, purchasing histories, and other financial transactions are generally public records. However, utilities should review the information before disclosure.

Existing records: Utilities generally must provide access to responsive, nonexempt records already maintained, including qualifying electronic records. They are not automatically required to create new records or customized reports.

Financial and personal information: Review records for bank account numbers, routing information, protected personal information, passwords, and other confidential information. Redactions must be supported by applicable law.

Detailed purchasing descriptions: Some invoices, purchase orders, and supporting documentation may contain information about critical equipment, operational systems, or facility security that requires additional review.

Partial disclosure: Under KRS 61.878(4), utilities must separate exempt information from nonexempt information and provide access to the nonexempt portions.

4. Protecting Critical Water and Wastewater Infrastructure

KRS 61.878(1)(m) provides an exemption for certain records when disclosure would have a reasonable likelihood of threatening public safety by exposing vulnerabilities related to terrorist acts, as defined by the statute.

The law specifically addresses records revealing vulnerabilities involving critical infrastructure, including drinking water, wastewater, electrical, information technology, and communications systems.

When reviewing purchasing records, utilities should pay particular attention to information concerning:

Water and Wastewater Infrastructure

• Detailed configurations of treatment plants, pump stations, lift stations, and critical distribution or collection systems.
• Security-sensitive locations and configurations of critical infrastructure.
• Chemical storage and handling arrangements that reveal security vulnerabilities.

SCADA, Automation, and Communications

• SCADA system architecture, network diagrams, and control system configurations.
• Remote access arrangements, passwords, network addresses, and authentication information.
• Cybersecurity vulnerabilities and protective measures.
• Critical telemetry and communications configurations.

Physical Security and Emergency Preparedness

• Security camera, alarm, and access control configurations.
• Security vulnerability assessments and protected response plans.
• Detailed facility drawings, schematics, or equipment specifications exposing vulnerabilities.
• Information identifying weaknesses in critical infrastructure protection measures.

Important: These categories are not automatically exempt. A utility must determine whether disclosure of the particular information meets the requirements of KRS 61.878(1)(m). Ordinary vendor names, equipment purchases, and payment amounts generally remain subject to disclosure.

If a utility denies access to records under KRS 61.878(1)(m), the statute also requires a copy of the written denial to be forwarded on the same day to the executive director of the Kentucky Office of Homeland Security and the Kentucky Attorney General.

5. Additional Legal References

The following provisions of the Kentucky Open Records Act are relevant to these requests:

• KRS 61.872: Public access to records and procedures for inspection.
• KRS 61.874: Copies, fees, and commercial use of public records.
• KRS 61.878(1)(m): Protection of certain critical infrastructure and security-sensitive information.
• KRS 61.878(4): Separation of exempt and nonexempt information.
• KRS 61.880: Requirements for responding to open records requests.

Final Reminder

Kentucky's Open Records Act requires public agencies to provide access to nonexempt public records. It also recognizes the need to protect public resources from certain commercial-use costs and safeguard information that could expose critical infrastructure vulnerabilities.

KRWA encourages members to respond promptly, exercise their rights under KRS 61.874, and carefully review records before disclosure.

Members with questions concerning their specific legal obligations, commercial-use fees, or potential exemptions should consult their legal counsel.

Sincerely,

Kentucky Rural Water Association

This advisory provides general guidance and is not a substitute for legal advice concerning an individual utility's records or circumstances.