Law: The Tennessee Information Protection Act ('TIPA')

Regulator: The Tennessee Attorney General ('AG')

Summary: On May 11, 2023, the Tennessee Governor signed the Tennessee Information Protection Act (TIPA) into law, which will become effective on July 1, 2025. The TIPA sets out obligations for businesses covered by its scope, such as risk assessments, data minimization requirements, and obtaining opt-in consent for processing sensitive personal information, and establishes consumer rights, including the right to know, access, correction, deletion, and data portability, as well as a right to opt out of the sale of personal information, targeted advertising, and profiling. Moreover, the TIPA provides the Tennessee Attorney General (AG) with exclusive authority to bring actions, while also recognizing that controllers or processors that comply with a privacy program that reasonably conforms to the National Institute of Standards of Technology (NIST) or other documented policies, standards, and procedures designed to safeguard consumer privacy, have an affirmative defense to a cause of action for a violation of the TIPA.

Furthermore, Tennessee has recognized the common law tort of invasions of privacy, and like all US states, it has enacted a data breach notification law under §47-18-2107 of the Tennessee Code, as amended in 2017 (the Tennessee Code). Notably, Tennessee was the first US state requiring notification of a breach of both encrypted and unencrypted information. In 2017, the Tennessee legislature amended the definition of a breach of system security to not include the good faith acquisition of personal information by an employee if the personal information is not used or subject to further unauthorized disclosure.

Other Tennessee privacy laws tend to focus on consumer protection, including laws governing the privacy of consumer reports, security freeze requests, identity theft, and the protection of personally identifiable information of consumers of videotape sellers or service providers. In addition, Tennessee has the Insurance Data Security Law under §56-2-1001 et seq. of Part 10 Chapter 2 of Title 56 of the Tennessee Code which limits the disclosure or redisclosure and reuse of non-public personal information by insurers and agents. In addition, on April 28, 2023, the Tennessee Governor signed into law the Genetic Information Privacy Act, which entered into effect on July 1, 2023.

You can follow legislative developments in the US through the USA State Law Tracker.