Are you a professional in the financial services industry looking for ways to remain compliant with consumer data privacy laws? If so, you’ll want to familiarize yourself with the new Tennessee Information Protection Act. which is designed to protect consumers from unauthorized access or misuse of their personal data. It’s essential that organizations ensure they comply with this legislation as failure to do so could result in hefty fines or other civil penalties. In this blog post, we’ll cover everything you need to know about this important piece of regulation including key provisions, requirements for compliance , and potential impacts on your business operations. Read on for more details!
Overview of the Tennessee Information Protection Act
The Tennessee Information Protection Act (TIPA) was signed by Governor Bill Lee on May 11, 2023 after passing unanimously through both houses of the Tennessee legislature ,TIPA will not take effect until July 1, 2025.
The Tennessee Consumer Data Privacy Law regulates the collection, use, and disclosure of consumer personal data. It requires organizations to disclose their practices on collecting, using, disclosing, selling, and securely storing consumers’ personal information. The law also provides consumers with certain rights regarding their Personal Information including the right to access it or request that it be deleted or amended. The law also requires organizations to implement technical, organizational and administrative measures to protect consumers’ personal information from unauthorized access or misuse.
Who does this applies to
- This law applies to organizations with a gross revenue of more than $25 million that conduct business in Tennessee or offer products or services to Tennessee residents, and:
- Control or process the personal information of 175,000 or more Tennessee consumers
- or Control or process the personal information of 25,000 or more Tennessee consumers and generate at least 50% of gross revenue from the sale of such data.
Key Features of the Tennessee Information Protection Act
1. Data Collection Notice: Organizations must provide Tennessee Consumers with a clear and conspicuous notice at or before the point of data collection. This includes what information is being collected, how it will be used, who it will be shared with, and any other applicable details.
2. Opt-Out Rights: Organizations must allow Tennessee consumers to opt out of the sale of their personal data.
3. Right to Access: Consumers have the right to access their Personal Information, including a free copy of all collected data and a description of how it is used.
4. Data Security Requirements: Organizations must implement technical, organizational, and administrative measures to protect consumer personal information from unauthorized access or misuse.
5. Data Breach Notification: Organizations must notify consumers in the event of a data breach within 72 hours of discovering it.
Controlling Authority and Enforcement
The Tennessee Attorney General’s Office will act as the controlling authority for TIPA enforcement, If a business violates the law, the Tennessee Attorney General must give the controller 60 days’ written notice and an opportunity to remedy. If an enforcement action is taken, violations of the TIPA may result in fines of up to $7500 per violation.also there will not be private right of action.
Understanding Your Rights Under the Tennessee Information Protection Act
The Tennessee Information Protection Act provides consumers with important rights and protections when it comes to their personal data. As a consumer, you have the right to access your Personal Information, including a free copy of all collected data and a description of how it is used. You also have the right to opt out of the sale of your personal data. It’s important to understand the requirements of the Tennessee Information Protection Act and take steps to ensure your organization is compliant with the law. Doing so will help protect you, your customers, and your business from any potential fines or other civil penalties.
Controllers in Tennessee are obligated to reply to a consumer’s request for personal information within 45 days after receipt. TIPA allows businesses to use an additional 45-day extension with sufficient notice to the requesting consumer.
Consumer rights under TIPA
- The right to delete
- The right to access
- The right to know
- The right to correction
- The right to data portability
- The right to opt out of Targeted advertising, Sale
Who Is Exempt from TIPA
- Government entities, including any authority, board, body, bureau, commission, district, or agency of the state or a political subdivision of the state.
- Insurance firms licensed under state privacy lawÂ
- Nonprofit organizations
- Financial institutions covered by Title V of the Gramm-Leach-Bliley Act (GLBA)
- entities and business associates governed by Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH)
- higher education Institutions
Sensitive data types as per TIPA
- Social Security Number
- Driver’s License Numbers
- Financial Account Information
- Biometric Data, Geolocation data
- Passwords and Other Authentication Credentials.
- Medical Records or Information.
- Sexual orientation
- Racial or Ethnic Origin Information.
Privacy notices Requirements under TIPA
Controllers must provide a privacy notice to consumers detailing how they process personal information at or before the time of collection. The notice must include:
- The purpose for processing personal information
- Personal data categories processed by the controller
- Personal information categories that the controller sells to third parties,
- How consumers can use their rights, including how to challenge a controller’s decision on the consumer’s request
- The opportunity to request deletion or modification of specific personal information, as well as the right to opt out of the selling of personal information to third parties.
Data Protection Impact Assessments
Under Tennessee Information Protection Act Controllers need to complete and document a data protection assessment for each of the following personal information processing actions such as:
- Personal information processing for targeted advertising
- when selling Personal information
- Organizations process personal information for profiling purposes, which carries specific risks
- Processing of sensitive information
How Businesses Can Comply with the Tennessee Information Protection Act
1. Develop a data privacy policy: Organizations must develop and maintain a clear, publicly available data privacy policy that details the information they collect, how they use it, who they share it with, and other relevant specifics
2. Implement technical measures to protect consumer personal information: Organizations must take reasonable steps to implement technical, administrative, and organizational measures to protect consumer personal information from unauthorized access or misuse.
3. Train staff on data privacy: Organizations should train their staff on the law and its implications for their business.
4. Provide notice of a data breach: Organizations must notify consumers in the event of a data breach within 72 hours of discovering it.
5. Respond to consumer requests: Organizations must respond to a consumer’s request for information or deletion within 45 days, or provide an additional 45-day extension with sufficient notice to the requesting consumer.
6. Update policies and procedures regularly: Businesses should keep their policies and procedures up-to-date in order to stay compliant
7.Data Protection Impact Assessments: Businesses should conduct regular Data Protection Impact Assessments (DPIAs) to identify, assess and mitigate risks associated with processing personal data.
Businesses must ensure they comply with the Tennessee Information Protection Act (TIPA) by implementing strong technical and organizational measures to protect consumer data from unauthorized access or misuse, providing a privacy notice, training staff on data privacy, responding promptly to consumer requests, and conducting regular Data Protection Impact Assessments. Failing to comply with the TIPA may result in hefty monetary penalties.Â
