Tennessee’s privacy law passed its state legislature on the same day as Montana’s. This article will go over everything you need to know about the Tennessee Information Privacy Act (TIPA), what you need to do to comply, and how Ethyca’s privacy solutions can help.
2023 is seeing a surge of new U.S. state privacy laws passing state legislatures!
Tennessee’s House and Senate voted to pass the Tennessee Information Privacy Act (TIPA) on the same day that Montana’s Consumer Data Protection Act (MCDPA) passed its state legislature.
The governor of Tennessee signed HB 1181 into law on May 11, 2023. The law is now scheduled to go into effect on July 1, 2025, giving businesses approximately two years to get ready.
If your business has already been preparing for the other state privacy laws that have either passed or are going into effect this year, you already have a great head start getting ready for Tennessee’s privacy law. However, TIPA still has its own unique provisions that businesses must be aware of.
Let’s go over what your business needs to know about Tennessee’s privacy law.
Tennessee’s privacy law applies to businesses that operate in Tennessee or target its products or services to Tennessee consumers. These businesses must also:
Like Iowa, Indiana, and Montana’s privacy laws, Tennessee determines applicability based on the amount of data that businesses are processing. Confirm if your business is processing the minimum amount of Tennesseans’ data to see if TIPA applies to you.
If your business is subject to Tennessee’s privacy law, you’ll need to abide by Tennessee consumers’ subject rights and consent rights. It’s also helpful to know how the law is enforced and the consequences of privacy violations.
TIPA grants Tennessee consumers data subject rights over their personal data, including:
Like in Iowa, Indiana, and Montana, Tennessee consumers do not have a private right of action. Tennessee residents do have the ability to correct their data like in Indiana and Montana, whereas residents in Iowa do not.
Tennessee residents also have specific opt-out and opt-in consent rights that businesses must enable.
For opt-out consent, consumers are allowed to opt out of the processing of personal data for:
Like Iowa’s privacy law, TIPA only specifies the ability to opt out of the sale of personal data. It’s also unclear if consumers can opt out of targeted advertising, However, unlike Indiana’s privacy law, which doesn’t mention profiling at all, TIPA mentions profiling only in the case of data protection assessments (more information about that later in this article).
TIPA is also similar to Iowa and Indiana’s privacy law in that it does not require businesses to recognize a universal opt-out mechanism.
In terms of opt-in rights, Tennessee consumers have the right to opt into the processing of “sensitive data,” which includes:
Businesses must provide a way for consumers to exercise their data subject rights and consent rights on their website by July 1st, 2025.
Companies must respond to consumers’ data subject and consent requests within 45 days and can extend for an additional 45 days. The Attorney General has exclusive authority to enforce TIPA and can issue notices of privacy violations or start civil investigations,
Once notified, businesses have a 60-day cure period to correct violations. If violations are not corrected on time, businesses can face a civil penalty of up to $15,000 per violation. That’s double the amount of most other state privacy laws (usually $7,500 per violation).
Now that you know what data subject rights and consent rights consumers have under Tennessee’s privacy law, as well as the consequences of violations, here are the additional obligations your business needs to fulfill for regulatory compliance.
One of the main business responsibilities that TIPA specifies is transparency. That means, companies must be transparent with their data collecting and processing practices.
For example, businesses must only collect and process data that’s necessary to fulfill a legitimate business purpose. They are also prohibited from discriminating against users that exercise their opt-out rights, such as through providing a lower level quality of product or service.
TIPA mandates that businesses must publish easily accessible privacy notices on their websites detailing:
To ensure your business’s data practices are transparent with consumers, work with your legal team to include all of the necessary information in your privacy notice.
TIPA also mandates that businesses enter data processing contracts between processors or entities that “process personal data on behalf of a controller.” Examples of this include third-party SaaS vendors that process and store data for your business.
These contracts must establish the terms of how the processor processes personal data for the controller, including: the purpose of processing, the type of data being processed, the duration of processing, and the rights and obligations of both controllers and processors. Data processing contracts must also ensure that the processor does not prevent the controllers’ ability to maintain compliance with Tennessee’s privacy law.
If your business works with processors or subcontractors that process data on your behalf, be sure to enter legally binding data processing contracts with each of them.
Like many other state privacy laws, TIPA requires businesses to perform data protection assessments (DPAs). DPAs are meant to help businesses carefully assess the risks of processing data on the consumer and the business itself.
These assessments should weigh the business benefits against the potential risks of the following activities:
The Attorney General can request a DPA to determine whether a company is compliant or not. To make sure your business is ready for Tennessee regulators, conduct and document DPIAs for the above processing activities.
Businesses that process de-identified and pseudonymous data must:
If your business processes de-identified and pseudonymous data, make sure the required controls and safeguards are put in place by July 1, 2025.
The most unique provision of Tennessee’s privacy law is the requirement for businesses to create a privacy policy based on the National Institute of Standards and Technology (NIST) Privacy Framework, or A Tool for Improving Privacy through Enterprise Risk Management Version 1.0.
Not following this framework is considered unfair and deceptive under TIPA, and could lead to a notice of violation by the Attorney General. To ensure your business remains compliant in Tennessee, use the NIST Privacy Framework to develop or enhance your business’ privacy program.
Making sure your business complies with all U.S. state privacy laws can feel overwhelming. Luckily, Ethyca makes it easy with the Fides privacy intelligence platform. With Fides, your business will be able to automate privacy obligations for all U.S. state privacy laws.
Read on to learn how.
Different U.S. state privacy laws have different consent requirements your business needs to provide users. With the Fides privacy intelligence platform, your business can easily manage users’ consent preferences for any privacy law.
Your business will be able to set multiple opt-out links on your website footer, customize a Privacy Center for consent intake, and set single or multiple opt-in or opt-out consent preferences to comply with different state privacy laws at the same time.
Users can submit requests through a Privacy Center on your website and verify their identity via a code sent through SMS or email. With an easy-to-use Admin UI. your business will be able to quickly process and record users’ consent preferences as proof of compliance.
All privacy regulations require businesses to fulfill user subject requests, or data subject requests (DSRs). Unfortunately, this process is often manual, costly, labor-intensive, and causes lots of friction for legal, compliance, and engineering teams.
The Fides privacy intelligence platform streamlines these workflows. Your business will be able to automate DSR processing end-to-end with Fides. Users can submit their DSR requests via the same Privacy Center they would use to submit consent requests.
After DSR requests are submitted, you can approve or deny them with the same Admin UI. Users will then receive an email containing a link to the data they requested in a machine-readable format or a confirmation that their data has been corrected or deleted.
Fides will also maintain a log of the requests your business has received and processed. That way, you can prove to regulators that your business’ privacy practices are compliant if they come knocking.
What makes the Fides privacy intelligence platform so powerful is its ability to connect to all internal and third-party databases and systems. After connecting with all systems, Fides will be able to produce a data map, or a real-time visualization, of your organization’s data flows.
Unlike tracking data through manual spreadsheets that are immediately out of date, Fides’ automated data map will give you an accurate inventory of all the data in your systems, i.e. what the data is, where it goes, and where it’s stored.
In fact, connecting to all of your systems is how Fides can automate consent management and data subject requests in the first place. Using the Fides privacy intelligence platform will integrate privacy across your entire business. That’s the true power of privacy intelligence.
Tennessee follows Iowa, Indiana, and Montana as the fourth U.S. state privacy law to be passed in 2023. But, more privacy bills are still making their way through state legislatures. Your business will need to look ahead and prepare for all of these new regulations.
Thankfully, you don’t have to do it alone. Ethyca is here to help your business fulfill its privacy obligations every step of the way. If you have any questions about new or existing privacy laws, schedule a free 15-minute call today to get privacy intelligence and expertise.
Ethyca announces fundraise, doubles annual revenue with new enterprise clients, and reveals new brand.
Today we’re announcing faster and more powerful Data Privacy and AI Governance support
See new feature releases enhancing user experience, adding new integrations and support for IAB GPP
Learn more about the privacy and data governance enhancements in Fides 2.27 here.
Read Ethyca’s CEO Cillian Kieran describe why and how an open data governance ontology enables companies to comply with data privacy regulations and frameworks.
Ethyca sponsored the Unpacking Privacy Engineering for Lawyers webinar for the Interactive Advertising Bureau (IAB) on December 14, 2023. Our CEO Cillian Kieran moderated the event and ran a practical discussion about how lawyers and engineers can work together to solve the technical challenges of privacy compliance. Read a summary of the webinar here.
Our team of data privacy devotees would love to show you how Ethyca helps engineers deploy CCPA, GDPR, and LGPD privacy compliance deep into business systems. Let’s chat!
Speak with UsStay informed with the latest in privacy compliance. Get expert insights, updates on evolving regulations, and tips on automating data protection with Ethyca’s trusted solutions.