Processes personal data, in Tennessee

Public Chapter 246 (2023), Tenn. Code Ann. title 56, chapter 7, part 27 · Read the law's page

• As a life insurance provider, do not cancel insurance coverage for an individual or a family member of an individual based solely on the individual's or family member's genetic information (section 8(a) of Public Chapter 246).
• Do not request or require an individual to whom you provide life insurance coverage, or an individual who applies for it, to take a genetic test as a precondition of insurability, and do not require the complete genome sequencing of an individual's DNA (section 8(b) of Public Chapter 246).
• Do not access sensitive medical information, including the genetic data of an individual, without first obtaining the individual's signed, written consent (section 8(c) of Public Chapter 246).

Tenn. Code Ann. secs. 47-18-4901 to 47-18-4906 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give a Tennessee consumer essential information about your collection, use, and disclosure of genetic data and a prominent, publicly available privacy notice covering your data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices (section 47-18-4904(a)(1)).
• Obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data, clearly describing your use of the data you collect through your genetic testing product or service, who has access to test results, and how you may share the data (section 47-18-4904(a)(2)).
• If you transfer or disclose genetic data to a person other than your vendors and service providers, use it beyond the primary purpose of your product or service, or keep a biological sample after the initial testing, obtain the consumer's separate express consent for each; obtain informed consent under the federal human-subjects rules, 45 CFR Part 46, before transferring or disclosing genetic data to a third party for research, or for your own research for publication or generalizable knowledge; and obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to a consumer based on the consumer having ordered or purchased a genetic testing product or service (section 47-18-4904(a)(3)).
• Require valid legal process before you disclose a consumer's genetic data to law enforcement or a government entity without the consumer's express written consent (section 47-18-4904(a)(4)).
• Develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure (section 47-18-4904(a)(5)).
• Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and destroy the consumer's biological sample (section 47-18-4904(a)(6)).
• Do not disclose a consumer's genetic data to an entity that offers health insurance, life insurance, or long-term care insurance, or to an employer of the consumer, without first obtaining the consumer's written consent (section 47-18-4905).

Tenn. Code Ann. § 47-18-3207 · Read the law's page

• If you are a controller in possession of de-identified data, take reasonable measures to ensure that the data cannot be associated with a natural person (Tenn. Code Ann. § 47-18-3207(a)(1)).
• Publicly commit to maintaining and using the de-identified data without attempting to reidentify it (Tenn. Code Ann. § 47-18-3207(a)(2)).
• Contractually obligate recipients of the de-identified data to comply with the Act (Tenn. Code Ann. § 47-18-3207(a)(3)).
• If you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address breaches of those commitments (Tenn. Code Ann. § 47-18-3207(d)).

Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214 · Read the law's page

• Confirm TIPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.
• Use July 1, 2025 as TIPA's general effective date, not July 1, 2024. An earlier engrossed print of the enacting bill carried the 2024 date, but the final signed Public Chapter moved it to 2025.

Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214 · Read the law's page

• Expect TIPA violations to be enforced exclusively by the Tennessee Attorney General and Reporter, never by a private plaintiff or class action.
• Consider creating, maintaining, and complying with a written privacy policy that reasonably conforms to the NIST privacy framework Version 1.0, or to other documented policies, standards, and procedures designed to safeguard consumer privacy, because section 47-18-3213 makes that policy an affirmative defense to a cause of action for a violation of TIPA, not a duty. To keep the defense, update the policy to reasonably conform to a revision of the NIST or a comparable privacy framework within two years of the publication date stated in the most recent revision, and provide a person with the substantive rights TIPA requires.
• Expect a mandatory 60-day cure notice before an enforcement action, with no sunset date found in the statute's text.

Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214 · Read the law's page

• Give a Tennessee consumer a means to confirm, access, correct, delete, and port their personal information, and offer an opt-out of targeted advertising, sale, and certain profiling.
• Respond to a consumer rights request within 45 days of receipt (extendable once by 45 days) and to an appeal of a denial within 60 days of receipt.

Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214 · Read the law's page

• Obtain a Tennessee consumer's consent before processing sensitive data, including biometric or genetic data processed to uniquely identify the individual.
• Treat a faceprint or voiceprint your product derives from a photograph, video, or audio recording as biometric data under TIPA when it is generated by automatic measurement of an individual's biological characteristics and used to identify a specific individual; the consent duty for sensitive data then applies to it.