Law / United States / 
Tennessee
Tennessee Information Protection Act, Attorney General enforcement and NIST safe harbor
Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect TIPA violations to be enforced exclusively by the Tennessee Attorney General and Reporter, never by a private plaintiff or class action.
- Consider creating, maintaining, and complying with a written privacy policy that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework Version 1.0, or to other documented policies, standards, and procedures designed to safeguard consumer privacy, because section 47-18-3213 makes that policy an affirmative defense to a cause of action for a violation of TIPA, not a duty. To keep the defense, update the policy to reasonably conform to a revision of the NIST or a comparable privacy framework within two years of the publication date stated in the most recent revision, and provide a person with the substantive rights TIPA requires.
- Expect a mandatory 60-day cure notice before an enforcement action, with no sunset date found in the statute's text.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does "treble damages" in Tenn. Code Ann. § 47-18-3212(d)(2) multiply the civil penalty of up to $7,500 per violation, or some other measure of recovery, when a controller or processor willfully or knowingly violates the part?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 47-18-3212 gives the Attorney General and Reporter exclusive enforcement after a 60-day notice and cure period; a controller that cures gives the Attorney General an express written statement, which is a statement to the authority and not a record the controller keeps. Section 47-18-3213 makes a written privacy policy that reasonably conforms to the NIST privacy framework an affirmative defense; a written policy states rules and is not a record of processing, access or decisions. Section 47-18-3209 lets the Attorney General issue a civil investigative demand when there is reasonable cause to believe a violation occurred, a power to demand information that names no record. The documented data protection assessment and its production to the Attorney General sit in section 47-18-3206, which the Act's general row carries. The row cites the whole of sections 47-18-3201 to 47-18-3214, so it takes the Act's reach test: section 47-18-3202 applies the Act to persons that conduct business in the state producing products or services that target residents, and section 47-18-3201(7) defines a consumer as a resident.
- Kind
- None
- As of
What this law does
TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and the text carries no sunset clause anywhere, unlike Maryland's and Minnesota's expiring cure mechanisms. A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation.
TIPA's voluntary privacy program provision, section 47-18-3213 of the Tennessee Code, is an affirmative defense and not a duty: a controller or processor that creates, maintains, and complies with a written privacy policy that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework Version 1.0, or to other documented policies, standards, and procedures designed to safeguard consumer privacy, has a defense to a cause of action for a violation of TIPA, provided the policy is updated to reasonably conform to a revision of the NIST or a comparable privacy framework within two years of the publication date stated in the most recent revision, and provides a person with the substantive rights TIPA requires.
TIPA bars any private right of action, including a class action, under TIPA or other law.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .