Law / United States / 
Tennessee
Tennessee Information Protection Act, consumer rights
Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Give a Tennessee consumer a means to confirm, access, correct, delete, and port their personal information, and offer an opt-out of targeted advertising, sale, and certain profiling.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request within 45 days of receipt (extendable once by 45 days) and to an appeal of a denial within 60 days of receipt.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the portability right in Tenn. Code Ann. § 47-18-3203(a)(2)(D) reach only personal information "that the consumer previously provided to the controller", or also information the controller obtained from other sources or inferred?
What it makes you log
Logging duty
Section 47-18-3203 gives a consumer rights to confirm, access, correct, delete, port and opt out, sets a 45-day response period, and requires an appeal process whose outcome is communicated to the consumer in writing with the reasons (section 47-18-3203(c)). Those are notices to the consumer, not a record the controller keeps. A controller that obtained data from another source complies with a deletion request by retaining a record of the request or by opting the consumer out, which are alternative routes and not a duty (section 47-18-3203(a)(2)(C)). The controller bears the burden of demonstrating that a request was manifestly unfounded, technically infeasible, excessive or repetitive (section 47-18-3203(b)(3)), which allocates the burden of proof on a fee or refusal and does not name a record, and the Act sets no retention period for request records. The row cites the whole of sections 47-18-3201 to 47-18-3214, so it takes the Act's reach test: section 47-18-3202 applies the Act to persons that conduct business in the state producing products or services that target residents, and section 47-18-3201(7) defines a consumer as a resident.
- Kind
- None
- As of
What this law does
Tennessee consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. A controller must respond without undue delay and in all cases within 45 days of receipt, extendable once by 45 additional days when reasonably necessary; a denial must be communicated within 45 days, and an appeal decision must issue within 60 days of receipt.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .