Law / United States / 
Tennessee
Tennessee Information Protection Act, sensitive data and biometric definition
Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Obtain a Tennessee consumer's consent before processing sensitive data, including biometric or genetic data processed to uniquely identify the individual.
- Do not assume Tennessee's recording-derived exclusion protects you elsewhere. A faceprint or voiceprint your product extracts from a photograph, video, or audio recording is categorically outside TIPA's biometric-data definition, unlike Maryland, Minnesota, and New Jersey, where the same extraction claws back into a consent duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a faceprint or voiceprint that a controller derives from a photograph or recording in order to identify a specific individual excluded from "biometric data" by the exclusion of "data generated from a photograph or video or audio recording" in Tenn. Code Ann. § 47-18-3201(3)(B)?
What it makes you log
Logging duty
Section 47-18-3204(a)(6) bars a controller from processing sensitive data, including genetic or biometric data processed to identify a person, without the consumer's consent (or, for a known child, without following the federal Children's Online Privacy Protection Act). Section 47-18-3201(6) defines consent as a clear affirmative act and allows a written statement, which makes the consent a condition of processing and states no duty to keep a record of it or to show it on demand. The documented data protection assessment that section 47-18-3206(a)(4) requires for the processing of sensitive data is a duty the Act's general row carries. The row cites the whole of sections 47-18-3201 to 47-18-3214, so it takes the Act's reach test: section 47-18-3202 applies the Act to persons that conduct business in the state producing products or services that target residents, and section 47-18-3201(7) defines a consumer as a resident.
- Kind
- None
- As of
What this law does
TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.
"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.
This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .