LexLint.ioBeta

Know the law your code answers to.

Law / United States / Tennessee

Tennessee Information Protection Act (TIPA), de-identified data

Tenn. Code Ann. § 47-18-3207

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf

In force since .

A de-identification rule binding private bodies.

Private right of action
No
How the hook was established
express
What makes it apply
Operator establishment, Market targeting, Data subject residence
Obligation class
Disclosure, Prohibition
Audit expectation
none

What it requires

  • If you are a controller in possession of de-identified data, take reasonable measures to ensure that the data cannot be associated with a natural person (Tenn. Code Ann. § 47-18-3207(a)(1)).
  • Publicly commit to maintaining and using the de-identified data without attempting to reidentify it (Tenn. Code Ann. § 47-18-3207(a)(2)).
  • Contractually obligate recipients of the de-identified data to comply with the Act (Tenn. Code Ann. § 47-18-3207(a)(3)).
  • If you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address breaches of those commitments (Tenn. Code Ann. § 47-18-3207(d)).

These lines are LexLint's reading of the law's text.

What it makes you log

Logging duty

Section 47-18-3207 sets the conditions for holding de-identified data and the oversight a controller owes when it discloses such data. It states no log or record duty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 47-18-3207(a) requires a controller in possession of de-identified data to take reasonable measures to ensure that the data cannot be associated with a natural person, to publicly commit to maintaining and using it without attempting to reidentify it, and to contractually obligate recipients of the data to comply with the part.

Section 47-18-3201(11) defines de-identified data as data that cannot reasonably be linked to an identified or identifiable natural person, or a device linked to that individual. Section 47-18-3207(d) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to and to take appropriate steps to address breaches of those commitments.

Section 47-18-3207(b) does not require a controller or processor to reidentify de-identified data or pseudonymous data. The Attorney General and Reporter alone enforces the part, and section 47-18-3212(e) bars a private right of action.

When LexLint raises it

When your app profile says your app processes personal data or processes de-identified data.

Back to the example  ·  Lint your app

Page updated .