Tennessee

Adds a new section to Title 39, Chapter 17, Part 10 (Sexual Offenses) making it an offense for a person to knowingly possess, distribute, or produce technology, software, or digital tools designed for the purpose of creating material that includes a minor engaged in sexual activity or simulated sexual activity that is patently offensive, reaching an AI image-generation tool purpose-built for that use.

Possession is a Class E felony, distribution a Class C felony, and production a Class B felony; a court weighs factors including the defendant's own statements, advertising, and instructional materials in deciding whether a tool was so designed. The enacting Public Chapter leaves the new provision's codified section number to be assigned by the Tennessee Code Commission.

Amends the Personal Rights Protection Act of 1984, renamed the Ensuring Likeness, Voice, and Image Security Act, to add voice to the property right an individual holds in their name, photograph, and likeness, defining voice as a sound readily identifiable and attributable to a particular individual whether or not the sound is the person's actual voice or a simulation of it.

A person who publishes, performs, distributes, or transmits an individual's voice or likeness knowing it was not authorized is liable to a civil action, and the same liability reaches a person who distributes, transmits, or otherwise makes available an algorithm, software, tool, or other technology, service, or device whose primary purpose or function is producing a particular identifiable individual's photograph, voice, or likeness, knowing that distributing it was not authorized.

Creates a new part of the criminal code defining an intimate digital depiction as one appearing to show nudity or sexual content and created or altered through digital manipulation, and a deepfake as a video, image, or audio file generated or manipulated by artificial intelligence to realistically portray something that did not occur.

A person who intentionally discloses, or threatens to disclose, an intimate digital depiction of an identifiable individual without consent, knowing or recklessly disregarding that consent was absent, is liable to a civil action and, where the disclosure is intended to harass or cause harm, commits a Class E felony, rising to a Class C felony where the disclosure could reasonably be expected to affect a governmental proceeding, including an election, or facilitate violence.

A provider of an interactive computer service is not liable for content supplied by another person or for good-faith restriction of access to such depictions.

A new section of the mental health code bars a person who develops or deploys an artificial intelligence system from advertising or representing to the public that the system is, or is able to act as, a qualified mental health professional. A violation is a violation of the Tennessee Consumer Protection Act of 1977 and, notwithstanding that act's ordinary civil penalty limits, carries its own civil penalty of five thousand dollars per violation.

The act defines artificial intelligence broadly as models and systems capable of performing functions generally associated with human intelligence, including reasoning and learning.

Section 56-2-1005(d) of the Insurance Data Security Law requires a licensee to maintain records concerning all cybersecurity events for a period of at least five years from the date of discovery of the cybersecurity event. The licensee must provide those records to the commissioner upon request.

Section 56-2-1005(e) requires a licensee that conducts an investigation or review and determines that a potential or suspected event is not a cybersecurity event to reduce that determination to writing, maintain the writing for at least five years from the date of discovery of the event, and provide it to the commissioner upon request.

Section 56-2-1005(a) requires a licensee that learns that a cybersecurity event has or may have occurred to conduct, or to have a designated outside vendor or service provider conduct, a prompt investigation. Section 56-2-1005(c) requires a licensee that learns of an event in a system maintained by a third-party service provider to complete the actions required by subsection (b), or to confirm and document that the provider has completed them.

Section 56-2-1003 defines a licensee as a person licensed, authorized to operate, or registered, or required to be, under title 56. Section 56-2-1009(a)(1) provides that the part does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets. Section 56-2-1010 provides that the commissioner may seek penalties under section 56-2-305 for a violation of the part.

Section 4 of the act that enacted the Insurance Data Security Law provides that, for all purposes other than promulgating rules, the act takes effect July 1, 2021 and applies to breaches that occur or are discovered on or after that date.

House Bill 766, assigned Public Chapter Number 345 by the Secretary of State, enacts the Insurance Data Security Law and amends chapter 2 of title 56 of the Tennessee Code.

Section 56-2-1006(a) of the Insurance Data Security Law requires a licensee to notify the commissioner as soon as practicable, and in no event more than three business days, following a determination that a cybersecurity event has occurred, if the licensee is domiciled in this state or this state is its home state and the event has a reasonable likelihood of materially harming a consumer residing in this state or a material part of its normal operations, or if the licensee reasonably believes that the nonpublic information of 250 or more consumers residing in this state is involved and the event must be reported to a government body, self-regulatory agency, or other supervisory body or has a reasonable likelihood of materially harming a consumer or a material part of its normal operations.

Section 56-2-1006(b) of the Insurance Data Security Law requires a licensee that must notify the commissioner to provide, in a format directed by the commissioner, as much as is available of a listed set of information, including the date of the event, how the nonpublic information was exposed, how the event was discovered, the number of total consumers in this state affected, and a copy of the licensee's privacy policy, and to continually provide material updates or supplements.

Section 56-2-1006(c) of the Insurance Data Security Law requires a licensee, following a determination that a cybersecurity event has occurred and has a reasonable likelihood of materially harming a consumer, to notify consumers residing in this state whose nonpublic information has been acquired, or reasonably believed to have been acquired, no later than forty-five days after the determination, unless a longer period is required due to the legitimate needs of law enforcement.

Section 56-2-1006(d) of the Insurance Data Security Law requires a licensee that becomes aware of a cybersecurity event in an information system maintained by a third-party service provider to treat the event as if it occurred in its own system, with its time limits running from when the provider notifies it or it otherwise gains actual knowledge, whichever is sooner.

Section 56-2-1006(e) of the Insurance Data Security Law requires a licensee acting as an assuming insurer that does not have a direct contractual relationship with the affected consumers to notify the affected ceding insurers and the commissioner of the licensee's state of domicile within three business days of determining that a cybersecurity event has occurred.

Section 56-2-1006(f) of the Insurance Data Security Law requires an insurer, where consumer notice is required, to notify the producers of record of all affected consumers, if known, as soon as practicable but not later than when the notice is provided to the affected consumers, and excuses the insurer where it does not have the current producer of record information for an individual consumer.

Section 56-2-1009(a)(1) of the Insurance Data Security Law provides that the part does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets. Section 56-2-1002(b) of the Insurance Data Security Law provides that the part does not create or imply a private cause of action for a violation of the part, and does not limit a private cause of action that otherwise exists.

Section 56-2-1010 of the Insurance Data Security Law provides that the commissioner may seek penalties under section 56-2-305 for a violation of the part. Section 4 of the act that enacted the Insurance Data Security Law provides that, for all purposes other than promulgating rules, the act takes effect July 1, 2021 and applies to breaches that occur or are discovered on or after that date. Public Chapter 345 was signed by the Governor on May 18, 2021.

The House adopted Amendment 1 (HA0155) on April 8, 2021. The Senate adopted Senate Amendment 1 (SA0267) on April 15, 2021, passed the bill as amended on April 19, 2021, and the House concurred in the Senate amendment. Senate Commerce and Labor Amendment 1 to SB0725, which names Senate Bill 725 and House Bill 766, deletes all language after the enacting clause and substitutes the Insurance Data Security Law.

Section 56-2-1009(a)(2) and (3) of the Insurance Data Security Law treat a licensee subject to the federal Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules that maintains nonpublic information in the same manner as protected health information, and a licensee subject to Title V of the Gramm-Leach-Bliley Act, as meeting the consumer notice requirement of section 56-2-1006(c) if the licensee is compliant with the federal law and submits a written statement certifying its compliance.

Section 56-2-305 of the Tennessee Code, in the May 2021 archive copy, lets the commissioner, after notice and a contested case hearing, order an insurer, person or entity required to be licensed by the division of insurance that has violated any statute, rule or order to cease and desist, to pay a monetary penalty of not more than $1,000 for each violation up to an aggregate of $100,000, and to suspend or revoke its license, and sets a higher tier for a knowing violation.

Section 56-2-305 of the Tennessee Code, in the May 2021 archive copy, does not apply to individual or business entity insurance producers licensed under chapter 6, part 1 of title 56.

TIPA governs private-sector processing of Tennessee residents' personal information, enacted as House Bill 1181, Public Chapter 408 of the 113th General Assembly. The bill passed the House April 21, 2023 and was approved by the Governor in May 2023; a floor amendment moved the general effective date from an engrossed print's July 1, 2024 to the signed Public Chapter's July 1, 2025, which the Secretary of State's official publication confirms as authoritative.

A separate data protection impact assessment look-back date, July 1, 2024, is unaffected by the general effective-date correction.

Rule 0780-1-72-.02(1) of the Rules of the Tennessee Department of Commerce and Insurance governs the treatment of nonpublic personal information about individuals by all licensees of the Insurance Division, requires a licensee to provide notice to individuals about its privacy policies and practices, describes the conditions under which a licensee may disclose nonpublic personal information to affiliates and nonaffiliated third parties, and provides methods for individuals to prevent a licensee from disclosing that information.

Rule 0780-1-72-.02(2) applies to nonpublic personal information about individuals who obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees, and does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.

Rule 0780-1-72-.04 defines a licensee as all licensed insurers, agents and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the Tennessee Insurance Law, codified at title 56 of the Tennessee Code.

Rule 0780-1-72-.04 defines nonpublic personal information as personally identifiable financial information and any list, description or other grouping of consumers, and publicly available information pertaining to them, that is derived using personally identifiable financial information that is not publicly available.

Rule 0780-1-72-.05(1) requires a licensee to provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal information about the consumer to a nonaffiliated third party other than as rules .15 and .16 authorize.

Rule 0780-1-72-.06(1) requires a licensee to provide customers a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.

Rule 0780-1-72-.07(1) requires each initial, annual and revised privacy notice to include the categories of nonpublic personal information the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom it discloses, an explanation of the consumer's right to opt out and how to exercise it, and the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal information.

Rule 0780-1-72-.08(1) requires a licensee that must provide an opt out notice to give each consumer a clear and conspicuous notice that states that the licensee discloses or reserves the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt out right.

Rule 0780-1-72-.11(1) bars a licensee from disclosing, directly or through any affiliate, any nonpublic personal information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

Rule 0780-1-72-.13(1) bars a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar access number or access code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer.

Rule 0780-1-72-.23 bars a licensee from unfairly discriminating against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal information, and does not prohibit licensees from engaging in their appropriate or acceptable methods for insurance underwriting. Rule 0780-1-72-.24 subjects any violation of the rule to the penalties delineated or referenced in Public Chapter 107 of the 2001 Public Acts.

Rule 0780-1-72-.26(1) states that the regulations impose substantially and materially the same requirements as the Public Necessity Rules that became effective July 1, 2001. Rule 0780-1-72-.26(2) requires a licensee to provide an initial notice to consumers who are its customers on July 1, 2001 by that date. Rule 0780-1-72 was filed on August 30, 2001 and became effective on November 13, 2001.

Section 1 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that a person who discloses nonpublic personal information contrary to Title V of the Gramm-Leach-Bliley Act of 1999, or who violates a rule lawfully promulgated under the section, engages in an unfair or deceptive act or practice, subjecting the person to the penalties delineated in section 56-8-109.

Section 2 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that nothing in the act creates a private cause of action and that the Commissioner of the Department of Commerce and Insurance is responsible for enforcement of the act. Section 3 of the 2001 act on the disclosure of nonpublic personal information by insurance licensees provides that, for all purposes other than rulemaking, the act takes effect July 1, 2001.

Tennessee consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. A controller must respond without undue delay and in all cases within 45 days of receipt, extendable once by 45 additional days when reasonably necessary; a denial must be communicated within 45 days, and an appeal decision must issue within 60 days of receipt.

TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and the text carries no sunset clause anywhere, unlike Maryland's and Minnesota's expiring cure mechanisms. A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation.

TIPA's voluntary privacy program provision, section 47-18-3213 of the Tennessee Code, is an affirmative defense and not a duty: a controller or processor that creates, maintains, and complies with a written privacy policy that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework Version 1.0, or to other documented policies, standards, and procedures designed to safeguard consumer privacy, has a defense to a cause of action for a violation of TIPA, provided the policy is updated to reasonably conform to a revision of the NIST or a comparable privacy framework within two years of the publication date stated in the most recent revision, and provides a person with the substantive rights TIPA requires.

TIPA bars any private right of action, including a class action, under TIPA or other law.

House Bill 1310, assigned Public Chapter Number 324 by the Secretary of State, enacts the Genetic Information Privacy Act and amends title 47 of the Tennessee Code.

Section 47-18-4902(4) of the Genetic Information Privacy Act defines a direct-to-consumer genetic testing company as an entity that offers consumer genetic testing products or services directly to a consumer, or collects, uses, or analyzes genetic data that resulted from a direct-to-consumer genetic testing product or service and was provided to the company by a consumer, and excludes a law enforcement agency and an entity engaged in research conducted in accordance with the federal human-subjects rules.

Section 47-18-4903 of the Genetic Information Privacy Act provides that the part does not apply to protected health information collected by a covered entity or business associate, a public or private institution of higher education, an entity owned or operated by one, biomedical or academic research conducted by a research hospital, academic medical center or affiliated entity that is not a direct-to-consumer genetic testing company, genetic data shared with or by such an entity for biomedical or academic research or to find causes of or cures for a disease or medical condition, or the sharing of genetic data that does not require consent under the federal human-subjects rules.

Section 47-18-4904(a)(1) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to provide a consumer essential information about its collection, use, and disclosure of genetic data and a prominent, publicly available privacy notice covering its data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.

Section 47-18-4904(a)(2) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to obtain a consumer's initial express consent for collection, use, or disclosure of genetic data that clearly describes the company's use of the data, specifies who has access to test results, and specifies how the company may share the data.

Section 47-18-4904(a)(3) of the Genetic Information Privacy Act requires a company that engages in the listed conduct to obtain a consumer's separate express consent for transfer of genetic data to a person other than its vendors and service providers, for use beyond the primary purpose and for retention of a biological sample after the initial testing, informed consent under the federal human-subjects rules for transfer to a third party for research, and express consent for marketing based on the genetic data.

Section 47-18-4904(a)(4) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to require valid legal process for its disclosure of a consumer's genetic data to law enforcement or a government entity without the consumer's express written consent.

Section 47-18-4904(a)(5) and (6) of the Genetic Information Privacy Act require a direct-to-consumer genetic testing company to develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure, and to provide a process for a consumer to access the genetic data, delete the account and genetic data, and destroy the biological sample.

Section 47-18-4904(b) of the Genetic Information Privacy Act allows a company with a first-party relationship to a consumer to provide customized content or offers on its website or through its application or service without the consumer's express consent to marketing.

Section 47-18-4905 of the Genetic Information Privacy Act bars a direct-to-consumer genetic testing company from disclosing a consumer's genetic data to an entity that offers health insurance, life insurance, or long-term care insurance, or to an employer of the consumer, without first obtaining the consumer's written consent.

Section 47-18-4906 of the Genetic Information Privacy Act makes the division of consumer affairs in the office of the attorney general and reporter responsible for enforcing the part, requires the division to establish a means for a consumer to submit a complaint, and requires it to promulgate rules. Section 2 of the act that enacted the Genetic Information Privacy Act provides that the Act takes effect July 1, 2023, and applies to conduct occurring on or after that date.

Public Chapter 324 was signed by the Governor on May 3, 2023. The House adopted Amendment 1 (HA0269) on April 6, 2023. The Senate withdrew Senate Amendment 1 (SA0282) on April 10, 2023, substituted the House bill for its companion Senate bill, and passed it on April 11, 2023. Amendment 1 to HB1310 in House Commerce deletes all language after the enacting clause and substitutes the Genetic Information Privacy Act.

House Bill 1309, assigned Public Chapter Number 246 by the Secretary of State, prohibits a life insurance provider from canceling a life insurance policy based on genetic information, from requesting or requiring genetic testing as a condition of insurability, and from accessing the genetic data of an individual without consent, and amends part 27 of chapter 7 of title 56 of the Tennessee Code.

The life insurance provider section added to part 27 of chapter 7 of title 56 of the Tennessee Code bars a life insurance provider from canceling insurance coverage for an individual or a family member of an individual based solely on the individual's or family member's genetic information.

The life insurance provider section added to part 27 of chapter 7 of title 56 of the Tennessee Code bars a life insurance provider from requesting or requiring an individual to whom the insurer provides life insurance coverage, or an individual who applies for life insurance coverage, to take a genetic test as a precondition of insurability, and from requiring the complete genome sequencing of an individual's DNA.

The life insurance provider section added to part 27 of chapter 7 of title 56 of the Tennessee Code bars a life insurance provider from accessing sensitive medical information, including the genetic data of an individual, without first obtaining the individual's signed, written consent.

The life insurance provider section added to part 27 of chapter 7 of title 56 of the Tennessee Code does not prevent a life insurance provider from requesting or obtaining existing health information for underwriting, including genetic information contained within an individual's medical record. The act that added the life insurance provider section defines a life insurance provider as an insurer or other entity providing life insurance coverage.

The act that added the life insurance provider section provides that, for all purposes other than promulgating rules, the act takes effect July 1, 2023 and applies to policies of insurance entered into, issued, amended, or renewed on or after that date. Public Chapter 246 was signed by the Governor on May 3, 2023. Section 1 of the act deletes section 56-7-2701 in its entirety.

Sections 3 to 7 of the act change part 27's existing sections to refer to a health insurance provider, delete the words life insurance policy from section 56-7-2705, and extend section 56-7-2706 to a health insurer or life insurer. The bill page for HB1309 lists no amendments for HB1309 or for its companion SB1294. The Senate substituted the House bill for its companion bill and passed it on March 31, 2023, after the House passed it on March 21, 2023.

Section 56-2-305 of the Tennessee Code, in the May 2021 archive copy, lets the commissioner, after notice and a contested case hearing, order an insurer, person or entity required to be licensed by the division of insurance that has violated any statute, rule or order to cease and desist, to pay a monetary penalty of not more than $1,000 for each violation up to an aggregate of $100,000, and to suspend or revoke its license, and sets a higher tier for a knowing violation.

House Bill 1931, assigned Public Chapter Number 757 by the Secretary of State, enacts the Student Online Personal Protection Act and amends title 49 of the Tennessee Code. The Student Online Personal Protection Act defines an operator as the operator of an Internet web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes.

The Student Online Personal Protection Act defines covered information as personally identifiable information or material, or information linked to it, in any media or format that is not publicly available and is created by or provided to an operator by a student or the student's parent or legal guardian, created by or provided to an operator by an employee or agent of a K-12 school or a local education agency, or gathered by an operator through its site, service, or application for K-12 school purposes and personally identifies a student.

Section 3(a)(1) of the Student Online Personal Protection Act bars an operator from knowingly engaging in targeted advertising on its site, service, or application, or targeting advertising on any other site, service, or application based on any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of its site, service, or application for K-12 school purposes.

Section 3(a)(2) of the Student Online Personal Protection Act bars an operator from knowingly using information, including persistent unique identifiers, created or gathered by its site, service, or application to amass a profile about a student except in furtherance of K-12 school purposes. Section 3(a)(3) of the Student Online Personal Protection Act bars an operator from knowingly selling or renting a student's information, including covered information.

Section 3(a)(4) of the Student Online Personal Protection Act bars an operator from knowingly disclosing covered information unless the disclosure falls within the listed grounds, such as furtherance of the K-12 school purpose, legal and regulatory compliance, the judicial process, protecting safety or security, a school, educational, or employment purpose requested by the student or parent, or a third party that the operator contractually bars from using the information for any other purpose.

Section 3(c) of the Student Online Personal Protection Act requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and to delete a student's covered information within a reasonable time if the K-12 school or local education agency requests deletion, unless a student or parent or legal guardian consents to its maintenance.

Section 3(g)(1) of the Student Online Personal Protection Act provides that any violation of the section constitutes an unfair or deceptive act or practice affecting the conduct of trade or commerce under the Tennessee Consumer Protection Act of 1977 and shall be enforced solely by the attorney general and reporter in the attorney general's discretion.

Section 3(g)(2) of the Student Online Personal Protection Act provides that in an action brought by the attorney general the court may award or impose any relief available under the Tennessee Consumer Protection Act of 1977. Section 4 of the Student Online Personal Protection Act provides that the act takes effect July 1, 2016. Public Chapter 757 was signed by the Governor on April 26, 2016. The House adopted Amendment 1 (HA0885) on March 21, 2016.

The Senate substituted the House bill for its companion bill and passed it on March 30, 2016. Amendment 1 (SA0883) to SB1900, the companion Senate bill, was withdrawn on March 30, 2016. Education Administration and Planning Amendment 1 to HB1931 deletes all language after the caption and substitutes the Student Online Personal Protection Act.

Section 49-1-708 of the Tennessee Code, in the May 2021 archive copy, is headed Student online personal protection act and opens with the prohibition that an operator shall not knowingly engage in targeted advertising on the operator's site, service, or application. The history note of section 49-1-708 in the May 2021 archive copy of the Tennessee Code lists Acts 2016, chapter 757, section 3.

TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.

"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.

This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found.

Section 39-14-602 of the Tennessee Code, part of the Tennessee Personal and Commercial Computer Act of 2003, as restated by Public Chapter 1042 of 2022, which deleted subsections (a) through (c) and substituted the text described here (effective July 1, 2022, for acts on or after that date). Subsection (b)(1) makes it an offense to intentionally and without authorization, directly or indirectly, access any computer, computer system, or computer network, a Class A misdemeanor.

Subsection (a)(1)(B) makes it an offense to intentionally and without authorization, directly or indirectly, alter, damage, destroy or disrupt a computer or its data, or make or cause to be made an unauthorized copy of computer data, computer programs or computer software, with penalties under § 39-14-105. Subsection (c) provides that operating a computer network in such a way as to allow anonymous access to that network constitutes implicit consent to access under the part.

The Insurance Data Security Law requires each licensee to develop, implement, and maintain a comprehensive, written information security program based on its risk assessment. A licensee must establish a written incident response plan designed to promptly respond to and recover from a cybersecurity event. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation.

The Law does not apply to a licensee with fewer than 25 individuals, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets. The commissioner may seek penalties under section 56-2-305 for a violation of the Law. The Law takes effect on July 1, 2021.

A public utility that provides electric, water, wastewater, or natural gas services must prepare and implement a cyber security plan to protect its facilities from unauthorized use, alteration, ransom, or destruction of electronic data, and must annually submit documentation of its compliance to the commission by July 1. A utility must assess and update the plan at least once every two years to address new threats.

The documentation must be made in writing and under oath by the chief executive officer, president, or other person with an equivalent role of the utility. A utility that fails to comply is subject to reasonable sanctions ordered by the commission as described in rule.

The Commission's rule requires the annual filing to include contact information for the employees responsible for cybersecurity, a statement whether the utility conducts annual cybersecurity training, and a statement whether the utility has procured cybersecurity insurance. Public Chapter 1111 was signed into law on June 1, 2022.

For the part on utility cyber security plans, a utility means an entity subject to the jurisdiction of the water and wastewater financing board or the utility management review board, a cooperative, or a county-owned or municipal-owned utility that provides electric, natural gas, or propane services to the public.

A utility must prepare and implement a cyber security plan by July 1, 2023, or within one year after the utility is formed, whichever is later, and must assess and update it every two years to address new threats. The comptroller of the treasury, or the comptroller's designee, must verify each year that a utility has implemented a cyber security plan.

For a cooperative or a county-owned or municipal-owned utility that has not implemented or updated a plan, the comptroller must impose reasonable sanctions. The comptroller of the treasury enforces the part and may promulgate rules necessary to effectuate it. Public Chapter 1111 was signed into law on June 1, 2022.

State agencies must notify the Comptroller of the Treasury of any confirmed or suspected unauthorized acquisition of computerized data and any confirmed or suspected breach of a computer information system or related security system. The Comptroller states that the report should be made within five working days after confirming or suspecting the unauthorized acquisition or breach.

A state agency is not required to notify the Comptroller of individual occurrences of malware or spyware unless the occurrence led to the unauthorized acquisition of computerized data or compromises a security system established to safeguard data and computer information systems.

A state entity must not submit payment to an entity that has engaged in a cybersecurity incident by encrypting data and then offering to decrypt it in exchange for a ransom payment. A state entity experiencing a ransom request in connection with a cybersecurity incident must immediately notify and consult with the technology and innovation division of the Tennessee Bureau of Investigation.

A state entity does not include a vendor, contractor, insurance company, law firm, or other third party that has a contract, or does other business, with a state entity. The act takes effect upon becoming a law.

A utility must electronically notify the Commission's Executive Director of any cybersecurity incident that results in interruption of service within 72 hours after discovery and confirmation. Where law enforcement prohibits notice or recommends against it to avoid compromising an investigation, notification is required within 24 hours after the restriction is lifted.

The rule defines a cybersecurity incident to include an event that is under investigation as a possible incident without final determination of its root cause or nature. The rules apply to a public utility that provides electric, water, wastewater, or natural gas services. After a hearing, the Commission may impose reasonable sanctions, including civil and monetary penalties, against a utility in non-compliance with the rules.

Commission Staff has cited Rule 15 April 1220-.04, which sets the information required in the annual filing, in a complaint against a utility that did not file its cybersecurity documentation by July 1, 2024.

Requires an individual or commercial entity that publishes or distributes a website on which one third or more of total content is content harmful to minors to perform reasonable age verification before granting access, and to re-verify after each age-verified session of at most 60 minutes. Verifiers must retain seven years of anonymized age verification data and may not retain personally identifying information. A violation is a Class C felony.

Requires social media companies to verify the age of prospective Tennessee account holders, obtain express parental consent before a minor under 18 can create or keep an account, let a parent revoke that consent, and provide parents supervisory tools including privacy settings visibility, daily time restrictions, and mandatory breaks.