USA – TENNESSEE Trends and Developments Contributed by: Alisa Chestler, Matthew White and Andrew Droke, Baker, Donelson, Bearman, Caldwell & Berkowitz, PC
• financial institutions and their affiliates subject to the Gramm-Leach-Bliley Act (GLBA). However, as is the case in all jurisdictions, the entity- level exemptions under TIPA should be reviewed care - fully. Personal information TIPA defines “personal information” broadly as “infor - mation that is linked or reasonably linkable to an iden- tified or identifiable natural person”. However, the law narrows this scope through several data-level exemp - tions. For example, TIPA does not apply to: • health records under state law and protected health information under HIPAA; • personal information processed for research pur - poses under applicable law; • consumer credit reporting data; • personal or educational information regulated by the Family Educational Rights and Privacy Act (FERPA); • personal information collected, processed, sold or disclosed under the federal Farm Credit Act; • employment-related data processed in the course of an individual’s application, employment or work as an agent or independent contractor; • publicly available information; • de-identified data created under HIPAA; • de-identified data as defined under TIPA, provided that certain requirements are met; and • aggregate consumer information. Given these exemptions, organisations should care - fully identify the data they process and determine whether any exemptions apply. It is also important to assess whether any personal information being processed is considered “sensitive data”. Under TIPA, “sensitive data” includes the fol - lowing: • personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; • genetic or biometric data processed to uniquely identify a natural person;
• personal information collected from a known child; and • precise geolocation data. Sensitive data may only be processed with the con - sumer’s consent (ie, a clear affirmative act signifying a consumer’s freely given, specific, informed and unam - biguous agreement), and any sensitive data concern - ing a known child must be processed in accordance with the Children’s Online Privacy Protection Act (COPPA). Basic responsibilities of controllers and processors Like other US state privacy laws and the EU’s Gen - eral Data Protection Regulation (GDPR), TIPA assigns responsibilities to parties based on their roles, using the common terminology of “controllers” (ie, those determining the purpose and means of processing personal information) and/or “processors” (ie, those who process the personal information on the control - ler’s behalf). This is a fact-based determination that depends on the context in which the personal infor - mation is being processed. Under TIPA, controllers must meet the following requirements. • Data minimisation: controllers must limit their col - lection of personal information to what is adequate, relevant and reasonably necessary for the dis - closed processing purpose. • Privacy notice: controllers must provide a clear, reasonably accessible privacy notice disclosing the categories and purposes of data processed, how consumers may exercise their rights, and informa - tion about any sales or personal information or targeted advertising activity, including how to opt out. • Secondary use prohibition: controllers may not process personal information beyond the purposes disclosed to the consumer without first obtaining the consumer’s consent. • Data security: controllers must implement reason - able administrative, technical and physical safe - guards appropriate to the volume and nature of the personal information they process. • Non-discrimination: controllers must not process personal information in a manner that violates
609 CHAMBERS.COM
Powered by FlippingBook