USA – TENNESSEE Trends and Developments Contributed by: Alisa Chestler, Matthew White and Andrew Droke, Baker, Donelson, Bearman, Caldwell & Berkowitz, PC
anti-discrimination laws and may not discriminate against consumers who exercise their rights under TIPA. • Data protection assessments – controllers must conduct and document data protection assess - ments, which may be requested by the Tennessee Attorney General, regarding the following process - ing activities: (a) processing personal information for purposes of targeted advertising; (b) sales of personal information; (c) processing personal information for the pur - pose of profiling in certain situations; (d) processing of sensitive data; and (e) processing activities that present a heightened risk of harm to consumers. • Data processing agreements: controllers must enter into a binding contract with each proces - sor that processes personal information on their behalf. The agreement must instruct the proces - sor about the processing of data and describe the nature, purpose, type of data and duration of processing, as well as the rights and obligations of both parties. The agreement must also require the processor to: (a) impose confidentiality obligations on those involved in the processing; (b) delete or return personal information at the controller’s request at the end of the provision of services; (c) make compliance-related information available to the controller; (d) co-operate with assessments; and (e) flow down equivalent requirements to any subcontractors. Beyond their contractual duties, TIPA also imposes direct obligations on processors, requiring them to: • adhere to the controller’s instructions; • enter into binding data processing agreements; and • assist the controller with its obligations under TIPA, including by adopting appropriate measures to help respond to consumer requests and providing information necessary for data protection assess - ments.
Consumer rights Similar to the privacy laws enacted in other states, TIPA affords Tennessee consumers the following rights with respect to their personal information: • the right to confirm whether a controller is process - ing the consumer’s personal information; • the right to access their personal information; • the right to correct inaccuracies in their personal information; • the right to delete their personal information; • the right to obtain a portable copy of the personal information that the consumer previously provided to the controller; and • the right to opt out of the sale of personal informa - tion about them, targeted advertising, and profiling in furtherance of decisions that produce legal or significant effects. Controllers must respond to consumer requests with - out undue delay, and, in all cases, within 45 days of receiving the request. Similar to other states, Ten - nessee has also implemented authentication require - ments, a framework under which the controller can extend the timeline for responding, and an appeals process that can be utilised by the consumer. Enforcement and unique affirmative defence TIPA is enforced exclusively by the Tennessee Attor - ney General, and there is no private right of action. The law also specifically prohibits violations of TIPA from serving as the basis for private claims or class action lawsuits. Controllers and processors found in violation may face civil penalties of up to USD7,500 per violation, and courts may impose treble damages for knowing or wilful violations. One of TIPA’s most distinctive features is its affirma - tive defence provision. A controller or processor that adopts and maintains a privacy programme that “rea - sonably conforms” to the National Institute of Stand - ards and Technology (NIST) Privacy Framework, or similar documented policies, standards and proce - dures designed to safeguard consumer privacy, can establish an affirmative defence against enforcement actions. The programme must also provide individuals with the rights afforded under TIPA and be regularly updated and appropriately tailored to the organisa -
610 CHAMBERS.COM
Powered by FlippingBook