USA – TENNESSEE Trends and Developments Contributed by: Alisa Chestler, Matthew White and Andrew Droke, Baker, Donelson, Bearman, Caldwell & Berkowitz, PC
tion. This creates a meaningful incentive for business - es to invest in robust privacy programmes – not only to improve their operations but to build a concrete legal safeguard against potential enforcement. Tennessee’s Genetic Information Privacy Act In addition to TIPA, Tennessee has also adopted the Genetic Information Privacy Act (GIPA). GIPA regu - lates direct-to-consumer genetic testing companies and requires them to provide consumers with infor - mation about the collection, use and disclosure of their genetic data as well as a publicly available pri - vacy notice covering the company’s data collection, consent, use, access, disclosure, transfer, security, retention and deletion practices. Companies must obtain the individual’s express consent for collecting, using and disclosing genetic data, and other uses and disclosures – such as disclosures to an individual’s employer – require separate consents. In addition to the notice and consent requirements, genetic testing companies must also: • develop, implement and maintain a comprehensive security programme; • support processes that allow consumers to access their genetic data, delete their account and genetic data, and destroy biological samples; and • only disclose genetic data to law enforcement or government entities in response to valid legal process if the consumer has not provided express written consent. This law is enforced by the Tennessee Attorney Gen - eral. Data Security Beyond the data security obligations imposed by TIPA, Tennessee has adopted several other laws that establish data security and breach notification require - ments for businesses. Breach notification Tennessee’s breach notification law applies broadly to any person or business that conducts business in the state and owns or licenses computerised personal information of Tennessee residents. Under the law, an “information holder” must notify affected individu -
als within 45 days of discovering or being notified of a breach of “system security”, which is defined as the unauthorised acquisition of data that materially compromises the security, confidentiality or integrity of personal information. Importantly, the law does not apply to entities subject to the GLBA or HIPAA, and it includes a “materially compromises” threshold that effectively limits the notification obligation to breaches that pose a meaningful risk of harm to affected indi - viduals. Notably, unlike TIPA, the breach notification law pro - vides a private right of action, and injured individu - als may bring civil claims for damages and injunctive relief. However, Tennessee enacted a significant class action shield in 2024 providing that a private entity is not liable in a class action lawsuit resulting from a cybersecurity event unless the event was caused by wilful and wanton misconduct or gross negligence. This heightened standard substantially limits class action exposure for businesses that experience a data breach but have otherwise maintained reasonable cybersecurity practices. This protection is particularly significant given the nationwide surge in data breach class action filings in recent years, and it goes further than the approach taken in other states, such as Ohio and Connecticut, which offer only affirmative defences to entities that maintain conforming cybersecurity pro - grammes, rather than a broad class action shield tied to the defendant’s level of culpability. Notably, courts have held that this provision does not apply retroac - tively to cybersecurity events that occurred before its effective date. The Insurance Data Security Law Tennessee has also adopted an Insurance Data Secu - rity Law, which requires licensed insurers to develop, implement and maintain a comprehensive informa - tion security programme. Licensees must investigate cybersecurity events and notify the Commissioner of Commerce and Insurance as well as affected consum - ers within 45 days of determining that a cybersecu - rity event has occurred. This law includes exceptions for smaller licensees (eg, those with fewer than 25 employees or less than USD5 million in gross annual revenue).
611 CHAMBERS.COM
Powered by FlippingBook