Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-3968 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/06/world-data-green-300x231.jpg" alt="connectivity" width="300" height="231" />

Tennessee <a href="http://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=SB2005">amended</a> its data breach notification statute to potentially require notification of a data breach to affected individuals regardless of whether the personal information involved in the security incident was encrypted. On July 1, Tennessee becomes the first state to remove its encryption safe harbor; there is still an ability to perform a risk analysis under the new law. This means that although there is not a blanket exception for encryption, it can still be considered as part of your risk analysis to determine if notification is necessary.

The amendment also requires businesses and government agencies to notify Tennessee residents affected by data breaches within 45 days of discovering the data breach. While the vast majority of states require notification in the “most expedient time possible” and “without unreasonable delay,” Tennessee becomes the eighth state to enact legislation that sets a specific time period for notification to affected individuals.

The new law also expands the definition of “unauthorized person.” Tennessee requires any information holder to disclose a breach of the security of the system to any resident of Tennessee whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person. According to the new law, “unauthorized person” now includes “an employee of the information holder who is discovered by the information holder to have obtained personal information and intentionally used it for an unlawful purpose.”

For additional information regarding data breach notification statutes enacted in the United States and worldwide, please refer to BakerHostetler’s <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/State_Data_Breach_Statute_Form.pdf">State-by-State Survey of Data Breach Notification Laws</a>, <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf">Key Issues in State Data Breach Notification Laws</a>, and <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/International-Compendium-of-Data-Privacy-Laws.pdf">International Compendium of Data Privacy Laws</a>.

Tennessee Revamps Its State Data Breach Notification Statute