The stated intent of TIPA is to establish a framework for controlling and processing consumers' personal data in Tennessee. The Act applies to any individual conducting business in the state or producing products/offering services targeted to state residents. Additionally, the Act applies to individuals/entities that control or process personal data of at least 100,000 Tennessee residents or of at least 25,000 Tennessee residents that accounts for 50 percent of the gross revenue from the sale of personal data.

Act exemptions include:

• Financial institutions and data governed by the Gramm-Leach-Bliley Act
• Personal data subject to the federal Fair Credit Reporting Act (FCRA)
• Covered entities governed by the Health Insurance Portability and Accountability Act (HIPAA)
• Protected health information under HIPAA
• Nonprofit organizations
• Higher education institutions
• Personal information regulated by the Family Educational Rights and Privacy Act (FERPA)
• Data processed or maintained in the course of employment

Employers are encouraged to consult with legal counsel to determine if their use of data will be subject to TIPA in preparation for July, 2024.

Posted: June 5, 2023

All Rights Reserved © 2023 Business Information Group, Inc.
This document and/or presentation is provided as a service to our customers. Its contents are designed solely for informational purposes, and should not be inferred or understood as legal advice or binding case law, nor shared with any third parties. Persons in need of legal assistance should seek the advice of competent legal counsel. Although care has been taken in preparation of these materials, we cannot guarantee the accuracy, currency or completeness of the information contained within it. Anyone using this information does so at his or her own risk.