Tennessee Information Protection Act (TIPA)
TIPA defines “personal information” as information that is linked or reasonably linkable to an identified or identifiable natural person.2 Similar to other state privacy laws, TIPA establishes a category of “sensitive data” as personal information that includes: (1) personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (2) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; (3) the personal information collected from a known child (e.g., a natural person under 13 years of age); or (4) precise geolocation data (e.g., information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 ft.)
Is Complying with TIPA Mandatory?
The Tennessee law governs the activities of “controllers”—those determining the purpose and means of processing personal data—and “processors”—those who process the personal data on the controller’s behalf. To be applicable, TIPA requires a $25 million annual revenue threshold akin to that of the UCPA.
Unless the business is deriving more than 50% of its gross annual revenue from the sale of personal information and controls or processes the information of at least 25,000 Tennessee consumers, TIPA only applies if the business controls or processes the personal information of 175,000 Tennessee consumers—the highest state resident threshold of any enacted state privacy law to date.
What are the penalties for not complying with TIPA?
If the alleged violations are not cured, the AG may file an action and seek declaratory, injunctive and monetary relief, including a $7,500 maximum civil penalty per violation, along with reasonable attorney’s fees and investigative costs. However, in the event of willful or knowing violations, treble damages may be awarded at the court’s discretion.