Tennessee's Breach Notification Law: How Public Chapter 91 Rewrote Section 47-18-2107

Two Rewrites in Two Years

The current section is the product of back-to-back public chapters. In 2016, Public Chapter 692 (Senate Bill 2005, effective July 1, 2016 for breaches occurring on or after that date) amended the existing statute in four places. It added an "unauthorized person" definition covering an employee who "intentionally used" personal information "for an unlawful purpose"; it deleted the word "unencrypted" from the definition of a breach; it required notice "immediately, but no later than forty-five (45) days"; and it rewrote the GLBA and HIPAA exclusion.

The following year the General Assembly started over. Public Chapter 91 of 2017 (Senate Bill 547, substituted for House Bill 545) provides in section 1 that section 47-18-2107 "is amended by deleting the section and substituting instead the following." The bill page shows the governor signed it on April 4, 2017, and section 2 made it effective "upon becoming a law."

The enacted chapter differs from the bill as introduced. The introduced bill defined "encryption" by reference to a methodology "generally accepted in the field of information security" and placed the FIPS 140-2 reference in an exclusion from the definition of personal information. Public Chapter 91 as enacted instead puts FIPS 140-2 into the definition of "encrypted" and moves the key condition into the definition of a breach. Readers relying on the introduced bill will see a different structure from the law that passed.

The codified Tennessee Code is hosted by a commercial publisher and could not be retrieved for this post. The text below is reported from Public Chapter 91. No public chapter amending section 47-18-2107 after 2017 was located.

Who § 47-18-2107 Reaches

The section's duties fall on an "information holder," defined as "any person or business that conducts business in this state, or any agency of this state or any of its political subdivisions, that owns or licenses computerized personal information of residents of this state." State and local agencies are therefore inside the same section as private businesses, unlike Minnesota, which places government entities in a separate statute (see the post on § 325E.61).

Subsection (i) removes information holders subject to Title V of the Gramm-Leach-Bliley Act, or to HIPAA "as expanded by" the HITECH Act. The exclusion turns on whether the holder is subject to those laws, not on whether the breached data is regulated by them.

Personal information is a first name or first initial and last name with a Social Security number, a driver license number, or an account, credit or debit card number with any required code or password permitting access to a financial account. It excludes information lawfully available from government records and "information that has been redacted, or otherwise made unusable." The chapter does not define "redacted."

The Breach Definition, Encryption and the Rogue Insider

A "breach of system security" under subsection (a)(1) is the acquisition by an unauthorized person of either "(i) Unencrypted computerized data; or (ii) Encrypted computerized data and the encryption key" that "materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder." Good faith acquisition by an employee or agent for the holder's purposes is excluded if the information is not used or further disclosed.

"Materially" is a qualifier that neither the Minnesota nor the Michigan breach definition uses. The chapter does not define it.

Under subsection (a)(2), "encrypted" means data "rendered unusable, unreadable, or indecipherable without the use of a decryption process or key and in accordance with the current version of the Federal Information Processing Standard (FIPS) 140-2." The reference is to a specific federal standard. NIST's publication page for FIPS 140-2 now shows it as superseded by FIPS 140-3 and notes that testing of modules against FIPS 140-2 ended September 22, 2021. The chapter, which names 140-2 and its "current version," does not address a successor standard.

Subsection (a)(5) provides that an unauthorized person "includes an employee of the information holder who is discovered by the information holder to have obtained personal information with the intent to use it for an unlawful purpose." The 2016 version required that the employee have "intentionally used" the information; the 2017 text requires only that the employee obtained it with that intent.

The 45-Day Deadline

Subsection (b) requires disclosure to any Tennessee resident whose personal information "was, or is reasonably believed to have been, acquired by an unauthorized person" and fixes the outer limit: "The disclosure must be made no later than forty-five (45) days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement." The 2016 word "immediately" does not appear in the 2017 text.

Subsection (c) applies the same 45 days to an information holder that maintains data it does not own and must notify the owner or licensee. Subsection (d) handles law enforcement: notice may be delayed if an agency "determines that the notification will impede a criminal investigation," and if delayed must be made "no later than forty-five (45) days after the law enforcement agency determines that notification will not compromise the investigation." The delay therefore does not end the 45-day structure; it moves its starting point.

There is no risk-of-harm exception of the kind in Michigan's statute (see the post on MCL 445.72), although the materiality qualifier in the breach definition does some of the same filtering at the definitional stage.

Subsection (e) allows written notice, electronic notice consistent with the E-SIGN Act or where electronic communication has been the primary method, or substitute notice where cost would exceed $250,000, more than 500,000 people are affected, or contact information is insufficient. Substitute notice consists of email where available, a conspicuous website posting and notice to major statewide media. Under subsection (f), a holder following its own notification policy is compliant if the policy is "otherwise consistent with the timing requirements of this section." The chapter prescribes no content for the notice.

Notice to Consumer Reporting Agencies

Subsection (g) provides that if an information holder "discovers circumstances requiring notification pursuant to this section of more than one thousand (1,000) persons at one (1) time," it "must also notify, without unreasonable delay, all consumer reporting agencies, as defined by 15 U.S.C. § 1681a, and credit bureaus that compile and maintain files on consumers on a nationwide basis, of the timing, distribution, and content of the notices."

That is the only third-party notice in the section. It contains no provision for notice to the Attorney General and Reporter or any other state agency. Minnesota's equivalent duty starts at more than 500 persons and runs on a 48-hour clock; Michigan's starts above 1,000 residents and requires the number and timing of notices.

Remedies Under the Statute

Subsection (h) creates a private remedy: "Any customer of an information holder who is a person or business entity, but who is not an agency of this state or any political subdivision of this state, and who is injured by a violation of this section, may institute a civil action to recover damages and to enjoin the information holder from further action in violation of this section." The rights and remedies are "cumulative to each other and to any other rights and remedies available under law." The text limits the plaintiff class to customers and excludes customers that are themselves government agencies; it does not limit which information holders may be sued.

The section contains no civil penalty schedule and no grant of authority to the Attorney General. That is the reverse of the state's comprehensive privacy law, which gives the Attorney General exclusive enforcement and bars private suits "under this part or other law" (see the post on TIPA).

The Attorney General's office has nonetheless taken part in multistate settlements that cite state breach notification statutes. In the June 23, 2022 Carnival Cruise Line settlement, the office stated that notices to attorneys general showed Carnival first became aware of suspicious email activity in late May 2019, about 10 months before it reported the breach, and that the multistate investigation focused on "compliance with state breach notification statutes." More than 2,000 Carnival employees in Tennessee were affected, and Tennessee received $19,855.20 of a $1.25 million settlement.

Unfortunately, we live in a world where data breaches will continue to happen. What's not inevitable is how a company reacts. We hope this serves as a reminder: you are required by state law to promptly notify those affected.

Attorney General Herbert H. Slatery III, Carnival settlement release, June 23, 2022

The October 5, 2023 Blackbaud settlement resolved allegations under "state consumer protection laws, breach notification laws, and HIPAA," including that the company "failed to provide its customers with timely, complete, and accurate information regarding the breach"; Tennessee received $882,312.00 of $49.5 million. In the May 29, 2019 consent judgment with Medical Informatics Engineering, the states' claims included "Notice of Data Breach statutes"; the breach compromised data of 43,373 Tennesseans, including 14,871 Social Security numbers. None of the three releases cites section 47-18-2107 by number, and no Tennessee-only action under the section was located for this post.

Frequently Asked Questions