Ask Reggi Your Question Now
Can you summarize TNCO 47-18-2107?
Identity Theft Deterrence > Release of personal consumer information.
Short Summary
This section governs the release of personal consumer information in Tennessee. It applies to any person or business that conducts business in Tennessee, or any agency of Tennessee or its political subdivisions, that owns or licenses computerized personal information of residents of Tennessee. The section defines terms such as ‘breach of system security’, ’encrypted’, ‘information holder’, ‘personal information’, and ‘unauthorized person’. It requires information holders to disclose any breach of system security to affected residents of Tennessee within 45 days of discovery or notification, unless a longer period is required for law enforcement purposes. The section also outlines the methods of providing notice, including written notice, electronic notice, or substitute notice. It further specifies that information holders who maintain their own notification procedures in compliance with the section’s timing requirements are deemed to be in compliance. Additionally, the section addresses the notification of consumer reporting agencies and credit bureaus in the event of a breach affecting more than 1,000 persons. It grants the right to customers to institute civil actions for damages and injunctive relief for violations of this section. The section does not apply to information holders subject to certain federal acts.
Whom does it apply to?
Any person or business that conducts business in Tennessee, or any agency of Tennessee or its political subdivisions, that owns or licenses computerized personal information of residents of Tennessee
What does it govern?
Release of personal consumer information
What are exemptions?
This section does not apply to any information holder that is subject to Title V of the Gramm-Leach-Bliley Act of 1999 or the Health Insurance Portability and Accountability Act of 1996, as expanded by the Health Information Technology for Clinical and Economic Health Act
What are the Penalties?
Any customer of an information holder who is injured by a violation of this section may institute a civil action to recover damages and to enjoin the information holder from further action in violation of this section
Jurisdiction
Tennessee