What does Tennessee's data breach law ask a business to do?

Who does this law apply to?

The law applies to an information holder: any person or business that conducts business in Tennessee, or any state or local agency, that owns or licenses computerized personal information of Tennessee residents. The holder must tell any resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

any person or business that conducts business in this state, or any agency of this state or any of its political subdivisions, that owns or licenses computerized personal information of residents of this state

Following discovery or notification of a breach of system security by an information holder, the information holder shall disclose the breach of system security to any resident of this state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What counts as personal information?

Personal information is a first name or first initial and last name together with a social security number, a driver licence number, or a financial account or card number with the code that opens it. Information made public by government records, or redacted or made unusable, is not included.

Means an individual's first name or first initial and last name, in combination with any one (1) or more of the following data elements: (i) Social security number; (ii) Driver license number; or (iii) Account, credit card, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account;

How fast must people be told?

Notice is due no later than 45 days from discovery or notification of the breach, unless law enforcement needs more time.

The disclosure must be made no later than forty-five (45) days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement, as provided in subsection (d).

Who else must be told?

When more than one thousand people are to be told at one time, the holder must also tell the nationwide consumer reporting agencies and credit bureaus without unreasonable delay.

information holder discovers circumstances requiring notification pursuant to this section of more than one thousand (1,000) persons at one (1) time, the information holder must also notify, without unreasonable delay, all consumer reporting agencies

Is encrypted information treated differently?

Yes. A breach covers unencrypted data, or encrypted data acquired together with its encryption key. The text defines encrypted data as data made unusable, unreadable or indecipherable without a decryption process or key.

means computerized data that is rendered unusable, unreadable, or indecipherable without the use of a decryption process or key

Unencrypted computerized data; or (ii) Encrypted computerized data and the encryption key;

What if a vendor holds the data?

An information holder that keeps personal information it does not own must tell the owner or licensee of a breach. The text sets the same 45 day limit for that notice.

Any information holder that maintains computerized data that includes personal information that the information holder does not own shall notify the owner or licensee of the information of any breach of system security if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.