Applicability of the Tennessee Information Protection Act (TIPA)

The Tennessee Information Protection Act (TIPA) establishes its applicability through a combination of material and territorial factors. These factors determine whether an entity is subject to the law based on its business activities, revenue, and data processing operations. Below is a detailed analysis of these factors.

Material Applicability Factors

The material applicability of TIPA is determined by three key factors:

1. Number of Data Subjects
2. Sale of Personal Data Criterion
3. Revenue-Based Applicability

Number of Data Subjects

Referenced Provisions:

• TIPA Sec.47-18-3202(2)(A):

  "Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or"

• TIPA Sec.47-18-3202(2)(B):

  "During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers."

Analysis:

• Thresholds: TIPA applies to businesses that control or process personal information for at least 25,000 consumers if they also derive over 50% of their gross revenue from selling such data (Sec.47-18-3202(2)(A)). Alternatively, businesses controlling or processing data for at least 175,000 consumers annually are subject to TIPA regardless of revenue model (Sec.47-18-3202(2)(B)).
• Implications: These thresholds ensure that smaller entities with limited data processing activities are excluded from TIPA's scope, focusing regulatory oversight on larger businesses or those heavily reliant on data monetization.

Sale of Personal Data Criterion

Referenced Provision:

• TIPA Sec.47-18-3202(2)(A):

  "Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information."

Analysis:

• Revenue Dependency: This provision targets businesses whose primary business model involves selling personal data, as indicated by the requirement to derive more than 50% of gross revenue from such sales.
• Scope Limitation: By focusing on entities with substantial engagement in data monetization, TIPA ensures that smaller businesses or those with diversified revenue streams are not unnecessarily burdened.

Revenue-Based Applicability

Referenced Provisions:

• TIPA Sec.47-18-3202(1):

  "(1) Exceed twenty-five million dollars ($25,000,000) in revenue; and"

• TIPA Sec.47-18-3202(2)(A):

  "Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or"

Analysis:

• High Revenue Threshold: Businesses with annual revenues exceeding $25 million automatically fall under TIPA's scope if they meet additional criteria related to data processing or monetization.
• Dual Focus: This factor captures large-scale entities with significant financial resources while also addressing risks posed by businesses heavily dependent on data sales.

Territorial Applicability Factors

The territorial applicability of TIPA is based on two primary factors:

1. Doing Business in Jurisdiction
2. Offering Goods and Services to Data Subjects in Jurisdiction

Doing Business in Jurisdiction

Referenced Provision:

• TIPA Sec.47-18-3202:

  "This part applies to persons that conduct business in this state producing products or services that target residents of this state and that:"

Analysis:

• Commercial Presence: TIPA applies to entities conducting business within Tennessee, regardless of whether their operations are physically located in the state.
• Additional Criteria: Businesses must also meet other thresholds related to revenue or data processing activities to fall under TIPA's jurisdiction.

Offering Goods and Services to Data Subjects in Jurisdiction

Referenced Provision:

• TIPA Sec.47-18-3202:

  "This part applies to persons that conduct business in this state producing products or services that target residents of this state and that:"

Analysis:

• Intentional Targeting: The phrase "producing products or services that target residents of this state" indicates that TIPA applies to entities intentionally directing their offerings toward Tennessee residents.
• Extraterritorial Reach: Foreign entities may also fall under TIPA if they specifically target Tennessee residents and meet other applicability thresholds.

Conclusion

The Tennessee Information Protection Act (TIPA) applies to entities based on a combination of material and territorial factors:

1. Material applicability focuses on thresholds for the number of data subjects, reliance on personal data monetization, and overall revenue.
2. Territorial applicability ensures coverage for businesses operating within Tennessee or targeting its residents.

These provisions collectively ensure robust consumer privacy protections while limiting regulatory burdens on smaller entities with minimal data processing activities.