Applicability of Data Protection Law in Tennessee to Organizations Doing Business in the Jurisdiction

The factor of "doing business in the jurisdiction" is used in the Tennessee Information Protection Act (TIPA) to define the scope of applicability. This factor ensures that organizations with a commercial presence or targeting products and services to residents in Tennessee are subject to the state's data protection regulations.

Text of Relevant Provisions

TIPA Sec.47-18-3202:

"This part applies to persons that conduct business in this state producing products or services that target residents of this state and that:"

TIPA Sec.47-18-3202(1):

"(1) Exceed twenty-five million dollars ($25,000,000) in revenue; and"

TIPA Sec.47-18-3202(2)(A):

"(2) (A) Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or"

TIPA Sec.47-18-3202(2)(B):

"(B) During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers."

Analysis of Provisions

The Tennessee Information Protection Act (TIPA) extends its applicability to entities based on their commercial activities within the state. Section 47-18-3202 sets forth specific conditions under which the law applies:

• Commercial Presence and Targeting: The TIPA applies to any person or entity that "conducts business in this state producing products or services that target residents of this state." This broad definition ensures that any entity with significant commercial activities in Tennessee falls within the scope of the law.
• Revenue and Data Processing Thresholds: The provision specifies that the law applies to entities that:
  • Exceed twenty-five million dollars ($25,000,000) in revenue.
  • Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or
  • During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers.

These criteria are intended to focus the law's applicability on entities with significant data processing activities, ensuring that smaller entities are not unduly burdened while still protecting a substantial number of consumers.

The inclusion of this factor reflects a legislative intent to safeguard the privacy of Tennessee residents by regulating entities that either have a significant operational presence in the state or actively target Tennessee residents with their products or services. This ensures that consumer data is protected regardless of whether the data processing occurs within or outside state boundaries.

Implications

For Businesses and Data Processors:

• Extended Compliance: Entities operating or targeting residents in Tennessee must comply with the TIPA if they meet the specified criteria. This includes adhering to data protection standards and implementing appropriate measures for consumer data protection.
• Regulatory Oversight: The Tennessee Attorney General's office is responsible for enforcing compliance with the TIPA, ensuring that businesses adhere to the stipulated data protection requirements.
• Case Examples:
  • A national retailer with significant customers in Tennessee must comply with the TIPA if it processes or sells personal data of residents.
  • An online service provider targeting Tennessee residents and engaging in the sale of personal data must comply with the TIPA.
• Compliance Challenges: Businesses must navigate the complexities of the TIPA, including updating privacy policies, implementing data subject rights, and ensuring data security measures are in place.

By defining "persons that conduct business in this state producing products or services that target residents of this state," the Tennessee Information Protection Act ensures robust consumer privacy protections for residents, extending its reach to both local and out-of-state entities that engage significantly with Tennessee consumers.