SB 2100

The Tennessee Information Protection Ac t (the "Act"") requires a controller to comply with an authenticated consumer request to exercise the right to any of the following:  Confirm whether a controller is processing the consumer's personal information and to access the personal information .  Correct inaccuracies in the consumer's personal information, taking into account the nature of the personal information and the purposes of the processing of the consumer's personal information .  Delete certain personal information provided by or obtained about the consumer.  Obtain a copy of the consumer's personal information that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means .  Opt out of a controller's processing of personal information for purposes of (i) s elling personal information about the consumer, (ii) t argeted advertising, or (iii) p rofiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Such Act applies to persons that conduct business in this state producing products or services that target residents of this state and that e xceed $25 million in revenue and either (i ) c ontrol or process personal information of at least 25, 000 consumers and derive more than 50% of gross revenue from the sale of personal information; or ( ii) d uring a calendar year, control or process personal information of at least 175, 000 consumers. As used in the Act, a ""controller"" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information . This bill clarifies that such term specifically includes an entity whose primary business is the commercial sale, licensing, or transfer of personal information about individuals, regardless of whether the entity has a direct relationship, consumer-facing or otherwise, with those individuals . REGISTRATION REQUIRED On or before January 31 following a year in which this bill applies to a controller, this bill requires the controller to register with the consumer protection division of the office of the attorney general (""division""). In registering with the division, a controller must pay a registration fee in an amount determined by the division, not to exceed the division's reasonable costs of establishing, maintaining, and providing a webpage on the division's website that contains the accessible deletion mechanism described below . The fee collected pursuant to such registration must be deposited into the Information Protection Registry fund, described below. By July 1, 2027, this bill requires the division to create a webpage on the division's website that h as the accessible deletion mechanism in a conspicuous location and p rovides information about both of the following:  How a consumer can utilize the accessible deletion mechanism, including the process for submitting a deletion request and examples of the types of information that may be deleted .  The additional rights a consumer may have under the Act. ACCESSIBLE DELETION MECHANISM By July 1, 2027, this bill requires the division to create a n accessible deletion mechanism that (i) i mplements and maintains reasonable security procedures and practices, including administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used; ( ii ) p rotects consumers' personal information from unauthorized use, disclosure, access, destruction, or modification; and (iii) a llows a consumer or the consumer's au thorized agent to engage in all of the following actions:  Through a single authenticated consumer request, request that every controller to which this part applies and that maintains personal information about the consumer delete the personal information related to the consumer that is held by the controller, or an agent of the controller .  Selectively exclude a specific controller from a request so made .  Make a request to alter a previous request so made after at least 45 days have passed since the consumer last made such a request .  Verify the status of a deletion request submitted by the consumer. This bill requires such accessible deletion mechanism, at a minimum, to (i) a llow a controller registered with the division to determine whether a consumer has submitted an authenticated request to delete the personal information related to the consumer; ( ii ) b e available for use by a consumer at no cost to the consumer; and ( iii ) b e usable by a consumer with a disability. This bill requires a controller to access the accessible deletion mechanism at least once every 45 days and to engage in all of the following actions:  Within 45 days after receipt of a deletion request, process the deletion request and delete all required personal information related to the consumer who made the request .  Process the request as an opt-out of the sale or sharing of the consumer's personal information, consistent with the consumer 's right to opt out of a controller's processing of personal information under present law, if the controller denies a consumer's deletion request because the controller is unable to authenticate the request using commercially reasonable efforts .  Direct any affiliates of the controller to (i) delete all personal information in the affiliate's possession related to the consumer who submitted the deletion request; or (ii) process a request as an opt-out of the sale or sharing of the consumer's personal information, consistent with the consumer right to opt out of a controller's processing of personal information under present law . However, this bill provides that a controller, or its affiliate, is not required to delete a consumer's personal information if such deletion would not be required if the request was submitted to the controller in accordance with present law . VIOLATIONS This bill provides that a controller's failure to comply with the registration or deletion request requirements of this bill constitutes a violation and is subject to a civil investigative demand, civil penalties, and other relief or actions that may be sought by the attorney general pursuant to present law . INFORMATION PROTECTION REGISTRY FUND – ANNUAL REPORT This bill create s within the state general fund a special account to be known as the information protection registry fund. The fee collected pursuant to this bill must be deposited into the fund and used only to implement and administer the purposes set forth in this bill . In addition to appropriations made to the fund, the division may accept other funds, public or private, by way of gift or grant to the fund. Any such gift or grant must be deposited into the fund to be expended in accordance with this bill. This bill requires the division to administer the fund, and moneys in the fund must be expended and obligated only in accordance with this bill and in accordance with appropriations made by the general assembly. All expenditures from the fund are subject to review in the form of an annual report submitted by the division to the commissioner of finance and administration no later than January 1, 2028, and by January 1 each year thereafter."