United States of America: Signed Tennessee Information Protection Act including data protection regulation (HB 1181/SB 73)

On 11 May 2023, the Tennessee Information Protection Act (HB 1181/SB 73) was signed into law by the Tennessee Governor. The Act will apply to business entities active in the state that, on an annual basis, either control or process personal information of at least 100'000 consumers or control or process personal information of at least 25'000 consumers and derive more than 50% of gross revenue from the sale of personal information. The Act sets out consumer data rights, including access to personal information, data correction, data deletion, and obtaining a copy of the consumer's personal information. In addition, the Act includes obligations for data controllers, including abiding by principles of adequacy, relevance, and reasonable necessity in processing data, following laws prohibiting unfair discrimination against consumers, and obtaining consumer consent before processing sensitive personal data. The Act will enter into force on 1 July 2024.