Law note · Tennessee
Tennessee Information Protection Act, Attorney General enforcement and NIST safe harbor
TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and this research pass found no sunset clause anywhere in the text, unlike Maryland's and Minnesota's expiring cure mechanisms.
A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation. TIPA's own compliance-program provision requires a written privacy program reasonably conforming to the NIST privacy framework, and grants an affirmative defense to liability for a controller or processor that creates, maintains, and complies with such a program, a structural feature no other state in this wave ties to liability this directly. TIPA bars any private right of action, including a class action, under TIPA or other law.
What it asks of an app
- Expect TIPA violations to be enforced exclusively by the Tennessee Attorney General and Reporter, never by a private plaintiff or class action.
- Consider creating, maintaining, and complying with a written privacy program reasonably conforming to the NIST privacy framework. TIPA grants an affirmative defense to a controller or processor that does so, a safe harbor no other state in this wave offers this directly.
- Expect a mandatory 60-day cure notice before an enforcement action, with no sunset date found in the statute's text.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Tennessee session law text, Public Chapter 408 (2023), Tennessee Secretary of State