Several important changes have been made to Tennessee’s breach notification statue after Gov. Bill Haslam signed S.B. 2005 into law, The National Law Review reports. With the amendment, Tennessee is removing the provision stating notice will only be given if unencrypted personal information has been breached. Tennessee will be the first state in the nation requiring notification of any breach, regardless of whether the information is encrypted or not. Other changes include a mandatory notification to any resident affected by a data breach within 45 days, and specification for an “unauthorized person” to include an employee of the information holder who received personal information and deliberately used it for an illegal purpose.
Full Story
10 Comments
If you want to comment on this post, you need to login.
Also, by definition, there is no data breach if the data are encrypted. ("47-18-2107. Release of personal consumer information. (a) As used in this section, unless the context otherwise requires: (1) "Breach of the security of the system" means unauthorized acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder. Good faith acquisition of personal information by an employee or agent of the information holder for the purposes of the information holder is not a breach of the security of the system; provided, that the personal information is not used or subject to further unauthorized disclosure."