Tennessee Is State Number Eight to Pass a Privacy Law

On May 11, 2023, Governor Bill Lee signed the Tennessee Information Protection Act ("TIPA"). The Volunteer State is the third to adopt a comprehensive data privacy statute in 2023 (after Indiana and Iowa) and the eighth overall (joining the Golden State's California Consumer Privacy Act and California Privacy Rights Act and similar-yet-unique laws passed in Virginia, Colorado, Connecticut, and Utah).

As I cautioned in a March 2021 Perspectives from FSF Scholars, multiple, inconsistent state laws inevitably will lead to "[c]ounterproductive consumer confusion, along with unreasonably burdensome and unjustifiably costly compliance obligations." At that time, just two states – California and Virginia – had enacted legislation. Today, with that total rapidly approaching double digits, such concerns exponentially are greater.

Consumer rights established by the TIPA include the right to know that a covered entity is processing personal information; to access, correct, delete, and obtain a copy of that data; and to opt out of the sale of personal information. In addition, a covered entity must disclose, upon request, categorical information regarding personal information that was sold, and obtain a consumer's consent before processing "sensitive data."

Covered entities ("controllers") that share personal information with third parties ("processors") must include certain provisions in their contracts to protect these consumer privacy rights. Controllers also must conduct data protection assessments under certain circumstances (for example, if they engage in targeted advertising, process "sensitive data," or sell personal information).

The TIPA does not create a private right of action. The Attorney General is responsible for enforcing its provisions. Covered entities have 60 days to cure an alleged violation.

Perhaps most notably, the TIPA requires that covered entities "create, maintain, and comply with a written privacy program that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework entitled 'A Tool for Improving Privacy through Enterprise Risk Management Version 1.0.'"

The TIPA becomes effective on July 1, 2024.

Seven States and Counting: Indiana Passes Privacy Law

Activity at the state level continues to complicate further the overall privacy landscape. On May 1st, Indiana Governor Eric Holcomb signed into law Senate Bill 5 (S.B. 5), the Indiana Consumer Data Privacy Act (ICDPA). Indiana is the second state to pass a comprehensive data privacy law in 2023 (Iowa was the first, as I noted in a recent post to the Free State Foundation blog) and the seventh overall (after California, not once but twice, Virginia, Colorado, Connecticut, Utah, and the aforementioned Iowa).

Meanwhile, Montana and Tennessee could follow quickly: bills in both states have made it to their respective governor's desks.

Uniquely, and apparently to provide an opportunity to learn how similar (but by no means identical) statutes in other states fare, the ICDPA will not go into effect until July 1, 2026. (Currently, only the laws enacted in California and Virginia are in force. The big day in Colorado and Connecticut is July 1st of this year, in Utah it is December 31st, and in Iowa it is January 1, 2025.)

Based largely (though, again, not entirely) on the Virginia Consumer Data Protection Act, the ICDPA creates several consumer rights: to know, to access, to correct, to delete, and to port data, as well as the ability to opt out of its processing/sale.

And it requires businesses, among other things, to provide a privacy notice and other disclosures, to obtain affirmative consent before processing "sensitive personal data," to conduct data protection impact assessments, and to enter binding contracts with third-party data processors to ensure that they, too, respect consumer privacy rights.

The ICDPA will be enforced exclusively by the Indiana attorney general. (It does not establish a private right of action.) In addition, it provides businesses with a 30-day cure period.

At the federal level, the House Committee on Energy & Commerce's Innovation, Data, and Commerce Subcommittee held a hearing on April 27th titled "Addressing America's Data Privacy Shortfalls: How a National Standard Fills Gaps to Protect Americans' Personal Information." It was the sixth Committee hearing on the topic of privacy thus far this legislative session.

In a joint statement, Committee Chair Cathy McMorris Rodgers (R – WA) and Subcommittee Chair Gus Bilirakis (R – FL) wrote that "[t]he Energy and Commerce Committee is building momentum this Congress towards enacting comprehensive national privacy and data security legislation."

Fittingly, in his opening statement, Subcommittee Chair Bilirakis acknowledged that the data privacy picture "only gets more complicated as fifty different states move towards their own data privacy laws, meaning an increasingly complicated and confusing landscape for consumers and for business."

Exhibit C(O) in the Case for a Federal Data Privacy Law: The Colorado Privacy Act

Colorado became the third state to enact comprehensive data privacy legislation when, on July 8, 2021, Governor Jared Polis signed the Colorado Privacy Act (CPA). With the passage of each new state law the rights of consumers become more uncertain, the compliance challenges for businesses become more complicated, and the urgent need for a preemptive federal statute becomes even more pronounced.

California was the first state to occupy the void created by congressional inaction, Virginia the second.

In fact, two comprehensive data privacy proposals have become law in California: (1) the state legislature in 2018 passed the California Consumer Privacy Act (CCPA), which I described in "California's Heavy-Handed Approach to Protecting Consumer Privacy: Exhibit A in the Case for Federal Preemption," an October 2019 Perspectives from FSF Scholars, and (2) voters in last year's election approved the California Privacy Rights Act, which I discussed in a November 2020 Perspectives.

The Virginia Consumer Data Protection Act (VCDPA), meanwhile, became law in March 2021. I summarized its provisions in a February 2021 post to the FSF Blog.

Prior to the VCDPA's passage (it goes into effect on January 1, 2023), the CCPA as a practical matter assumed the role of a national privacy standard, as many businesses determined that it is easier to comply with the CCPA's requirements throughout the country than to try to separate out, and treat differently, California residents. But once Virginia Governor Ralph Northam signed the VCDPA, which is similar but by no means identical to the CCPA, the compliance headache for businesses expanded exponentially.

As I explained in March 2021's "Inconsistent State Data Privacy Laws Increase Confusion and Costs," as more states embark on their own, unique paths, businesses are forced to choose between two problematic options: (1) developing and implementing multiple state-specific compliance regimes, an endeavor fraught with risk given that, as a technical matter, Internet traffic knows no borders, or (2) aggregating the most onerous obligations set forth in the growing number of state laws and abiding by that evolving "worst of" collection nationwide.

The passage of the CPA, which I detailed in an April 2021 FSF Blog post and which goes into effect on July 1, 2023, further exacerbates that situation.

The remedy, of course, is a federal data privacy regime that preempts state laws.

In that regard, I note that President Biden's July 9, 2021, "Executive Order on Promoting Competition in the American Economy" urges the FTC to consider adopting rules addressing unfair data collection:

To address persistent and recurrent practices that inhibit competition, the Chair of the FTC, in the Chair's discretion, is also encouraged to consider working with the rest of the Commission to exercise the FTC's statutory rulemaking authority, as appropriate and consistent with applicable law, in areas such as … unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy.

FTC Commissioner Christine Wilson (R), who spoke about data privacy at both the 2021 and 2020 (video) Free State Foundation Annual Telecom Policy Conferences, last month indicated that, given the failure of Congress to act and the proliferation of inconsistent state laws, she has "reluctantly come to consider whether we should begin a privacy rulemaking proceeding at the Federal Trade Commission."

Federal legislation, however, is the preferred path forward. More to the point, what is needed is a comprehensive data privacy statute that preempts state laws, treats all businesses with access to personal information the same, provides consumers with adequate disclosures and allows them to "opt out" of the use of their non-sensitive data, empowers the FTC with exclusive enforcement authority, and rejects a private right of action.

Unfortunately, press reports indicate that congressional activity on privacy once again has "stalled." Might the silver lining to the CPA's passage be the additional pressure needed to reignite those efforts?

Time will tell.

Virginia's Consumer Data Protection Act Soon Could Become Law

Virginia is poised to become the second state to adopt a data privacy law. California led the way, first with the passage in 2018 of the California Consumer Privacy Act (CCPA) and, more recently, via voter approval in the November 2020 election of Proposition 24, the California Privacy Rights Act (CPRA).

The Virginia Consumer Data Protection Act (CDPA) includes the following key provisions:

• New Consumer Private Rights: The CDPA grants consumers the right to access, the right to amend, and the right to delete personal data; the right to data portability; and the right "[t]o opt out of the processing of … personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer."
• Definition of "Personal Data": The CDPA defines "personal data" as "any information that is linked or reasonably linkable to an identified or identifiable natural person. 'Personal data' does not include de-identified data or publicly available information."
• Definition of "Sensitive Data": "Sensitive data," for which consumer or parental opt-in consent must be obtained before it is processed, is defined as a subset of "personal data" that includes (1) information "revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;" (2) "[t]he processing of genetic or biometric data for the purpose of uniquely identifying a natural person;" (3) "[t]he personal data collected from a known child;" and (4) "[p]recise geolocation data."
• Covered Entities: The CDPA "applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data."
• Enforcement: The CDPA exclusively authorizes the state attorney general to enforce its provisions via civil actions. There is no private right of action and covered entities are entitled to a 30-day cure period.

On February 3, the Virginia Senate unanimously passed SB 1392, identical companion legislation to HB 2307, which easily cleared the House of Delegates by a 89-9 vote on January 29. Should Governor Ralph Northam sign the bill into law, it would become effective on January 1, 2023.

I have argued in posts to the Free State Foundation Blog as well as Perspectives from FSF Scholars that what is needed is a single set of privacy rules that apply nationwide and preempt state laws. In the absence of federal legislation, however, we continue to see activity at the state level.

Additional states currently considering data privacy legislation include Washington, New York, and Oklahoma.