Listen
to
this
post
On
April
21,
2023,
the
Tennessee
legislature
voted
to
enact
the
Tennessee
Information
Privacy
Act
(H.B.
1181)(“TIPA”).
TIPA
includes
a
requirement
for
controllers
and
processors
to
create,
maintain
and
comply
with
a
written
privacy
program
that
reasonably
conforms
to
the
National
Institute
of
Standards
and
Technology
(NIST)
privacy
framework.
Under
TIPA,
the
scale
and
scope
of
a
controller
or
processor’s
privacy
program
is
appropriate
if
it
is
based
on
specific
factors
enumerated
in
the
law.
These
include
(1)
the
size
and
complexity
of
the
controller
or
processor’s
business;
(2)
the
nature
and
scope
of
the
activities
of
the
controller
or
processor;
(3)
the
sensitivity
of
the
personal
information
processed;
(4)
the
cost
and
availability
of
tools
to
improve
privacy
protections
and
data
governance;
and
(5)
compliance
with
a
comparable
state
or
federal
law.
Notably,
the
TIPA
recognizes
a
controller’s
certification
to
the
APEC
Cross-Border
Privacy
Rules
system
(“CBPR”)
and
a
processor’s
certification
to
the
APEC
Privacy
Recognition
for
Processors
system
(“PRP”)
as
additional
factors
to
be
considered
in
determining
whether
the
scale
and
scope
of
a
controller
or
processor’s
privacy
program
is
appropriate.
This
marks
the
first
time
the
CBPR
and
PRP
systems,
to
which
the
U.S.
is
an
active
participating
economy,
have
been
expressly
recognized
in
a
comprehensive
state
privacy
law.
The
TIPA
has
been
sent
to
Tennessee
Governor
Bill
Lee
for
signature.
About Author
