New Tennessee Law Creates Heightened Liability Requirement For Class Action Data Breach Lawsuits

Highlights

• Tennessee Gov. Bill Lee recently signed into law Public Chapter 991, which raises the liability standard for class action lawsuits arising from cybersecurity events.
• The law does not mention or explicitly amend the requirement that companies take "reasonable care" to prevent data from being compromised, nor does it speak to individual actions that are not class action litigations.
• Instead, the law creates a heightened liability requirement for class action data breach lawsuits that may effectively serve as an enhanced pleadings standard.

As courts have recognized, "[t]he fact that a company has suffered a security breach does not demonstrate that the company did not place significant emphasis on maintaining a high level of security."¹ Nevertheless, companies that experience cybersecurity events frequently are faced with numerous class action lawsuits. In most cases, these complaints contain generic allegations that the company failed to