Tennessee Amends Breach Notice Statute: Sets Notice Deadline, Eliminates Encryption Safe Harbor

Article by Shea Gordon Leitch, Emily Tabatabai, Sam Castic, Aravind Swaminathan and Antony P. Kim.

Tennessee recently amended its data breach notification law, and in doing so, it has joined the ranks of states like Florida, Ohio, and Wisconsin that require notification to residents of a data breach within a defined time period.  When the law becomes effective on July 1, 2016, the statute will require notice to Tennessee residents within forty-five (45) days after discovery that personal information has been acquired by an "unauthorized person," even if the information is encrypted.  The original amendment required notice within fourteen (14) days, but the bill was subsequently amended to expand the deadline to 45 days.