Appeal: A request made after a trial, asking another court (usually the court of appeals) to decide whether the trial was conducted properly. To make such a request is "to appeal" or "to take an appeal." One who appeals is called the appellant.
Attorney general: means the office of the Tennessee attorney general and reporter. See Tennessee Code 47-18-2102
Authenticate: means to verify using reasonable means that a consumer who is entitled to exercise the rights in §. See Tennessee Code 47-18-3302
Child: means a natural person younger than thirteen (13) years of age. See Tennessee Code 47-18-3302
Complaint: A written statement by the plaintiff stating the wrongs allegedly committed by the defendant.
Controller: means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information. See Tennessee Code 47-18-3302
De-identified data: means data that cannot reasonably be linked to an identified or identifiable natural person, or a device linked to that individual. See Tennessee Code 47-18-3302
Decisions that produce legal or similarly significant effects concerning the consumer: means decisions made by the controller that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services, or access to basic necessities, such as food and water. See Tennessee Code 47-18-3302
Guardian: A person legally empowered and charged with the duty of taking care of and managing the property of another person who because of age, intellect, or health, is incapable of managing his (her) own affairs.
processing: means an operation or set of operations performed, whether by manual or automated means, on personal information or on sets of personal information, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal information. See Tennessee Code 47-18-3302
Profiling: means a form of solely automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. See Tennessee Code 47-18-3302
Record: means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in a perceivable form. See Tennessee Code 1-3-105
Reporter: Makes a record of court proceedings and prepares a transcript, and also publishes the court's opinions or decisions (in the courts of appeals).
written: includes printing, typewriting, engraving, lithography, and any other mode of representing words and letters. See Tennessee Code 1-3-105
(1) A consumer may invoke the consumer rights authorized pursuant to subdivision (a)(2) at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child‘s parent or legal guardian may invoke the consumer rights authorized pursuant to subdivision (a)(2) on behalf of the child regarding processing personal information belonging to the known child.(2) A controller shall comply with an authenticated consumer request to exercise the right to:
(A) Confirm whether a controller is processing the consumer’s personal information and to access the personal information;(B) Correct inaccuracies in the consumer’s personal information, taking into account the nature of the personal information and the purposes of the processing of the consumer’s personal information;(C) Delete personal information provided by or obtained about the consumer. A controller is not required to delete information that it maintains or uses as aggregate or de-identified data; provided, that such data in the possession of the controller is not linked to a specific consumer. A controller that obtained personal information about a consumer from a source other than the consumer is in compliance with a consumer’s request to delete such personal information by:
(i)(a) Retaining a record of the deletion request and the minimum information necessary for the purpose of ensuring that the consumer’s personal information remains deleted from the controller’s records; and(b) Not using such retained personal information for any purpose prohibited under this part; or(ii) Opting the consumer out of the processing of such personal data for any purpose except for those exempted under this part;(D) Obtain a copy of the consumer’s personal information that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; or(E) Opt out of a controller’s processing of personal information for purposes of:
(i) Selling personal information about the consumer;(ii) Targeted advertising; or(iii)Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.(b) Except as otherwise provided in this part, a controller shall comply with an authenticated request by a consumer to exercise the consumer rights authorized pursuant to subdivision (a)(2) as follows:
(1) A controller shall respond to the consumer without undue delay, but in all cases within forty-five (45) days of receipt of a request submitted pursuant to subsection (a). The response period may be extended once by forty-five (45) additional days when reasonably necessary, taking into account the complexity and number of the consumer’s requests, so long as the controller informs the consumer of the extension within the initial forty-five-day response period, together with the reason for the extension;(2) If a controller declines to take action regarding the consumer’s request, then the controller shall inform the consumer without undue delay, but in all cases and at the latest within forty-five (45) days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision pursuant to subsection (c);(3) Information provided in response to a consumer request must be provided by a controller free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, technically infeasible, excessive, or repetitive, then the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, technically infeasible, excessive, or repetitive nature of the request; and(4) If a controller is unable to authenticate the request using commercially reasonable efforts, then the controller is not required to comply with a request to initiate an action under subsection (a) and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer’s request.(c) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the consumer’s receipt of the decision pursuant to subdivision (b)(2). The appeal process must be made available to the consumer in a conspicuous manner, must be available at no cost to the consumer, and must be similar to the process for submitting requests to initiate action pursuant to subsection (a). Within sixty (60) days of receipt of an appeal, a controller shall inform the consumer in writing of action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, then the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the attorney general and reporter to submit a complaint.
