(a) A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal information:
Terms Used In Tennessee Code 47-18-3307
Attorney general: means the office of the Tennessee attorney general and reporter. See Tennessee Code 47-18-2102
Controller: means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information. See Tennessee Code 47-18-3302
De-identified data: means data that cannot reasonably be linked to an identified or identifiable natural person, or a device linked to that individual. See Tennessee Code 47-18-3302
Person: means a natural person, consumer, individual, governmental agency, partnership, corporation, trust, estate, incorporated or unincorporated association, and any other legal or commercial entity however organized. See Tennessee Code 47-18-2102
processing: means an operation or set of operations performed, whether by manual or automated means, on personal information or on sets of personal information, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal information. See Tennessee Code 47-18-3302
Profiling: means a form of solely automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. See Tennessee Code 47-18-3302
Reporter: Makes a record of court proceedings and prepares a transcript, and also publishes the court's opinions or decisions (in the courts of appeals).
Sensitive data: means a category of personal information that includes: (A) Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. See Tennessee Code 47-18-3302
(1) The processing of personal information for purposes of targeted advertising;(2) The sale of personal information;(3) The processing of personal information for purposes of profiling, where the profiling presents a reasonably foreseeable risk of:
(A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers;(B) Financial, physical, or reputational injury to consumers;(C) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where the intrusion would be offensive to a reasonable person; or(D) Other substantial injury to consumers;(4) The processing of sensitive data; and(5) Processing activities involving personal information that present a heightened risk of harm to consumers.(b) Data protection assessments conducted pursuant to subsection (a) must identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards that can be employed by the controller to reduce the risks. The use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal information will be processed, must be factored into this assessment by the controller.(c) The attorney general and reporter may request pursuant to a civil investigative demand that a controller disclose a data protection assessment that is relevant to an investigation conducted by the attorney general and reporter, and the controller shall make the data protection assessment available to the attorney general and reporter. The attorney general and reporter may evaluate the data protection assessment for compliance with the responsibilities set forth in § 47-18-3305. Data protection assessments are confidential and not open to public inspection and copying. The disclosure of a data protection assessment pursuant to a request from the attorney general and reporter does not constitute a waiver of attorney-client privilege or work product protection with respect to the assessment and information contained in the assessment.(d) A single data protection assessment may address a comparable set of processing operations that include similar activities.(e) Data protection assessments conducted by a controller for the purpose of compliance with other laws, rules, or regulations may comply with this section if the assessments have a reasonably comparable scope and effect.(f) Data protection assessment requirements apply to processing activities created or generated on or after July 1, 2024, and are not retroactive.
