(a) This part does not restrict a controller‘s or processor‘s ability to:
Terms Used In Tennessee Code 47-18-3309
Amendment: A proposal to alter the text of a pending bill or other measure by striking out some of it, by inserting new language, or both. Before an amendment becomes part of the measure, thelegislature must agree to it.
Child: means a natural person younger than thirteen (13) years of age. See Tennessee Code 47-18-3302
Contract: A legal written agreement that becomes binding when signed.
Controller: means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information. See Tennessee Code 47-18-3302
Fraud: Intentional deception resulting in injury to another.
Guardian: A person legally empowered and charged with the duty of taking care of and managing the property of another person who because of age, intellect, or health, is incapable of managing his (her) own affairs.
Identity theft: means : (A) Obtaining, possessing, transferring, using or attempting to obtain, possess, transfer or use, for unlawful economic benefit, one (1) or more identification documents or personal identification numbers of another person. See Tennessee Code 47-18-2102
Obligation: An order placed, contract awarded, service received, or similar transaction during a given period that will require payments during the same or a future period.
Oversight: Committee review of the activities of a Federal agency or program.
Person: means a natural person, consumer, individual, governmental agency, partnership, corporation, trust, estate, incorporated or unincorporated association, and any other legal or commercial entity however organized. See Tennessee Code 47-18-2102
processing: means an operation or set of operations performed, whether by manual or automated means, on personal information or on sets of personal information, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal information. See Tennessee Code 47-18-3302
Processor: means a natural or legal entity that processes personal information on behalf of a controller. See Tennessee Code 47-18-3302
Prosecute: To charge someone with a crime. A prosecutor tries a criminal case on behalf of the government.
State: when applied to the different parts of the United States, includes the District of Columbia and the several territories of the United States. See Tennessee Code 1-3-105
Subpoena: A command to a witness to appear and give testimony.
Summons: Another word for subpoena used by the criminal justice system.
Third party: means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. See Tennessee Code 47-18-3302
written: includes printing, typewriting, engraving, lithography, and any other mode of representing words and letters. See Tennessee Code 1-3-105
(1) Comply with federal, state, or local laws, rules, or regulations;(2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;(3) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;(4) Investigate, establish, exercise, prepare for, or defend legal claims;(5) Provide a product or service specifically requested by a consumer or the parent or legal guardian of a known child, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract;(6) Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another natural person, and where the processing cannot be manifestly based on another legal basis;(7) Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activity, or illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for such action;(8) Engage in public- or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, or similar independent oversight entity that determines whether:
(A) Deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller;(B) The expected benefits of the research outweigh the privacy risks; and(C) The controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including risks associated with reidentification; or(9) Assist another controller, processor, or third party with the obligations under this part.(b) The obligations imposed on controllers or processors under this part do not restrict a controller’s or processor’s ability to collect, use, or retain data to:
(1) Conduct internal research to develop, improve, or repair products, services, or technology;(2) Effectuate a product recall;(3) Identify and repair technical errors that impair existing or intended functionality; or(4) Perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer’s existing relationship with the controller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party.(c) The obligations imposed on controllers or processors under this part do not apply where compliance by the controller or processor with this part would violate an evidentiary privilege under the laws of this state. This part does not prevent a controller or processor from providing personal information concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication.(d)(1) A controller or processor that discloses personal information to a third-party controller or processor, in compliance with the requirements of this part, is not in violation of this part if:
(A) The third-party controller or processor that receives and processes the personal information is in violation of this part; and(B) At the time of disclosing the personal information, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation.(2) A third-party controller or processor receiving personal information from a controller or processor in compliance with the requirements of this part is likewise not in violation of this part for the violations of the controller or processor from which it receives such personal information.(e) This part does not impose an obligation on controllers and processors that adversely affects the rights or freedoms of a person, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution, or applies to the processing of personal information by a person in the course of a purely personal activity.(f) A controller shall not process personal information for purposes other than those expressly listed in this section unless otherwise allowed by this part. Personal information processed by a controller pursuant to this section may be processed to the extent that the processing is:
(1) Reasonably necessary and proportionate to the purposes listed in this section; and(2) Adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section. Personal information collected, used, or retained pursuant to subsection (b) shall, where applicable, take into account the nature and purpose or purposes of the collection, use, or retention. The data is subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal information and to reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal information.(g) If a controller processes personal information pursuant to an exemption in this section, then the controller bears the burden of demonstrating that the processing qualifies for the exemption and complies with subsection (f).(h) Processing personal information for the purposes expressly identified in subdivisions (a)(1)-(9) does not solely make an entity a controller with respect to the processing.
