Good morning TCPAWorld, Duchess here with a quick update on the latest states to sign into law new consumer privacy laws, Indiana with the Consumer Data Protection and Tennessee with the Information Protection Act.
If you will recall, I brought you news of the bill passing of both these bills in their respective state house and senate just a few weeks ago. Both bills have now been officially signed by their state governors. Indiana was signed on May 1st and Tennessee was signed into law yesterday May 11th. Check out the quick recap below.
What to know about Indiana’s Consumer Data Protection
- Right to Know and Access
- Right to Correction
- Right to Delete
- Right to Data Portability
- Right to Opt-Out of
- Targeted Advertising
- Sale of Personal Data
- Decision Profiling
- Controllers will have 45 days to respond to the consumer with a one-time extension of 45 additional days.
- Consumers requested information to be provided free once annually
- Establish a process for which a consumer can appeal a denied request
- Controllers must complete Data Protection Impact Assessments
- No private right of action
- Up to $7,500 per violation
- Offers a 30-day cure period
- Effective date is January 1, 2026
What to know about Tennessee’s Information Protection Act
- Right to Know and Access
- Right to Correction
- Right to Delete
- Right to Data Portability
- Right to Opt-Out of
- Targeted Advertising
- Sale of Personal Data
- Decision Profiling
- Controllers will have 45 days to respond to the consumer with a one-time extension of 45 additional days.
- Consumers requested information to be provided free twice annually
- Establish a process for which a consumer can appeal a denied request
- Controllers to conduct and document Data Protection Assessments
- No private right of action
- Up to $7,500 per violation, willing or knowingly can be awarded treble damages
- Offers a 60-day cure period
- Offers Affirmative Defense via a voluntary privacy program that the controller or processor creates, maintains, and complies with a written privacy policy. See specific requirements in the bill.
- Effective date is July 1, 2025
Lots of movement on the consumer data privacy front, we will continue to keep a watchful eye on these.