On April 21, 2023, the Montana and Tennessee legislatures voted to enact comprehensive consumer privacy bills in their respective states. If signed by their governors, Montana’s Consumer Data Privacy Act (S.B. 384) (“MCDPA”) and Tennessee’s Information Protection Act (H.B. 1181) (“TIPA”) could make these states the eighth and ninth U.S. states to enact comprehensive privacy legislation.
Applicability
The MCDPA applies to persons that conduct business in Montana or persons that produce products or services that are targeted to Montana residents and (1) control or process the personal data of 50,000 or more consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) control or process the personal data of 25,000 or more consumers and derive more than twenty-five percent (25%) of gross revenue from the sale of personal data. “Consumer” means an individual who is a Montana resident and does not include an individual acting in a commercial or employment context.
The TIPA applies to persons that conduct business in Tennessee producing products or services targeting Tennessee residents and that exceed $25 million in revenue, and either (1) during a calendar year, control or process personal information of at least 175,000 consumers, or (2) control or process personal information of at least 25,000 consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information. “Consumer” means a natural person who is a Tennessee resident “acting only in a personal context” and does not include a natural person acting in a commercial or employment context.
Controller Obligations
Among other obligations, controllers subject to the MDCPA are required to (1) provide a privacy notice with certain specified content, (2) establish a secure and reliable means for consumers to exercise their privacy rights under the law, (3) obtain a consumer’s consent to process sensitive data, (4) enter into contracts with its processors and (5) conduct and document data protection assessments.
Under the TIPA, controllers are required to (1) provide a privacy notice with certain specified content, (2) establish a secure and reliable means for consumers to exercise their privacy rights under the law, (3) obtain a consumer’s consent to process sensitive data, (4) enter into contracts with its processors and (5) conduct and document data protection assessments. Notably, the TIPA is the first of the state consumer privacy laws to provide an affirmative defense to a cause of action for a TIPA violation where a controller creates, maintains and complies with a written privacy policy that reasonably conforms to the National Institute of Standards and Technology (“NIST”) privacy framework entitled “A Tool for Improving Privacy through Enterprise Risk Management Version 1.0.”
Consumer Rights
The MDCPA provides consumers the right to (1) confirm whether a controller is processing the consumer’s personal data and access the consumer’s personal data; (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data about the consumer; (4) obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily useable format that allows the consumer to transmit the personal data to another controller without hindrance when the processing is carried out by automated means; and (5) opt out of the processing of the consumer’s personal data for purposes of (a) targeted advertising, (b) the sale of the consumer’s personal data and (c) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Beginning January 1, 2025, controllers must allow a consumer to opt out of targeted advertising and the sale of their personal data through an opt-out preference signal.
The TIPA provides consumers the right to (1) confirm whether a controller is processing the consumer’s personal information and access the personal information; (2) correct inaccuracies in the consumer’s personal information; (3) delete personal information provided by or obtained about the consumer; (4) obtain a copy of the consumer’s personal information that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily useable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (5) opt out of a controller’s processing of personal information for purposes of (a) selling personal information about the consumer, (b) targeted advertising and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
Enforcement
Neither the MCDPA nor the TIPA contain a private right of action. The MCDPA and TIPA provide exclusive enforcement authority to the Montana Attorney General and Tennessee Attorney General & Reporter, respectively. Both bills provide a right to cure violations within 60 days of receiving notice of a violation, but the MCDPA’s cure period sunsets on April 1, 2026.
The MCDPA and TIPA will become law if the Montana and Tennessee Governors sign or allow the bills to become law without their signatures. If enacted, the MCDPA would take effect October 1, 2024 and the TIPA would take effect July 1, 2025.
Updates: On May 11, 2023, Tennessee State Governor Bill Lee signed House Bill 1181 into law, making Tennessee the eighth state to enact a Comprehensive Privacy Law.
On May 19, 2023, Montana State Governor Greg Gianforte signed Senate Bill 384 into law, making Montana the ninth state to enact a Comprehensive Privacy Law.
Search
Recent Posts
Categories
- Behavioral Advertising
- Centre for Information Policy Leadership
- Children’s Privacy
- Cyber Insurance
- Cybersecurity
- Enforcement
- European Union
- Events
- FCRA
- Financial Privacy
- General
- Health Privacy
- Identity Theft
- Information Security
- International
- Marketing
- Multimedia Resources
- Online Privacy
- Security Breach
- U.S. Federal Law
- U.S. State Law
- Workplace Privacy
Tags
- Aaron Simpson
- Accountability
- Adequacy
- Advertisement
- Advertising
- American Privacy Rights Act
- Anna Pateraki
- Anonymization
- Anti-terrorism
- APEC
- Apple Inc.
- Argentina
- Arkansas
- Article 29 Working Party
- Artificial Intelligence
- Australia
- Austria
- Automated Decisionmaking
- Baltimore
- Bankruptcy
- Belgium
- Biden Administration
- Big Data
- Binding Corporate Rules
- Biometric Data
- Blockchain
- Bojana Bellamy
- Brazil
- Brexit
- British Columbia
- Brittany Bacon
- Brussels
- Business Associate Agreement
- BYOD
- California
- CAN-SPAM
- Canada
- Cayman Islands
- CCPA
- CCTV
- Chile
- China
- Chinese Taipei
- Christopher Graham
- CIPA
- Class Action
- Clinical Trial
- Cloud
- Cloud Computing
- CNIL
- Colombia
- Colorado
- Committee on Foreign Investment in the United States
- Commodity Futures Trading Commission
- Compliance
- Computer Fraud and Abuse Act
- Congress
- Connecticut
- Consent
- Consent Order
- Consumer Protection
- Cookies
- COPPA
- Coronavirus/COVID-19
- Council of Europe
- Council of the European Union
- Court of Justice of the European Union
- CPPA
- CPRA
- Credit Monitoring
- Credit Report
- Criminal Law
- Critical Infrastructure
- Croatia
- Cross-Border Data Flow
- Cyber Attack
- Cybersecurity
- Cybersecurity and Infrastructure Security Agency
- Data Brokers
- Data Controller
- Data Localization
- Data Privacy Framework
- Data Processor
- Data Protection Act
- Data Protection Authority
- Data Protection Impact Assessment
- Data Transfer
- David Dumont
- David Vladeck
- Delaware
- Denmark
- Department of Commerce
- Department of Health and Human Services
- Department of Homeland Security
- Department of Justice
- Department of the Treasury
- Disclosure
- Disclosures
- District of Columbia
- Do Not Call
- Do Not Track
- Dobbs
- Dodd-Frank Act
- DPIA
- E-Privacy
- E-Privacy Directive
- Ecuador
- Ed Tech
- Edith Ramirez
- Electronic Communications Privacy Act
- Electronic Privacy Information Center
- Elizabeth Denham
- Employee Monitoring
- Encryption
- ENISA
- EU Data Protection Directive
- EU Member States
- European Commission
- European Data Protection Board
- European Data Protection Supervisor
- European Parliament
- Facial Recognition
- Facial Recognition Technology
- FACTA
- Fair Information Practice Principles
- Federal Aviation Administration
- Federal Bureau of Investigation
- Federal Communications Commission
- Federal Data Protection Act
- Federal Trade Commission
- FERC
- FinTech
- Florida
- Food and Drug Administration
- Foreign Intelligence Surveillance Act
- France
- Franchise
- Fred Cate
- Freedom of Information Act
- Freedom of Speech
- Fundamental Rights
- GDPR
- Geofencing
- Geolocation
- Georgia
- Germany
- Global Privacy Assembly
- Global Privacy Enforcement Network
- Gramm Leach Bliley Act
- Hacker
- Hawaii
- Health Data
- Health Information
- HIPAA
- HIPPA
- HITECH Act
- Hong Kong
- House of Representatives
- Hungary
- Illinois
- India
- Indiana
- Indonesia
- Information Commissioners Office
- Information Sharing
- Insurance Provider
- Internal Revenue Service
- International Association of Privacy Professionals
- International Commissioners Office
- Internet
- Internet of Things
- IP Address
- Ireland
- Israel
- Italy
- Jacob Kohnstamm
- Japan
- Jason Beach
- Jay Rockefeller
- Jenna Rode
- Jennifer Stoddart
- Jersey
- Jessica Rich
- John Delionado
- John Edwards
- Kentucky
- Korea
- Latin America
- Laura Leonard
- Law Enforcement
- Lawrence Strickling
- Legislation
- Legislature
- Liability
- Lisa Sotto
- Litigation
- Location-Based Services
- London
- Madrid Resolution
- Maine
- Malaysia
- Markus Heyder
- Maryland
- Massachusetts
- Meta
- Mexico
- Microsoft
- Minnesota
- Mobile App
- Mobile Device
- Montana
- Morocco
- MySpace
- Natascha Gerlach
- National Institute of Standards and Technology
- National Labor Relations Board
- National Science and Technology Council
- National Security
- National Security Agency
- National Telecommunications and Information Administration
- Nebraska
- NEDPA
- Netherlands
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- New Zealand
- Nigeria
- Ninth Circuit
- North Carolina
- Norway
- Obama Administration
- OECD
- Office for Civil Rights
- Office of Foreign Assets Control
- Ohio
- Online Behavioral Advertising
- Opt-In Consent
- Oregon
- Outsourcing
- Pakistan
- Parental Consent
- Paul Tiao
- Payment Card
- PCI DSS
- Penalty
- Pennsylvania
- Personal Data
- Personal Health Information
- Personal Information
- Personally Identifiable Information
- Peru
- Philippines
- Phyllis Marcus
- Poland
- PRISM
- Privacy By Design
- Privacy Policy
- Privacy Rights
- Privacy Rule
- Privacy Shield
- Protected Health Information
- Ransomware
- Record Retention
- Red Flags Rule
- Rhode Island
- Richard Thomas
- Right to Be Forgotten
- Right to Privacy
- Risk-Based Approach
- Rosemary Jay
- Russia
- Safe Harbor
- Sanctions
- Schrems
- Scott Kimpel
- Securities and Exchange Commission
- Security Rule
- Senate
- Serbia
- Service Provider
- Singapore
- Smart Grid
- Smart Metering
- Social Media
- Social Security Number
- South Africa
- South Carolina
- South Korea
- Spain
- Spyware
- Standard Contractual Clauses
- State Attorneys General
- Steven Haas
- Stick With Security Series
- Stored Communications Act
- Student Data
- Supreme Court
- Surveillance
- Sweden
- Switzerland
- Taiwan
- Targeted Advertising
- Telecommunications
- Telemarketing
- Telephone Consumer Protection Act
- Tennessee
- Terry McAuliffe
- Texas
- Text Message
- Thailand
- Transparency
- Transportation Security Administration
- Trump Administration
- United Arab Emirates
- United Kingdom
- United States
- Unmanned Aircraft Systems
- Uruguay
- Utah
- Vermont
- Video Privacy Protection Act
- Video Surveillance
- Virginia
- Viviane Reding
- Washington
- WeProtect Global Alliance
- Whistleblowing
- Wireless Network
- Wiretap
- ZIP Code