Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On May 21, Tennessee Governor Bill Lee signed into law<a> </a><a href="https://legiscan.com/TN/bill/HB2434/2023" target="_blank" rel="noreferrer noopener">House Bill (HB) 2434</a>, which provides a legal safe harbor for businesses that are victims of data breaches. Given the sophistication of today’s criminal cyber actors, a data breach can impact even the best-prepared business. Unfortunately, a business that falls victim to a cybersecurity event may itself become the target of litigation or government enforcement actions. Accordingly, with HB 2434, Tennessee joins the <a href="https://www.thompsonhine.com/insights/florida-and-west-virginia-create-new-cybersecurity-safe-harbor-laws/" target="_blank" rel="noreferrer noopener">growing number of states</a> seeking to provide legal protections to businesses that suffer data breaches and to deter frivolous litigation. The law goes into effect immediately.

contentpilot/introduction

core/heading

<a>HB 2434 </a>provides that a “private entity is not liable in a class action lawsuit resulting from a cybersecurity event,” provided the event was not “caused by willful and wanton misconduct or gross negligence on the part of the private entity.”

core/paragraph

Interestingly, the law does not limit the type of class action claims affected by the safe harbor. Given that most data breach-related class actions allege negligence, breach of contract, and invasion of privacy-type claims, the reach of the safe harbor likely is very broad. In addition, unlike other data breach safe harbor laws, HB 2434 does not prescribe any specific information security standard or program the private entity must satisfy or establish to be afforded the legal safe harbor. However, Tennessee has enacted other laws related to the safe <a href="https://law.justia.com/codes/tennessee/2021/title-39/chapter-14/part-1/section-39-14-150/" target="_blank" rel="noreferrer noopener">disposal of sensitive personal information</a> and <a href="https://legiscan.com/TN/text/SB0073/id/2817209" target="_blank" rel="noreferrer noopener">security control requirements</a> for the protection of consumers’ personal information.

The law defines a “cybersecurity event” broadly as an “event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system.” Accordingly, it could apply to ransomware attacks, business email compromises, or stolen devices containing accessible protected information.

The term “nonpublic information” means “information that is not publicly available and concerns a person that, because of a name, number, personal mark, or other identifier, can be used to identify that person, in combination with”:

core/list

Interestingly, this definition includes types of personal data that are not included in <a href="https://law.justia.com/codes/tennessee/2021/title-47/chapter-18/part-21/section-47-18-2107/" target="_blank" rel="noreferrer noopener">Tennessee’s data breach notification statute</a>, but does not cover all the various types of data that may trigger notification obligations under various federal and state personal data breach notification laws, such as passport numbers, military identification numbers, dates of birth, health data, and online accounts and passwords.

Further, the law defines an “information system” as either a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic nonpublic information; or a specialized system, including an industrial or process control system, a telephone switching and private branch exchange system, or an environmental control system.

The term “private entity” means “a corporation, religious or charitable organization, association, partnership, limited liability company, limited liability partnership, or other private business entity, whether organized for-profit or not-for-profit,” and therefore HB 2434 will cover several different types of private-sector organizations.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/05/Privacy-Cybersecurity-Update-Tennessee-Enacts-Data-Breach-Class-Action-Safe-Harbor.pdf

Tennessee Enacts Data Breach Class Action Safe Harbor

Services