ACT to amend Tennessee Code Annotated, Title 29 and Title 47, relative to civil liability
~tate of 1!tennessee
PUBLIC CHAPTER NO. 991
HOUSE BILL NO. 2434
By Representatives Terry, Sherrell
Substituted for: Senate Bill No. 2018
By Senators Reeves, Hensley
AN ACT to amend Tennessee Code Annotated, Title 29 and Title 47, relative to civil
liability.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF TENNESSEE:
SECTION 1. Tennessee Code Annotated, Title 29, Chapter 34, Part 2, is amended by
adding the following as a new section:
(a) As used in this section:
(1) "Cybersecurity event" means an event resulting in unauthorized
access to, or disruption or misuse of, an information system or nonpublic
information stored on an information system;
(2) "Information system" has the same meaning as defined in ยง 56-2-
1003;
(3) "Nonpublic information" means information that is not publicly
available and concerns a person that, because of a name, number, personal
mark, or other identifier, can be used to identify that person, in combination with
the following:
(A) A social security number;
(8) A driver license number or non-driver identification card
number;
(C) A financial account number or credit or debit card number;
(D) A security code, access code, or password that would permit
access to the person's financial accounts; or
(E) Biometric records;
(4) "Private entity" means a corporation, religious or charitable
organization, association, partnership, limited liability company, limited liability
partnership, or other private business entity, whether organized for-profit or notfor-profit; and
(5) "Publicly available information" means information that is lawfully
made available through federal, state, or local government records, or
information that a business has a reasonable basis to believe is lawfully made
available to the general public.
(b) A private entity is not liable in a class action lawsuit resulting from a
cybersecurity event unless the cybersecurity event was caused by willful and wanton
misconduct or gross negligence on the part of the private entity.
SECTION 2. This act takes effect upon becoming a law, the public welfare requiring it.
HOUSE BILL NO. 2434
PASSED: April 24, 2024
D..
CAME:'IIIQIPSEXTON,SPEAKER
HOUSE OF REPRESENTATIVES
A " -..\\,-.
' RANDY MCNA\L Y
SPEAKER OF THE SENATE
~.f
APPROVED this J f day of 2024
lu,
BILL LEE, GOVERNOR
PUBLIC CHAPTER NO. 991
HOUSE BILL NO. 2434
By Representatives Terry, Sherrell
Substituted for: Senate Bill No. 2018
By Senators Reeves, Hensley
AN ACT to amend Tennessee Code Annotated, Title 29 and Title 47, relative to civil
liability.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF TENNESSEE:
SECTION 1. Tennessee Code Annotated, Title 29, Chapter 34, Part 2, is amended by
adding the following as a new section:
(a) As used in this section:
(1) "Cybersecurity event" means an event resulting in unauthorized
access to, or disruption or misuse of, an information system or nonpublic
information stored on an information system;
(2) "Information system" has the same meaning as defined in ยง 56-2-
1003;
(3) "Nonpublic information" means information that is not publicly
available and concerns a person that, because of a name, number, personal
mark, or other identifier, can be used to identify that person, in combination with
the following:
(A) A social security number;
(8) A driver license number or non-driver identification card
number;
(C) A financial account number or credit or debit card number;
(D) A security code, access code, or password that would permit
access to the person's financial accounts; or
(E) Biometric records;
(4) "Private entity" means a corporation, religious or charitable
organization, association, partnership, limited liability company, limited liability
partnership, or other private business entity, whether organized for-profit or notfor-profit; and
(5) "Publicly available information" means information that is lawfully
made available through federal, state, or local government records, or
information that a business has a reasonable basis to believe is lawfully made
available to the general public.
(b) A private entity is not liable in a class action lawsuit resulting from a
cybersecurity event unless the cybersecurity event was caused by willful and wanton
misconduct or gross negligence on the part of the private entity.
SECTION 2. This act takes effect upon becoming a law, the public welfare requiring it.
HOUSE BILL NO. 2434
PASSED: April 24, 2024
D..
CAME:'IIIQIPSEXTON,SPEAKER
HOUSE OF REPRESENTATIVES
A " -..\\,-.
' RANDY MCNA\L Y
SPEAKER OF THE SENATE
~.f
APPROVED this J f day of 2024
lu,
BILL LEE, GOVERNOR
