Tennessee is expected to become the eighth or ninth state to enact a comprehensive data privacy law. Tennessee Information Protection Act (“TIPA”) is a unique safe harbor compared to other recently enacted laws: it offers an affirmative defense to businesses who create, maintain and comply with a written privacy program that “reasonably conforms” to the National Institute of Standards and Technology (“NIST”) privacy framework or “other documented policies, standards, and procedures designed to safeguard consumer privacy.”

Last month, three state legislatures passed comprehensive data privacy laws. This week, Indiana’s governor signed the Indiana Consumer Data Privacy Act (“ICDPA’) into law. Montana and Tennessee likely to follow right behind. These newcomers will join the six other states with data privacy statutes already enacted.

The privacy compliance landscape has changed significantly in 2022. These acronyms have joined the CCPA, HIPAA, and GDPR in the privacy alphabet soup: CPRA, VCDPA, CDPA, CPA, and UCPA. Do you know what they all mean for your company and what they will require in order to be compliant?  

If you haven’t already got December 27^th on your calendar, it’s the deadline for updating your documentation for transfers of personal data from the European Economic Area (EEA) to other countries – including the United States. Read our blog post regarding this issue and contact the Mintz Privacy Team if you need assistance. 

Read about how the California Privacy Rights Act (CPRA) will eliminate an exemption that allows employers to exclude some employee and applicant personal information from the reach of the California Consumer Privacy Act (CCPA) as of January 1, 2023.

If you’ve relied on the temporary “exemption” for employee/applicant and business-to-business (B2B) personal information under the California Consumer Privacy Act (CCPA), those exemptions will expire on January 1, 2023.   The California legislature adjourned on August 31 for the 2022 session without adopting legislation to extend those exemptions, and therefore, absent a special legislative session, they will sunset on December 31.

California is leading the way on privacy regulation --- again.   The California State Assembly has passed AB 2273, which, if approved by the California Governor, would require businesses that provide online services, products, or features likely to be accessed by children or teens under the age of 18 to increase their privacy and safety protections.