Tennessee Code Annotated

Tenn. Code Ann. § 29-34-215 (2026)

Liability of private entities for cybersecurity events

✓ current as of May 2026

Find cases: SyfertCases citing this section JustiaTenn. Code CornellLII Search CasesGoogle Scholar

(a) As used in this section:
- (1) "Cybersecurity event" means an event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system;
- (2) "Information system" has the same meaning as defined in § 56-2-1003;
- (3) "Nonpublic information" means information that is not publicly available and concerns a person that, because of a name, number, personal mark, or other identifier, can be used to identify that person, in combination with the following:
  - (A) A social security number;
  - (B) A driver license number or non-driver identification card number;
  - (C) A financial account number or credit or debit card number;
  - (D) A security code, access code, or password that would permit access to the person's financial accounts; or
  - (E) Biometric records;
- (4) "Private entity" means a corporation, religious or charitable organization, association, partnership, limited liability company, limited liability partnership, or other private business entity, whether organized for-profit or not-for-profit; and
- (5) "Publicly available information" means information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public.

(b) A private entity is not liable in a class action lawsuit resulting from a cybersecurity event unless the cybersecurity event was caused by willful and wanton misconduct or gross negligence on the part of the private entity.

Added by 2024 Tenn. Acts, ch. 991,s 1, eff. 5/21/2024.

Notes of Decisions

Cited in 2 cases (2 in the last 5 years), 2024–2025 · leading case: Mason v. Wright Bros. Constr. Co., Inc. (E.D. Tenn. 2025).

Sort: Relevance Newest Treatment

Mason v. Wright Bros. Constr. Co., Inc. (E.D. Tenn. 2025). · cites it 21× “” Tenn. Code Ann. § 29-34-215 (1)(b). While Section 2 states that “[t]his act takes effect upon becoming a law,” the statute does not expressly state that it applies retroactively.”

Cahill v. Mem'l Heart Inst., LLC (E.D. Tenn. 2024). · cites it 19× “” Tenn. Code Ann. § 29-34-215 (1)(b). Section 2 of §29-34-215 states “[t]his act takes effect upon becoming a law.”

Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.