An exterior view of the Tennessee State Capitol building.NASHVILLE -- The bill, sponsored by Sen. Bill Ketron, R-Murfreesboro, passed 32-0. The House companion bill is awaiting consideration.
Under an amendment adopted by the Senate, the bill sets a 45-day time period within which a business must notify a consumer if his or her personal information held by the business was obtained by an unauthorized person. Employees of a business who use the information in an unlawful manner as unauthorized person would also trigger the notice requirements.
Ketron told colleagues that consumers sometimes are getting notifications 9 or 10 months after data has been breached. The bill originally set for a 14-day notice requirement but was changed to the 45-day period.