Tennessee Enacts Law Raising Bar for Class Action Data Breach Lawsuits

Tennessee Governor Bill Lee has signed Public Chapter 991 on May 21, 2024, a law that introduces a higher liability threshold for class action lawsuits stemming from cybersecurity incidents, effectively raising the bar for legal pleadings in such cases. This new legislation does not alter the existing requirement for companies to exercise "reasonable care" in safeguarding data nor does it address individual litigation outside of class actions. Under this new law, plaintiffs in class action suits must prove that the cybersecurity incident was caused by "willful and wanton misconduct or gross negligence" on the part of the private entity involved. The law does not modify the existing "reasonable care" requirement for data protection, nor does it address individual lawsuits outside of class actions. Instead, it imposes a more rigorous pleading standard for class action cases. The law will apply to both for-profit and non-profit entities, including those in the healthcare sector.