In 2016 the General Assembly amended T.C.A. § 10-7-504 to provide that no governmental entity shall publicly disclose personally identifying information of any citizen of the state unless: (i) Permission is given by the citizen; (ii) Distribution is authorized under state or federal law; or (iii) Distribution is made: (a) To a consumer reporting agency as defined by the federal Fair Credit Reporting Act (15 U.S.C. §§ 1681 et seq.); (b) To a financial institution subject to the privacy provisions of the federal Gramm Leach Bliley Act (15 U.S.C. § 6802); or (c) To a financial institution subject to the International Money Laundering Abatement and Financial Anti–Terrorism Act of 2001 (31 U.S.C. §§ 5311 et seq.).
The law defines “personally identifying information” to include: (i) Social security numbers; (ii) Official state or government issued driver licenses or identification numbers; (iii) Alien registration numbers or passport numbers; (iv) Employer or taxpayer identification numbers; (v) Unique biometric data, such as fingerprints, voice prints, retina or iris images, or other unique physical representations; or (vi) Unique electronic identification numbers, routing codes or other personal identifying data which enables an individual to obtain merchandise or service or to otherwise financially encumber the legitimate possessor of the identifying data.
The law provides that it does not prohibit the use of personally identifying information by a governmental entity in the performance of its functions or the disclosure of personally identifying information to another governmental entity, or an agency of the federal government, or a private person or entity that has been authorized to perform certain duties as a contractor of the governmental entity.