Tennessee Identity Theft Laws: Rights, Penalties, and Protection

Identity theft can devastate a victim’s finances, credit history, and peace of mind. Tennessee has created a detailed legal framework addressing this problem, combining criminal penalties, victim protections, and consumer data safeguards to limit the damage and deter offenders.

This guide explains how identity theft is defined under Tennessee law, the difference between identity theft and identity theft trafficking, how victims are protected, and what businesses must do when personal information is exposed.

Core Legal Definition of Identity Theft in Tennessee

Under Tennessee Code Title 39, Chapter 14, Section 150, a person commits identity theft when they knowingly obtain, possess, buy, or use the personal identifying information of another person in order to carry out an unlawful act without consent or legal authority.

Several elements must be present for conduct to qualify as identity theft:

• Personal identifying information of another person is involved, such as a Social Security number, driver’s license number, financial account information, or medical identifiers.
• The information is obtained, possessed, bought, or used knowingly.
• There is an intent to commit an unlawful act, often involving obtaining credit, goods, services, or medical information in the victim’s name.
• The person lacks consent or lawful authority to use that identifying information.

Identity theft is treated as a continuing offense in Tennessee, because the unlawful use of a victim’s identifying information can harm the victim wherever they live or are found, and may continue over time.

Identity Theft vs. Identity Theft Trafficking

Tennessee law distinguishes between using someone’s identifying information yourself and transferring that information to others for unlawful purposes.

Identity theft trafficking targets individuals and networks that distribute stolen personal information, essentially treating the trade of identifying data as a more serious offense than individual misuse.

Criminal Penalties and Sentencing Consequences

The punishment for identity-related crimes in Tennessee depends on the specific offense and its classification as a misdemeanor or felony.

Felony Classification

• Identity theft under Tennessee Code § 39-14-150(b) is a Class D felony.
• Identity theft trafficking under § 39-14-150(c) is a Class C felony.

Felony convictions can lead to years in prison, significant fines, and long-term consequences for employment, housing, and professional licensing.

Examples of Penalties and Additional Consequences

• Class D felony identity theft is commonly associated with the possibility of multiple years of incarceration and substantial fines.
• Identity theft trafficking, as a Class C felony, typically carries harsher sentencing ranges than simple identity theft because it involves distributing personal data for others to misuse.
• Courts may order forfeiture of property derived from identity theft crimes, which can include money, vehicles, and other assets connected to the offense.
• In some contexts, using another person’s identification or a fake ID to obtain goods may be treated as a misdemeanor, but more serious misuse or repeated conduct can escalate to felony-level charges.

Aggravating factors, such as the amount of loss, number of victims, or victims’ vulnerability, can influence sentencing outcomes and the likelihood of additional federal charges in severe cases.

Victims’ Rights Under the Identity Theft Victims’ Rights Act

Tennessee refers to § 39-14-150 as the Identity Theft Victims’ Rights Act of 2004, highlighting the importance of protecting people whose identifying information is misused.

Under this statute, a victim is defined as the person whose identifying information was obtained or used in violation of identity theft or identity theft trafficking provisions.

Key Protections for Victims

• Recognition as a crime victim: The law clearly defines victims of identity theft, supporting their access to victim services and participation in criminal proceedings.
• Potential restitution orders: Courts may require offenders to pay restitution for financial losses caused by the identity theft, such as fraudulent charges or costs incurred to correct credit records, subject to court findings and applicable law.
• Use of official records to restore identity: Victims may seek documentation from law enforcement or the courts confirming the identity theft, which can help in dealing with creditors, credit reporting agencies, and other entities.

These rights are designed to help victims repair the damage caused by identity theft, which often extends far beyond the initial misuse of information.

Consumer Data Protection and Breach Notification Duties

Beyond criminal law, Tennessee has enacted consumer protection and data breach notification requirements to reduce identity theft risk and ensure transparency when personal information is exposed.

Under Title 47, Chapter 18, Part 21 of the Tennessee Code, businesses and governmental entities must notify affected residents when certain personal data is accessed without authorization in a computer system.

Who Must Provide Notice?

• Any business operating in Tennessee that maintains personal consumer information.
• State agencies and their political subdivisions, including county governments.

Information Covered by Breach Notification Rules

Notice is triggered when an unauthorized party obtains a person’s name in combination with sensitive data, such as:

• Social Security number.
• Driver license number.
• Financial account numbers.
• Credit or debit card numbers.

Publicly available information from government records is not considered protected personal information for these breach provisions.

Methods and Scope of Notification

Entities can provide notice in several ways, depending on the scale and expense of the breach response:

• Written or electronic notice to affected individuals is the standard approach.
• Substitute notice is allowed when direct notice costs are extremely high (over $250,000) or when more than 500,000 people must be notified.

Substitute notice typically involves:

• Email notices where email addresses are available.
• Conspicuous posting of the notice on the entity’s website.
• Notification through major statewide media outlets.

If a breach affects more than 1,000 people at once, the entity must also notify consumer reporting agencies and credit bureaus.

Civil Remedies for Violations

Individuals injured by a violation of Tennessee’s data breach notification law may bring civil actions against businesses that fail to comply, seeking damages or court orders to stop the noncompliant conduct.

State agencies and political subdivisions, however, are exempt from the civil damages portion of the act.

Improper Disposal of Personal Information and Civil Penalties

Tennessee law addresses not only unauthorized access to data but also wrongful disposal of records containing personal identifying information.

Improper disposal of such records can be treated as a violation of the Tennessee Consumer Protection Act of 1977 and may lead to civil penalties.

• A violation involving wrongful disposal of customer records can result in a civil penalty of $500 per record, subject to a maximum of $10,000 per affected customer.
• These penalties are intended to incentivize businesses to securely destroy documents and electronic records containing sensitive consumer information.

Role of the Tennessee Identity Crimes Unit

Tennessee supports enforcement and investigation of identity-related offenses through its Identity Crimes Unit, part of the Department of Safety and Homeland Security.

The unit’s mission includes:

• Investigating identity crimes across the state.
• Assisting local, state, and federal agencies with complex identity theft investigations.
• Providing specialized expertise in detecting and dismantling identity theft schemes.

Victims and law enforcement agencies may work with the Identity Crimes Unit on significant or multi-jurisdictional identity theft cases.

Practical Steps for Tennessee Consumers to Reduce Risk

While the law provides tools for punishment and remediation, consumers can take practical measures to reduce their exposure to identity theft and respond effectively if it occurs.

Preventive Measures

• Limit sharing of Social Security numbers and other sensitive identifiers to situations where they are truly necessary.
• Use strong, unique passwords for financial, email, and healthcare accounts, and enable multi-factor authentication where available.
• Monitor bank and credit card statements regularly for unusual charges.
• Review credit reports periodically to spot unauthorized accounts or inquiries.
• Shred or securely destroy documents containing personal or financial information.

Responding to Suspected Identity Theft

• Contact local law enforcement and request a police report documenting the identity theft.
• Notify financial institutions and creditors of any fraudulent accounts or transactions.
• Place fraud alerts or security freezes with major credit reporting agencies.
• Retain copies of correspondence and records related to the identity theft to support any restitution claims or disputes.
• Consider consulting a qualified attorney to understand criminal complaints, civil remedies, and interactions with Tennessee’s identity theft statutes.

Frequently Asked Questions About Tennessee Identity Theft Law

Is all misuse of another person’s information considered identity theft?

No. For conduct to meet Tennessee’s legal definition of identity theft, the person must knowingly obtain or use another individual’s identifying information with intent to commit an unlawful act and without consent or legal authority.

What is the difference between identity theft and identity theft trafficking?

Identity theft focuses on the offender’s own acquisition or use of someone else’s identifying information for unlawful purposes. Identity theft trafficking targets those who sell, transfer, or otherwise distribute another person’s identifying information so that someone else can use it to commit unlawful acts.

How serious are the criminal penalties in Tennessee?

Identity theft is classified as a Class D felony and identity theft trafficking as a Class C felony, meaning both are serious offenses that can result in significant prison time, fines, and long-term collateral consequences.

What rights do victims have under Tennessee law?

Victims are recognized and defined in the Identity Theft Victims’ Rights Act of 2004 and may receive assistance through law enforcement and court processes, including potential restitution orders and documentation to correct credit and identity records.

Are businesses required to notify customers after a data breach?

Yes. Tennessee law requires businesses and certain government entities to notify affected residents when key pieces of personal information, such as Social Security numbers or financial account data, are accessed without authorization in a computer system.

Can civil actions be brought for failure to disclose a data breach?

Individuals injured by a violation of Tennessee’s data breach notification law may bring civil actions against non-government entities to recover damages or seek court orders enforcing compliance, although state agencies and political subdivisions are exempt from civil damages provisions.

Similar Articles

Your First Credit Card: How to Avoid Costly Fine‑Print Traps

Smart Student Borrowing: A Financial Literacy Guide

Brendlin v. California and the Fourth Amendment Passenger Rule

Miranda v. Arizona and the Birth of Modern Police Warnings

Bankruptcy Glossary: Plain-Language Guide To Common Terms Now

Understanding Bankruptcy Noticing in Federal Courts

Author

medha deb

 

Medha Deb is an editor with a master's degree in Applied Linguistics from the University of Hyderabad. She believes that her qualification has helped her develop a deep understanding of language and its application in various contexts.

Read full bio of medha deb