Protecting social security numbers from disclosure
Tenn. SSN Protection
Data security
Requires businesses that hold Social Security numbers to make reasonable efforts to keep them from public disclosure. SSNs may not be publicly displayed, sent over the internet without a secure connection or encryption, used alone as a website login, printed on mailed materials unless required, or printed on cards or badges consumers must show to get services.
- Where
- Tennessee
- Citation
- Tenn. Code Ann. § 47-18-2110
- Status
- In force
- In force since
- 2008-01-01
- Enforced by
- Tennessee Attorney General (civil, as a part 21 and Tennessee Consumer Protection Act violation); district attorneys (criminal)
- People can sue
- Limited
- Penalties
- Each violation is a separate Class B misdemeanor and also a civil violation of part 21, which carries a civil penalty of the greater of $10,000, $5,000 per day, or ten times the amount obtained (§ 47-18-2105(d)), plus TCPA remedies. Part 21 gives private actions for identity-theft practices (§ 47-18-2104); whether they reach SSN-display violations is not settled.
- Applies to
- Any person or nonprofit or for-profit business entity in Tennessee, including health care businesses, that has obtained a Social Security number for a legitimate business or governmental purpose
- Exempt: state agencies and businesses providing Medicaid (Title XIX) health care services
Practices it requires
- Do not print SSNs on materials mailed to consumers unless required by law or the document is a form or application.Tenn. Code Ann. § 47-18-2110(a)(4)
- Do not print SSNs on any check, card, identification, or badge a consumer must present to receive benefits or services.Tenn. Code Ann. § 47-18-2110(a)(5)
Security duties
- Make reasonable efforts to protect Social Security numbers from disclosure to the public, and do not post or display them in public.Tenn. Code Ann. § 47-18-2110(a)(1)
- Do not require SSNs to be transmitted over the internet unless the connection is secure or the number is encrypted.Tenn. Code Ann. § 47-18-2110(a)(2)
- Do not require an SSN to log on to a website unless combined with a password or other authentication device.Tenn. Code Ann. § 47-18-2110(a)(3)
Sources
- Official text
- 2007 Tenn. Pub. Acts ch. 170 (Credit Security Act of 2007), Tennessee Secretary of State
- Tenn. Code Ann. § 47-18-2110 (2025 code text and history, Justia)
- Tenn. Code Ann. § 47-18-2105 (civil penalties, Justia)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Code history lists amendments in 2009 (ch. 269) and 2015 (ch. 127); their exact effective dates were not confirmed, so last_amended is left null. | The name "Credit Security Act of 2007" for ch. 170 is from general knowledge and was not confirmed in the fetched text.
Research reference, not legal advice.