Page 340 - GDPR and US States General Privacy Laws Deskbook

340 | Tennessee Information Protection Act
(B) Does not include:
(i)  The disclosure of personal information to a processor that processes the personal information on behalf of the
controller;
(ii)  The disclosure of personal information to a third party for purposes of providing a product or service requested by
the consumer;
(iii) The disclosure or transfer of personal information to an affiliate of the controller;
(iv) The disclosure of information that the consumer:
(a) Intentionally made available to the general public via a channel of mass media; and
(b) Did not restrict to a specific audience; or
(v)  The disclosure or transfer of personal information to a third party as an asset that is part of a merger, acquisition,
bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets;
(26) “Sensitive data” means a category of personal information that includes:
(A)  Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual
orientation, or citizenship or immigration status;
(B) The processing of genetic or biometric data for the purpose of uniquely identifying a natural person;
(C) The personal information collected from a known child; or
(D) Precise geolocation data;
(27)  “State agency” means an agency, institution, board, bureau, commission, council, or instrumentality of state government
in the executive branch;
(28) “Targeted advertising”:
(A)  Means displaying to a consumer an advertisement that is selected based on personal information obtained from that
consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s
preferences or interests; and
(B) Does not include:
(i) Advertisements based on activities within a controller’s own websites or online applications;
(ii) Advertisements based on the context of a consumer’s current search query, visit to a website, or online application;
(iii) Advertisements directed to a consumer in response to the consumer’s request for information or feedback; or
(iv) Personal information processed solely for measuring or reporting advertising performance, reach, or frequency;
(29)  “Third party” means a natural or legal person, public authority, agency, or body other than the consumer, controller,
processor, or an affiliate of the processor or the controller; and