Tort Liability and Reform - As enacted, declares a private entity to be not civilly liable in a class action resulting from a cybersecurity event unless the cybersecurity event was caused by willful and wanton misconduct or gross negligence on the part of the private entity. - Amends TCA Title 29 and Title 47.

This Tennessee law limits the ability of groups of people to sue private businesses for damages resulting from data breaches or unauthorized access to computer systems. Under the new rules, a private company will only be held financially responsible in a class-action lawsuit if the security incident was caused by willful misconduct, wanton behavior, or gross negligence. The legislation specifically defines a "cybersecurity event" as unauthorized access to or disruption of an information system containing nonpublic personal data, such as social security numbers or financial account details. By raising the standard for liability, the bill aims to protect private entities from broad lawsuits unless they acted with a high degree of fault.