Tort Liability and Reform - As enacted, declares a private entity to be not civilly liable in a class action resulting from a cybersecurity event unless the cybersecurity event was caused by willful and wanton misconduct or gross negligence on the part of the private entity. - Amends TCA Title 29 and Title 47.

This bill limits the ability of private companies to be sued in class-action lawsuits following a cybersecurity breach. It applies to any private business, including non-profits, and protects them from civil liability unless the breach was caused by willful misconduct, wanton behavior, or gross negligence. The law defines a cybersecurity event as unauthorized access to or disruption of an information system containing sensitive personal data, such as social security numbers or financial account details. By raising the standard of fault required for lawsuits, the bill aims to reduce the legal exposure for organizations that suffer data breaches through ordinary negligence.