1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

In Tennessee, hemp-derived CBD is widely legal and used in a variety of products, like oils and lotions. The history of the legal status surrounding cannabidiol (“CBD”) in Tennessee has been unclear, in part due to the uncertainty about the differences between the strains of cannabis from which CBD can be derived. In fact, there are different laws governing CBD depending on if it is derived from hemp or marijuana, and the legislation has been amended as recently as April of 2019. Because there has been confusion regarding the legality of CBD, a brief history on the legislation may be appropriate.

In 2014, Governor Bill Haslam signed Public Chapter Number 916 into law, thereby excluding industrial hemp from the definition of marijuana. Additionally, the bill clarified that hemp will not be categorized as a controlled substance. Tenn. Code Ann. § 39-17-415(c). Just two years later, in 2017, another bill was enacted by Governor Haslam that amended the definition of hemp to include “any industrial hemp-derived products that do not contain more than three-tenths of one percent (0.3%) of delta-9 tetrahydrocannabinol (THC) in a topical or ingestible consumer product.” Id. § 43-26-102(4) (emphasis added). Considering a derivative of hemp is CBD, the 2017 amendments gave businesses the greenlight to sell products containing CBD that were meant for human consumption and topical use.

The 2017 changes, however, were then repealed following a 2019 amendment. Id. The 2019 amendments, via Public Chapter Number 87, mirrored the recent changes from the 2018 Farm Bill, which changed hemp’s categorization at the federal level from a controlled substance to an agricultural product. Agriculture Improvement Act of 2018, Pub. L. No. 115-334. Today, in Tennessee and federally, hemp is defined as “the plant cannabis sativa L. and any part of that plant, including the seeds thereof and all derivatives, extracts, cannabinoids, isomers, acids, salts, and salts of isomers, whether growing or not, with a delta-9 tetrahydrocannabinol (THC) concentration of not more than three-tenths of one percent (0.3%) on a dry weight basis.” Id. § 43-27-101 (emphasis added). Accordingly, even though the legislation excluded the 2017 language, by redefining hemp to include “derivatives, extracts, [and] cannabinoids,” Tennessee has opened the door for a wide-variety of products containing hemp-derived CBD oil—without the need for a prescription.

Marijuana-derived CBD, however, is regulated under different statutes in Tennessee and under certain circumstances is exempt from criminal prosecution. According to Tennessee Code Annotated, cannabidiol is excluded from the definition of marijuana under the following circumstances: (1) a cannabidiol product that has been approved by the FDA as a prescription medication; (2) cannabis oil containing cannabidiol when under the control of a four-year higher education institution as part of a clinical research study on the treatment of intractable seizures, cancer, and other diseases; and (3) cannabidiol oil with less than 0.9% of THC, if (a) the bottle of oil is labeled by the manufacturer as containing cannabidiol in the proper amounts, (b) the person possessing the oil has proof of the legal order or recommendation from the issuing state and proof that the person or person’s immediate family member has been diagnosed with intractable seizures or epilepsy by a Tennessee-licensed doctor. Tenn. Code. Ann. § 39-17-402(16)(A)-(F)(ii)(b).

Currently, there is no legislation directly on point which dictates what products can and cannot be sold to the public that contain hemp-derived CBD. However, commonly sold products containing CBD include lotions, creams, oils, and edible gummies. Regardless of the end product, though, certain annual licensing standards must be met before a person is legally allowed to produce hemp and its derivatives. Tenn. Code Ann. § 47-27-102.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

As of now, Tennessee has not implemented any new legislation in reaction to the EU’s enactment of the GDPR. However, in 2016, Tennessee became the first state to require information holder’s to notify state residents of a personal information security breach—regardless of whether the information was encrypted. Pub. Ch. No. 692 § 2. Previously, the law only required notification if the stolen information was unencrypted. Additionally, the bill changed the mandatory disclosure timeline from “the most expedient time possible and without unreasonable delay” to no later than 45 days after the discovery or notification of a security breach. Id. § 4.