Crawls the web, in Georgia

O.C.G.A. Sec. 10-15-2 · Read the law's page

• This binds any 'business': a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, expressly including a financial institution and an entity that destroys records, that discards or disposes of a customer's record containing personal information.
• Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.
• A bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to HIPAA's privacy and security provisions, or any other entity governed by a federal law that itself requires disposal of such records in the same manner, is exempt from this duty.
• Expect Attorney General enforcement, using the Fair Business Practices Act's investigative powers, with an administrative penalty of up to $500 per wrongfully discarded customer record, capped at $10,000 total per order; a business that shows it used due diligence in attempting to properly dispose of the record has an affirmative defense, and the statute creates no private right of action of its own.

O.C.G.A. § 16-9-93 · Read the law's page

• Do not use a Georgia-connected computer or computer network in a manner that exceeds the right or permission its owner granted; ordinary access to a page that grants and denies no specific permission at all does not, on the statute's own text, become use 'without authority.'
• Do not take, delete, alter, or interfere with computer data, programs, or operation without authority; doing so with the required intent is computer theft or computer trespass regardless of whether the access was automated.
• Do not use a computer without authority to examine another person's employment, medical, salary, credit, or other financial or personal data; this reaches automated collection of such data just as it reaches direct access.
• Expect a private civil action for damages in addition to criminal prosecution if your access violates this Act; the civil claim under subsection (g) carries a four-year discovery-based limitations period.