Processes personal data, in Georgia

O.C.G.A. Sec. 10-1-399 · Read the law's page

• Expect a Georgia consumer harmed by a deceptive or unfair act or practice, including a misrepresentation about data collection or protection, to be able to sue individually for injunctive relief and damages under the Fair Business Practices Act.
• Do not treat the absence of a private right of action under the Personal Identity Protection Act's breach-notification duty as immunity from suit. A breach involving a deceptive or unfair practice can still be pursued under the Fair Business Practices Act.
• Expect exemplary damages and full attorneys' fees where a violation is found intentional.

O.C.G.A. Sec. 10-15-2 · Read the law's page

• This binds any 'business': a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, expressly including a financial institution and an entity that destroys records, that discards or disposes of a customer's record containing personal information.
• Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.
• A bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to HIPAA's privacy and security provisions, or any other entity governed by a federal law that itself requires disposal of such records in the same manner, is exempt from this duty.
• Expect Attorney General enforcement, using the Fair Business Practices Act's investigative powers, with an administrative penalty of up to $500 per wrongfully discarded customer record, capped at $10,000 total per order; a business that shows it used due diligence in attempting to properly dispose of the record has an affirmative defense, and the statute creates no private right of action of its own.

O.C.G.A. Sec. 10-1-912 · Read the law's page

• Give notice of a breach of the security of a system containing a Georgia resident's personal information in the most expedient time possible and without unreasonable delay.
• Notify the information broker or data collector you maintain data for of any breach you discover within 24 hours following discovery, so that party can meet its own notice duty.
• Notify, without unreasonable delay, all nationwide consumer reporting agencies of the timing, distribution and content of the notices if a breach requires notifying more than 10,000 Georgia residents at one time.
• Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Georgia's personal information definition does not include any of those categories.