Law / United States / 
Georgia
Georgia Fair Business Practices Act, civil action by individuals
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Expect a Georgia consumer harmed by a deceptive or unfair act or practice, including a misrepresentation about data collection or protection, to be able to sue individually for injunctive relief and damages under the Fair Business Practices Act.
- Do not treat the absence of a private right of action under the Personal Identity Protection Act's breach-notification duty as immunity from suit. A breach involving a deceptive or unfair practice can still be pursued under the Fair Business Practices Act.
- Expect exemplary damages and full attorneys' fees where a violation is found intentional.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The highest ceiling for a breach of the Act's own prohibitions is a civil penalty of up to $5,000 per violation, which a superior court may grant in an action by the Attorney General (O.C.G.A. 10-1-397(b)(2)(B)). The Attorney General may instead issue an order imposing a civil penalty of up to $2,000 per violation on a person who willfully violates the Act (10-1-397(b)(1)(B)). A separate civil penalty of up to $25,000 per violation applies to a person who violates the terms of an injunction issued under 10-1-397 (10-1-405(a)); that is a penalty for disobeying a court order, not the ceiling for a breach of the Act.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
No fixed sum: the injured person recovers general damages and, only for an intentional violation, exemplary damages, and the court awards three times actual damages for an intentional violation (O.C.G.A. 10-1-399(a) and (c)). The action may be brought only individually, not in a representative capacity.
- As of
Who enforces it
Enforcement body
The Attorney General enforces the Fair Business Practices Act through cease and desist orders, civil penalties, restitution and superior court actions (O.C.G.A. 10-1-397); an injured individual may also sue under 10-1-399, individually and not in a representative capacity. A separate civil penalty of up to $25,000 per violation of an injunction is recovered by the Attorney General under 10-1-405.
Settledness
- As of
- Open questions
- Does a business's misstatement about how it collects or protects personal data on a service that charges the user nothing arise in a 'consumer transaction', which O.C.G.A. 10-1-392(a)(10) defines by a sale, purchase, lease or rental 'primarily for personal, family, or household purposes', so that a user may sue under 10-1-399(a)?
What it makes you log
Logging duty
Section 10-1-399 sets out who may sue under the Fair Business Practices Act and what they may recover: an individual action for injunctive relief and general and exemplary damages, a written demand for relief at least 30 days before suit, treble damages for an intentional violation, attorneys' fees, and service of the complaint on the Attorney General. It requires no log, record, register or documentation of anyone. Section 10-1-400 mentions 'the maintenance of procedures reasonably adopted to avoid any such error' only as a condition of a bona fide error defense that limits recovery, which is not a duty to keep a record.
- Kind
- None
- As of
What this law does
Any person who suffers injury or damage from a consumer act or practice that violates the Georgia Fair Business Practices Act may bring an individual civil action, though not a class action, to obtain equitable injunctive relief and to recover general and exemplary damages, with exemplary damages available only for an intentional violation and the court awarding three times actual damages for an intentional violation.
A prevailing injured party is also entitled to reasonable attorneys' fees and expenses of litigation, though fees incurred after rejecting a reasonable written settlement offer within 30 days of the required pre-suit demand are excluded, and fees shift against a plaintiff who continues an action after such a rejection in bad faith or to harass.
This private right of action is separate from, and broader in subject matter than, the Personal Identity Protection Act's breach-notification duty, which itself creates no private right of action. The Fair Business Practices Act of 1975, which first enacted this remedy, took effect on its approval by the Governor on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .