Law / United States / 
Georgia
Georgia Personal Identity Protection Act, notification of security breach
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2008. Publisher's page: http://www.legis.ga.gov/legis/2007_08/fulltext/sb236.htmIn force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give notice of a breach of the security of a system containing a Georgia resident's personal information in the most expedient time possible and without unreasonable delay.
- Notify the information broker or data collector you maintain data for of any breach you discover within 24 hours following discovery, so that party can meet its own notice duty.
- Notify, without unreasonable delay, all nationwide consumer reporting agencies of the timing, distribution and content of the notices if a breach requires notifying more than 10,000 Georgia residents at one time.
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Georgia's personal information definition does not include any of those categories.
These lines are LexLint's reading of the law's text. Also read by: Georgia Attorney General's Consumer Protection Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Consumer Ed page describes the duty as reaching businesses that collect, transmit or maintain unencrypted digital records of personal information, where section 10-1-912(a) names an information broker or a data collector.
- As of
- Guidance link
- https://consumered.georgia.gov/ask-ed/2023-08-30/getting-notified-following-data-breach
- Guidance body
- Georgia Attorney General's Consumer Protection Division
- Open questions
- Must a business that is neither an 'information broker' nor a 'data collector' as O.C.G.A. 10-1-911 defines them give notice under 10-1-912(a), as the Attorney General's Consumer Ed page says of 'businesses who collect, transmit or maintain' personal information, or does the duty reach only those two defined classes?
What it makes you log
Logging duty
Code Section 10-1-912(a), as revised by Section 3 of SB 236 (2007-08) as passed, requires an information broker or data collector to give notice of a breach of the security of the system to any resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person; subsection (b) requires a person maintaining the data on its behalf to notify it within 24 hours of discovery, subsection (c) allows delay for a law enforcement investigation and subsection (d) requires notice to consumer reporting agencies when more than 10,000 residents are notified. Each is a notice, and no subsection requires the breach, its scope or the notices sent to be documented or kept. The text read is the Act as it passed in 2007, the enacted bill on the General Assembly's site, reached through an Internet Archive capture of that page; later amendments to the Code section are not read.
- Kind
- None
- As of
What this law does
An information broker or data collector, a term the Act defines to cover a state or local government agency or subdivision, that maintains computerized personal information on a Georgia resident must give notice of a breach of the security of the system in the most expedient time possible and without unreasonable delay, unless a law enforcement agency determines notification would compromise a criminal investigation.
A person or business maintaining data on behalf of an information broker or data collector must notify that broker or collector of a breach of the security of the system within 24 hours following discovery, and above a 10,000-resident notification threshold the notifying party must also notify nationwide consumer reporting agencies.
Georgia's personal information definition, in Code section 10-1-911, covers an individual's name combined with a Social Security number, a driver's license or state identification card number, an account, credit card, or debit card number where it could be used without additional identifying information, access codes, or passwords, or an account password, personal identification number or other access code, and also covers any of those elements without the name if the information would suffice for identity theft; biometric, genetic, and health data are absent from the definition entirely, so a breach of biometric data alone triggers no notice duty.
The Act has no direct notice duty running to a state regulator or the Attorney General, and Georgia courts have held the Act imposes no freestanding data-security standard of conduct in its own right. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .