Law / United States / 
Georgia
Disposal of records containing personal information
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any 'business': a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, expressly including a financial institution and an entity that destroys records, that discards or disposes of a customer's record containing personal information.
- Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.
- A bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security provisions, or any other entity governed by a federal law that itself requires disposal of such records in the same manner, is exempt from this duty.
- Expect Attorney General enforcement, using the Fair Business Practices Act's investigative powers, with an administrative penalty of up to $500 per wrongfully discarded customer record, capped at $10,000 total per order; a business that shows it used due diligence in attempting to properly dispose of the record has an affirmative defense, and the statute creates no private right of action of its own.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The $500.00 figure is per customer's record wrongfully disposed of or discarded, subject to a $10,000.00 total ceiling on the fine levied under any one Attorney General administrative order (O.C.G.A. Sec. 10-15-6(a)). A business that shows it used due diligence in its attempt to properly dispose of or discard the record has an affirmative defense to the violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 10,000
- Per violation unit
- Violation
- Per violation amount
- 500
Who enforces it
Enforcement body
The Attorney General, under O.C.G.A. Sec. 10-15-5(a), using the investigative powers of the Fair Business Practices Act of 1975 (O.C.G.A. Sec. 10-1-390 et seq., including the investigative-demand and subpoena powers of O.C.G.A. Secs. 10-1-403 and 10-1-404). A hearing and any administrative review proceed under the Georgia Administrative Procedure Act, per O.C.G.A. Sec. 10-15-6(c).
What this law does
A 'business' may not discard or dispose of a customer's record containing personal information unless it shreds the record, erases the personal information, modifies the record to make the personal information unreadable, or takes other action it reasonably believes will ensure that no unauthorized person will have access to the personal information for the period between disposal and destruction.
'Business' is defined broadly (sole proprietorship, partnership, corporation, association, or other group, organized for profit or not), expressly includes a financial institution and an entity that destroys records, and excludes a bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security provisions, and any other entity governed by a federal law that itself requires disposal of such records in the same manner.
'Personal information' is personally identifiable data about a customer's medical condition, account or credit balance or limit, data supplied when opening an account or applying for a loan or credit, or a federal, state, or local income tax return, where 'personally identifiable' requires the data to be combined with an identifier such as a Social Security number, driver identification number, passport number, or date of birth; a name, address, or phone number alone is not personally identifiable data under this chapter.
The Attorney General enforces the duty using the Fair Business Practices Act's investigative powers, and may impose an administrative penalty of not more than $500.00 for each wrongfully discarded customer record, capped at $10,000.00 total per order, after notice and a hearing conducted under the Georgia Administrative Procedure Act; a business that shows it used due diligence in its attempt to properly dispose of the record has an affirmative defense. The chapter states no private right of action for a violation of this duty.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .