Who Is Covered?

Any information broker or data collector that maintains computerized data that includes personal information of individuals. Ga. Code Ann. § 10-1-912(a).

 “Data collector” means any state or local agency or subdivision thereof including any department, bureau, authority, public university or college, academy, commission, or other government entity; provided, however, that the term “data collector” shall not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes or for purposes of providing public access to court records or to real or personal property information. Ga. Code Ann. § 10-1-911(2).

“Information broker” means any person or entity who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring, or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated third parties, but does not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes. Ga. Code Ann. § 10-1-911(3).

What Information Is Protected?

“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:

1. Social security number;
2. Driver’s license number or state identification card number;
3. Account number, credit card number, or debit card number, if circumstances exist wherein such a number could be used without additional identifying information, access codes, or passwords;
4. Account passwords or personal identification numbers or other access codes; or  
5. Any of the items contained in subparagraphs 1 through 4 above when not in connection with the individual’s first name or first initial and last name, if the information compromised would be sufficient to perform or attempt to perform identity theft against the person whose information was compromised. Ga. Code Ann. § 10-1-911(6).

What Is A “Breach”?

“Breach of the security of the system” means unauthorized acquisition of an individual’s electronic data that compromises the security, confidentiality, or integrity of personal information of such individual maintained by an information broker or data collector. Good faith acquisition or use of personal information by an employee or agent of an information broker or data collector for the purposes of such information broker or data collector is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure. Ga. Code Ann. § 10-1-911(1).

What Triggers Notification?

Notice must be given of any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Ga. Code Ann. § 10-1-912(a).

How Is Notice Provided To Individuals?

Timing: The notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, or with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system. Ga. Code Ann. § 10-1-912(a).

Delivery: Notice may be made by:

1. Written notice;
2. Telephone notice;
3. Electronic notice consistent with the requirements of the E-Sign Act; or
4. Substitute notice, in certain circumstances. Ga. Code Ann. § 10-1-911(4).

Content: None specified.

Is Notice To The Government Required?

No.

Is Notice To Consumer Reporting Agencies Required?

Yes. In the event that an information broker or data collector discovers circumstances requiring notification pursuant to this Code section of more than 10,000 residents of this state at one time, the information broker or data collector shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nation-wide basis of the timing, distribution, and content of the notices. Ga. Code Ann. § 10-1-912(c).

Are There Security Measure Standards?

No.

What Are The Possible Consequences Of A Violation?

N/A.

Are There Any Exemptions/Exceptions

No.