USA – GEORGIA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
Social Security numbers, dates of birth, addresses and health insurance details) was exfiltrated and appeared for sale on the dark web. The trial court dismissed the complaint in full. Presiding Judge Christopher McFad - den, writing for a unanimous panel, reversed on the negligence, implied contract and implied covenant claims while affirming dismissal with prejudice of the unjust enrichment claim on the ground that plaintiffs failed to allege the defendant received any benefit from their personal information. On the duty-of-care question (a matter of first impression for Georgia appellate courts), the panel looked to the Eleventh Circuit’s analysis in Ramirez v The Paradies Shops , 69 F.4th 1213 (11th Cir. 2023) (persuasive, not binding), concluding that the foreseeability of medical identity theft, combined with the defendant’s ability to prevent the breach through reasonable measures, established a duty at the pleading stage. On injury, the court held that plaintiffs adequately alleged harm by claiming their personally identifiable information had been stolen and offered for sale on the dark web, and that an imminent fraud risk fol- lowed, aligning Georgia state doctrine with Ramirez’s standing analysis, which treated imminent misuse of stolen data as sufficient injury. Bland did not defini - tively resolve the standing issue where data was accessed but not yet demonstrably misused; that argument remains available to defendants as the doc - trine develops. The implied contract holding adds a second avenue for plaintiffs: the exchange of person - al information as a condition of receiving services or employment creates contractual obligations to protect that information. Bland changes the litigation risk calculus for Georgia organisations holding significant volumes of sensitive personal information (particularly healthcare providers) by applying traditional tort foreseeability principles to data breach liability for the first time at the Georgia appellate level. The decision provides no guidance on which security measures will satisfy the duty at the merits stage, leaving organisations to calibrate invest - ments against data sensitivity, breach likelihood and evolving industry standards. Counsel should review incident response plans, cybersecurity documenta - tion and data governance practices accordingly. Post- Bland, the breach notification framework and com -
mon law liability require integrated analysis: a breach triggering statutory notification obligations will gener - ate facts directly relevant to negligence and implied contract claims, and organisations should not manage these exposures in separate tracks. AI in the courts: hallucinations, sanctions and practitioner accountability Georgia’s courts confronted AI-generated legal hal - lucinations for the first time in June 2025. In Shahid v Esaam , 376 Ga. App. 145 (Ct. App. June 30, 2025), the Court of Appeals vacated a trial court order and imposed the maximum available sanctions after find - ing that counsel had submitted briefs containing fabricated case citations likely generated by AI. The trial court’s denial order itself cited two non-existent cases originating in the opposing attorney’s filings. On appeal, that attorney submitted a brief containing 11 additional fabricated citations out of 15 total, including a fictitious 2009 Georgia Supreme Court case cited in support of an attorney’s fees request. The Court of Appeals imposed a USD2,500 sanctions award (the maximum permitted) and vacated the trial court order for relying on non-existent authority. The court used the occasion to place Georgia’s legal profession on broad notice. Citing US Supreme Court Chief Justice John Roberts’s 2023 Year-End Report on the Federal Judiciary and similar incidents in oth - er jurisdictions, it catalogued the systemic harms: wasted resources for courts and opposing parties, reputational injury to judges whose names appear on fabricated opinions and, most critically, the risk that decisions rest on non-existent law. For privacy and technology practices specifically, Shahid signals that Georgia courts will treat hallucinated citations as sanctionable professional conduct, not harmless error. Practitioners should monitor local circuit rules as Georgia courts may develop formal AI disclosure requirements through additional sanctions decisions, standing orders or court rules. Independent citation verification should be treated as a core professional obligation, not a precautionary option. Data breach notification: framework and recent incidents Georgia’s data breach notification statute, the Per - sonal Identity Protection Act, Ga. Code Ann. §§ 10-1-
585 CHAMBERS.COM
Powered by FlippingBook