USA – GEORGIA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
910 et seq., requires information brokers and data col - lectors to notify affected Georgia residents following discovery of a breach involving unencrypted personal information that was, or is reasonably believed to have been, acquired by an unauthorised person. Notice must be made in the most expedient time possible and without unreasonable delay, consistent with law enforcement needs or measures necessary to deter - mine the scope of the breach and restore the integrity of the data system. Unlike most state breach statutes, Georgia’s imposes no fixed notification deadline. Two additional provisions warrant particular attention from compliance and incident-response counsel. First, third-party data processors maintaining per - sonal information on behalf of a covered entity must notify the data owner within 24 hours of discovering a breach, a tight window demanding advance plan - ning and contractual clarity in vendor agreements. Second, when notification is required for more than 10,000 Georgia residents at one time, the notify - ing entity must also notify all nationwide consumer reporting agencies of the timing, distribution and content of the notices without unreasonable delay. One common point of confusion warrants clarifica - tion: Georgia’s statute does not impose a “substantial harm” trigger. The notification obligation arises upon unauthorised acquisition of the covered data, without any harm-probability filter; organisations cannot use a harm assessment to avoid notification when cov - ered personal information has been accessed without authorisation. The Dublin Medical Center breach illustrates the persistent vulnerability of smaller healthcare provid - ers. Suspicious activity was detected on 17 Octo - ber 2025; forensic investigation confirmed unau - thorised access and potential exfiltration of patient data affecting 32,090 patients, as reported to the US Department of Health and Human Services’ Office for Civil Rights. Notification letters began mailing on 17 December 2025, and plaintiffs’ counsel announced class action investigations in January 2026. Following Bland, smaller practices and regional systems with limited cybersecurity resources face the combina - tion of HIPAA enforcement exposure, Georgia breach notification obligations, and expanded common law tort liability, a convergence that makes proactive
investment in incident response planning increasingly urgent. Attorney General Carr: enforcement, advocacy and the FBPA Georgia AG Chris Carr has maintained an active pro - file on data privacy and children’s online safety across enforcement, litigation and federal legislative advoca - cy. On the federal front, Carr joined 31 other attorneys general in a late-2024 letter to congressional lead - ership urging passage of the Kids Online Safety Act (KOSA). In February 2026, he joined a coalition of 40 state and territorial AGs urging Congress to advance the Senate version of KOSA (S. 1748) while rejecting a House version the coalition viewed as insufficiently protective. That same month, AG Carr’s office opened a civil investigative demand inquiry into Roblox Corpo - ration, seeking information about the platform’s safety practices for minors, illustrating a regulatory strategy visible in AG offices nationally: deploying investigative authority proactively in the absence of comprehensive enforcement statutes. A frequently overlooked dimension of Georgia’s enforcement landscape is the AG’s authority under the Georgia Fair Business Practices Act (FBPA), Ga. Code Ann. §§ 10-1-390 et seq., the state’s primary unfair or deceptive acts or practices (UDAP) statute. The FBPA broadly prohibits unfair or deceptive prac - tices in the unregulated consumer marketplace (it does not extend to areas already governed by other state or federal regulatory frameworks) and empowers the AG to investigate, seek injunctive relief, impose civil penalties, and require restitution. Although the UDAP does not expressly address data privacy, AGs in Georgia and nationally have used analogous UDAP authority against entities whose data practices involve misleading privacy disclosures, inadequate security representations or deceptive data-sharing conduct. Organisations that make public commitments about their data practices (through privacy notices, market - ing materials or terms of service) and fail to honour them face FBPA exposure in addition to breach noti - fication and common law liability. Privacy counsel should audit external-facing data representations for consistency with actual organisational practices. The combination of SB 351 litigation, multistate coalition advocacy, targeted platform investigations and FBPA
586 CHAMBERS.COM
Powered by FlippingBook