05 LC
9 1671
House
Bill 648
By:
Representatives Martin of the
47th,
Amerson of the
9th,
Burkhalter of the
50th,
Royal of the
171st,
and Floyd of the
147th
A
BILL TO BE ENTITLED
AN ACT
AN ACT
To
amend Chapter 11 of Title 10 of the Official Code of Georgia Annotated, relating
to business records, so as to require a person or business that conducts
business in this state and that owns or licenses computerized data that includes
personal information to disclose in specified ways any breach of the security of
the data to any resident of this state whose unencrypted personal information
was, or is reasonably believed to have been, acquired by an unauthorized person;
to permit notification to be delayed if a law enforcement agency determines that
it would impede a criminal investigation; to require a person or business that
maintains computerized data that includes personal information owned by another
to notify the owner or licensee of the information of any breach of the security
of the data; to provide for certain civil actions; to define certain terms; to
amend Chapter 18 of Title 50 of the Official Code of Georgia Annotated, relating
to state printing and documents, so as to require an agency that owns or
licenses computerized data that includes personal information to disclose in
specified ways any breach of the security of the data to any resident of this
state whose unencrypted personal information was, or is reasonably believed to
have been, acquired by an unauthorized person; to permit notification to be
delayed if a law enforcement agency determines that it would impede a criminal
investigation; to require an agency that maintains computerized data that
includes personal information owned by another to notify the owner or licensee
of the information of any breach of the security of the data; to define certain
terms; to provide for legislative findings and declarations; to repeal
conflicting laws; and for other purposes.
BE
IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION
1.
The
General Assembly finds and declares as follows:
(1)
The privacy and financial security of individuals is increasingly at risk due to
the ever more widespread collection of personal information by both the private
and public sectors;
(2)
Credit card transactions, magazine subscriptions, telephone numbers, real estate
records, automobile registrations, consumer surveys, warranty registrations,
credit reports, and Internet websites are all sources of personal information
and form the source material for identity thieves;
(3)
Identity theft is one of the fastest growing crimes committed in this state.
Criminals who steal personal information such as social security numbers use the
information to open credit card accounts, write bad checks, buy cars, and commit
other financial crimes with other
peoplés
identities;
(4)
Identity theft is costly to the marketplace and to consumers; and
(5)
Victims of identity theft must act quickly to minimize the damage; therefore,
expeditious notification of possible misuse of a
persońs
personal information is imperative.
SECTION
2.
Chapter
11 of Title 10 of the Official Code of Georgia Annotated, relating to business
records, is amended by adding a new Code section to read as
follows:
"10-11-4.
(a)
As used in this Code section, the term:
(1)
'Breach of the security of the system' means unauthorized acquisition of
computerized data that compromises the security, confidentiality, or integrity
of personal information maintained by the person or business. Good faith
acquisition of personal information by an employee or agent of the person or
business for the purposes of the person or business is not a breach of the
security of the system, provided that the personal information is not used or
subject to further unauthorized disclosure.
(2)
'Personal information' means an
individuaĺs
first name or first initial and last name in combination with any one or more of
the following data elements, when either the name or the data elements are not
encrypted:
(A)
Social security number;
(B)
Driveŕs
license number or Georgia identification card number; or
(C)
Account number, credit card number, or debit card number, in combination with
any required security code, access code, or password that would permit access to
an
individuaĺs
financial account.
The
term 'personal information' does not include publicly available information that
is lawfully made available to the general public from federal, state, or local
government records.
(b)
Any person or business that conducts business in this state and that owns or
licenses computerized data that includes personal information shall disclose any
breach of the security of the system following discovery or notification of the
breach in the security of the data to any resident of this state whose
unencrypted personal information was, or is reasonably believed to have been,
acquired by an unauthorized person. The disclosure shall be made in the most
expedient time possible and without unreasonable delay, consistent with the
legitimate needs of law enforcement as provided in subsection (d) of this Code
section or any measures necessary to determine the scope of the breach and
restore the reasonable integrity of the data system.
(c)
Any person or business that maintains computerized data that includes personal
information that the person or business does not own shall notify the owner or
licensee of the information of any breach of the security of the data
immediately following discovery, if the personal information was, or is
reasonably believed to have been, acquired by an unauthorized
person.
(d)
The notification required by this Code section may be delayed if a law
enforcement agency determines that the notification will impede a criminal
investigation. The notification required by this Code section shall be made
after the law enforcement agency determines that it will not compromise the
investigation.
(e)
For purposes of this Code section, notice shall be provided by one of the
following methods:
(1)
Written notice;
(2)
Electronic notice, if the notice provided is consistent with the provisions
regarding electronic records and signatures set forth in Section 7001 of Title
15 of the United States Code; or
(3)
Substitute notice, if the person or business demonstrates that the cost of
providing notice would exceed $250,000.00, the affected class of subject persons
to be notified exceeds 500,000, or the person or business does not have
sufficient contact information. Substitute notice shall consist of all of the
following:
(A)
E-mail notice when the person or business has an e-mail address for the subject
persons;
(B)
Conspicuous posting of the notice on the website page of the person or business,
if the person or business maintains one; and
(C)
Notification to major state-wide media.
(f)
Notwithstanding subsection (e) of this Code section, a person or business that
maintains its own notification procedures as part of an information security
policy for the treatment of personal information and is otherwise consistent
with the timing requirements of this Code section shall be deemed to be in
compliance with the notification requirements of this Code section if the person
or business notifies affected persons in accordance with its policies in the
event of a breach of the security of the system.
(g)(1)
Any person injured by a violation of this Code section may institute a civil
action to recover damages.
(2)
Any business that violates, proposes to violate, or has violated this title may
be enjoined.
(3)
The rights and remedies available under this subsection are cumulative to each
other and to any other rights and remedies available under
law."
SECTION
3.
Chapter
18 of Title 50 of the Official Code of Georgia Annotated, relating to state
printing and documents, is amended by adding a new article to read as
follows:
"ARTICLE
8
50-18-140.
(a)
As used in this Code section, the term:
(1)
'Agency' means any:
(A)
State department, agency, board, bureau, commission, public corporation, or
authority;
(B)
County, municipal corporation, school district, or other political subdivision
of this state;
(C)
Department, agency, board, bureau, commission, authority, or similar body of
each such county, municipal corporation, or other political subdivision of the
state; or
(D)
City, county, regional, or other authority established pursuant to the laws of
this state.
(2)
'Breach of the security of the system' means unauthorized acquisition of
computerized data that compromises the security, confidentiality, or integrity
of personal information maintained by the agency. Good faith acquisition of
personal information by an employee or agent of the agency for the purposes of
the agency is not a breach of the security of the system, provided that the
personal information is not used or subject to further unauthorized
disclosure.
(3)
'Personal information' means an
individuaĺs
first name or first initial and last name in combination with any one or more of
the following data elements, when either the name or the data elements are not
encrypted:
(A)
Social security number;
(B)
Driveŕs
license number or Georgia identification card number; or
(C)
Account number, credit card number, or debit card number, in combination with
any required security code, access code, or password that would permit access to
an
individuaĺs
financial account.
The
term 'personal information' does not include publicly available information that
is lawfully made available to the general public from federal, state, or local
government records nor any information that is maintained by any law enforcement
agency of the state or any county or municipality exclusively for law
enforcement purposes.
(b)
Any agency that owns or licenses computerized data that includes personal
information shall disclose any breach of the security of the system following
discovery or notification of the breach in the security of the data to any
resident of this state whose unencrypted personal information was, or is
reasonably believed to have been, acquired by an unauthorized person. The
disclosure shall be made in the most expedient time possible and without
unreasonable delay, consistent with the legitimate needs of law enforcement as
provided in subsection (d) of this Code section or any measures necessary to
determine the scope of the breach and restore the reasonable integrity of the
data system.
(c)
Any agency that maintains computerized data that includes personal information
that the agency does not own shall notify the owner or licensee of the
information of any breach of the security of the data immediately following
discovery, if the personal information was, or is reasonably believed to have
been, acquired by an unauthorized person.
(d)
The notification required by this Code section may be delayed if a law
enforcement agency determines that the notification will impede a criminal
investigation. The notification required by this Code section shall be made
after the law enforcement agency determines that it will not compromise the
investigation.
(e)
For purposes of this Code section, notice shall be provided by one of the
following methods:
(1)
Written notice;
(2)
Electronic notice, if the notice provided is consistent with the provisions
regarding electronic records and signatures set forth in Section 7001 of Title
15 of the United States Code; or
(3)
Substitute notice, if the agency demonstrates that the cost of providing notice
would exceed $250,000.00, the affected class of subject persons to be notified
exceeds 500,000, or the agency does not have sufficient contact information.
Substitute notice shall consist of all of the following:
(A)
E-mail notice when the agency has an e-mail address for the subject
persons;
(B)
Conspicuous posting of the notice on the
agencýs
website page, if the agency maintains one; and
(C)
Notification to major state-wide media.
(f)
Notwithstanding subsection (e) of this Code section, an agency that maintains
its own notification procedures as part of an information security policy for
the treatment of personal information and is otherwise consistent with the
timing requirements of this article shall be deemed to be in compliance with the
notification requirements of this section if it notifies affected persons in
accordance with its policies in the event of a breach of the security of the
system."
SECTION
4.
All
laws and parts of laws in conflict with this Act are repealed.