In Georgia, the release by Secretary of State Brian Kemp’s office of the
addresses, dates of birth and Social Security and driver’s license numbers of
the state’s more than 6.1 million registered voters is more than water cooler
talk. Geogians from Ringgold to Valdosta and everywhere in between are upset,
and two people have already filed a class-action lawsuit against the state.
So do they have a case? Drew’s informative and engaging analysis addresses
that question in Friday’s Fulton County Daily Report. While the release
of the personally identifiable information appears to be a violation of
Georgia’s 8-year-old Personal Identity Protection Act, the plaintiffs’ recourse
appears limited. Drew notes that they don’t seek damages in the lawsuit. He also
points out that, unlike other states’ data breach notification laws, Georgia’s
statute doesn’t expressly create a private right of action or include statutory
penalties. And had plaintiffs sought damages, Drew adds, it probably would have
triggered a sovereign immunity fight.
Click here to read the column.